@hasna/bridge 0.1.0 → 0.1.1

package/LICENSE

@@ -2,13 +2,180 @@ Apache License
 Version 2.0, January 2004
 http://www.apache.org/licenses/
 
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright
+owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities
+that control, are controlled by, or are under common control with that entity.
+For the purposes of this definition, "control" means (i) the power, direct or
+indirect, to cause the direction or management of such entity, whether by
+contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including
+but not limited to software source code, documentation source, and configuration
+files.
+
+"Object" form shall mean any form resulting from mechanical transformation or
+translation of a Source form, including but not limited to compiled object code,
+generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form,
+made available under the License, as indicated by a copyright notice that is
+included in or attached to the work (an example is provided in the Appendix
+below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that
+is based on (or derived from) the Work and for which the editorial revisions,
+annotations, elaborations, or other modifications represent, as a whole, an
+original work of authorship. For the purposes of this License, Derivative Works
+shall not include works that remain separable from, or merely link (or bind by
+name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original
+version of the Work and any modifications or additions to that Work or
+Derivative Works thereof, that is intentionally submitted to Licensor for
+inclusion in the Work by the copyright owner or by an individual or Legal Entity
+authorized to submit on behalf of the copyright owner. For the purposes of this
+definition, "submitted" means any form of electronic, verbal, or written
+communication sent to the Licensor or its representatives, including but not
+limited to communication on electronic mailing lists, source code control
+systems, and issue tracking systems that are managed by, or on behalf of, the
+Licensor for the purpose of discussing and improving the Work, but excluding
+communication that is conspicuously marked or otherwise designated in writing by
+the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
+of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this
+section) patent license to make, have made, use, offer to sell, sell, import,
+and otherwise transfer the Work, where such license applies only to those patent
+claims licensable by such Contributor that are necessarily infringed by their
+Contribution(s) alone or by combination of their Contribution(s) with the Work
+to which such Contribution(s) was submitted. If You institute patent litigation
+against any entity (including a cross-claim or counterclaim in a lawsuit)
+alleging that the Work or a Contribution incorporated within the Work
+constitutes direct or contributory patent infringement, then any patent licenses
+granted to You under this License for that Work shall terminate as of the date
+such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and in
+Source or Object form, provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a copy
+of this License; and
+
+(b) You must cause any modified files to carry prominent notices stating that
+You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You
+distribute, all copyright, patent, trademark, and attribution notices from the
+Source form of the Work, excluding those notices that do not pertain to any part
+of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution, then
+any Derivative Works that You distribute must include a readable copy of the
+attribution notices contained within such NOTICE file, excluding those notices
+that do not pertain to any part of the Derivative Works, in at least one of the
+following places: within a NOTICE text file distributed as part of the
+Derivative Works; within the Source form or documentation, if provided along
+with the Derivative Works; or, within a display generated by the Derivative
+Works, if and wherever such third-party notices normally appear. The contents of
+the NOTICE file are for informational purposes only and do not modify the
+License. You may add Your own attribution notices within Derivative Works that
+You distribute, alongside or as an addendum to the NOTICE text from the Work,
+provided that such additional attribution notices cannot be construed as
+modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide
+additional or different license terms and conditions for use, reproduction, or
+distribution of Your modifications, or for any such Derivative Works as a whole,
+provided Your use, reproduction, and distribution of the Work otherwise complies
+with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any
+Contribution intentionally submitted for inclusion in the Work by You to the
+Licensor shall be under the terms and conditions of this License, without any
+additional terms or conditions. Notwithstanding the above, nothing herein shall
+supersede or modify the terms of any separate license agreement you may have
+executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor, except as required
+for reasonable and customary use in describing the origin of the Work and
+reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
+writing, Licensor provides the Work (and each Contributor provides its
+Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied, including, without limitation, any warranties or
+conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any risks
+associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in
+tort (including negligence), contract, or otherwise, unless required by
+applicable law (such as deliberate and grossly negligent acts) or agreed to in
+writing, shall any Contributor be liable to You for damages, including any
+direct, indirect, special, incidental, or consequential damages of any character
+arising as a result of this License or out of the use or inability to use the
+Work (including but not limited to damages for loss of goodwill, work stoppage,
+computer failure or malfunction, or any and all other commercial damages or
+losses), even if such Contributor has been advised of the possibility of such
+damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or
+Derivative Works thereof, You may choose to offer, and charge a fee for,
+acceptance of support, warranty, indemnity, or other liability obligations
+and/or rights consistent with this License. However, in accepting such
+obligations, You may act only on Your own behalf and on Your sole
+responsibility, not on behalf of any other Contributor, and only if You agree to
+indemnify, defend, and hold each Contributor harmless for any liability incurred
+by, or claims asserted against, such Contributor by reason of your accepting any
+such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate
+notice, with the fields enclosed by brackets "[]" replaced with your own
+identifying information. (Do not include the brackets!) The text should be
+enclosed in the appropriate comment syntax for the file format. We also
+recommend that a file or class name and description of purpose be included on
+the same "printed page" as the copyright notice for easier identification within
+third-party archives.
+
 Copyright 2026 Hasna
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-http://www.apache.org/licenses/LICENSE-2.0
+    http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,

package/README.md

@@ -89,6 +89,7 @@ Override with `BRIDGE_HOME` or `BRIDGE_CONFIG`.
 Telegram bot tokens should stay in environment variables; config stores the env
 var name, not the token value. Telegram channels fail closed unless
 `allowedChatIds` are set or `allowAllChats` is explicitly enabled.
-Channel-level `allowedChatIds` are enforced before route matching, and long-poll
-offsets are persisted in `~/.hasna/bridge/state.json` so restarts do not replay
-already-seen updates.
+Disabled channels do not match or deliver routes. Channel-level `allowedChatIds`
+are enforced before route matching, and long-poll offsets are persisted in
+`~/.hasna/bridge/state.json` so restarts do not replay already-seen updates.
+MCP config inspection redacts profile and agent environment values.

package/dist/cli/index.js

@@ -6305,7 +6305,54 @@ async function upsertRoute(route, configPath = defaultConfigPath()) {
   return config;
 }
 // src/lib/doctor.ts
-import { access } from "fs/promises";
+import { stat } from "fs/promises";
+
+// src/lib/state.ts
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2, join as join2 } from "path";
+function defaultStatePath() {
+  return process.env["BRIDGE_STATE"] || join2(bridgeHome(), "state.json");
+}
+function emptyState() {
+  return { telegramOffsets: {} };
+}
+async function loadState(statePath = defaultStatePath()) {
+  try {
+    const raw = await readFile2(statePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    return {
+      telegramOffsets: parsed.telegramOffsets && typeof parsed.telegramOffsets === "object" ? parsed.telegramOffsets : {}
+    };
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+      return emptyState();
+    }
+    throw err;
+  }
+}
+async function saveState(state, statePath = defaultStatePath()) {
+  await mkdir2(dirname2(statePath), { recursive: true, mode: 448 });
+  await writeFile2(statePath, `${JSON.stringify(state, null, 2)}
+`, { encoding: "utf-8", mode: 384 });
+  await chmod2(statePath, 384);
+}
+
+// src/lib/doctor.ts
+function isNotFound(err) {
+  return Boolean(err && typeof err === "object" && "code" in err && err.code === "ENOENT");
+}
+async function privateFileCheck(name, path) {
+  try {
+    const info = await stat(path);
+    const mode = info.mode & 511;
+    const ok = (mode & 63) === 0;
+    return { name, ok, detail: `${path} mode=${mode.toString(8)}` };
+  } catch (err) {
+    if (isNotFound(err))
+      return { name, ok: true, detail: `not created yet: ${path}` };
+    return { name, ok: false, detail: `${path}: ${err instanceof Error ? err.message : String(err)}` };
+  }
+}
 async function commandExists(command) {
   const proc = Bun.spawn(["sh", "-lc", `command -v ${command} >/dev/null 2>&1`], {
     stdout: "ignore",
@@ -6313,15 +6360,11 @@ async function commandExists(command) {
   });
   return await proc.exited === 0;
 }
-async function doctor(configPath = defaultConfigPath()) {
+async function doctor(configPath = defaultConfigPath(), statePath = defaultStatePath()) {
   const checks = [];
   let config = await loadConfig(configPath);
-  try {
-    await access(configPath);
-    checks.push({ name: "config", ok: true, detail: configPath });
-  } catch {
-    checks.push({ name: "config", ok: true, detail: `not created yet: ${configPath}` });
-  }
+  checks.push(await privateFileCheck("config", configPath));
+  checks.push(await privateFileCheck("state", statePath));
   for (const command of ["bridge", "codewith", "claude", "aicopilot"]) {
     checks.push({
       name: `command:${command}`,
@@ -6413,6 +6456,8 @@ function telegramUpdateToMessage(channelId, update) {
 // src/lib/router.ts
 function matchingRoutes(config, message) {
   const channel = config.channels[message.channelId];
+  if (!channel || channel.enabled === false)
+    return [];
   if (channel?.kind === "telegram" && !telegramChatAllowed(channel, message.chatId)) {
     return [];
   }
@@ -6440,6 +6485,10 @@ async function routeMessage(config, message, options = {}) {
     let deliveredResponse = false;
     const channel = responseChannel(config, route, message);
     const responseText = agent.stdout.trim();
+    if (channel?.enabled === false) {
+      results.push({ route, agent, deliveredResponse });
+      continue;
+    }
     if (responseText && channel?.kind === "telegram" && message.chatId) {
       if (!telegramChatAllowed(channel, message.chatId)) {
         results.push({ route, agent, deliveredResponse });
@@ -6456,35 +6505,6 @@ async function routeMessage(config, message, options = {}) {
   }
   return results;
 }
-// src/lib/state.ts
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2, join as join2 } from "path";
-function defaultStatePath() {
-  return process.env["BRIDGE_STATE"] || join2(bridgeHome(), "state.json");
-}
-function emptyState() {
-  return { telegramOffsets: {} };
-}
-async function loadState(statePath = defaultStatePath()) {
-  try {
-    const raw = await readFile2(statePath, "utf-8");
-    const parsed = JSON.parse(raw);
-    return {
-      telegramOffsets: parsed.telegramOffsets && typeof parsed.telegramOffsets === "object" ? parsed.telegramOffsets : {}
-    };
-  } catch (err) {
-    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
-      return emptyState();
-    }
-    throw err;
-  }
-}
-async function saveState(state, statePath = defaultStatePath()) {
-  await mkdir2(dirname2(statePath), { recursive: true, mode: 448 });
-  await writeFile2(statePath, `${JSON.stringify(state, null, 2)}
-`, { encoding: "utf-8", mode: 384 });
-  await chmod2(statePath, 384);
-}
 // src/cli/index.ts
 function version() {
   try {

package/dist/index.js

@@ -4099,6 +4099,7 @@ function defaultConfigPath() {
 }
 
 // src/lib/config.ts
+var REDACTED_VALUE = "[redacted]";
 var channelSchema = exports_external.discriminatedUnion("kind", [
   exports_external.object({
     id: exports_external.string().min(1),
@@ -4186,6 +4187,31 @@ function parseConfig(value) {
   const parsed = configSchema.parse(value);
   return parsed;
 }
+function redactEnv(env) {
+  if (!env)
+    return;
+  return Object.fromEntries(Object.keys(env).map((key) => [key, REDACTED_VALUE]));
+}
+function redactEnvRecord(items) {
+  return Object.fromEntries(Object.entries(items).map(([id, item]) => {
+    const clone = { ...item };
+    if (item.env)
+      clone.env = redactEnv(item.env);
+    return [id, clone];
+  }));
+}
+function redactConfig(config) {
+  return {
+    ...config,
+    channels: Object.fromEntries(Object.entries(config.channels).map(([id, channel]) => [id, { ...channel }])),
+    profiles: redactEnvRecord(config.profiles),
+    agents: redactEnvRecord(config.agents),
+    routes: config.routes.map((route) => ({
+      ...route,
+      match: route.match ? { ...route.match, chatIds: route.match.chatIds ? [...route.match.chatIds] : undefined } : undefined
+    }))
+  };
+}
 async function loadConfig(configPath = defaultConfigPath()) {
   try {
     const raw = await readFile(configPath, "utf-8");
@@ -4234,7 +4260,54 @@ async function upsertRoute(route, configPath = defaultConfigPath()) {
   return config;
 }
 // src/lib/doctor.ts
-import { access } from "fs/promises";
+import { stat } from "fs/promises";
+
+// src/lib/state.ts
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2, join as join2 } from "path";
+function defaultStatePath() {
+  return process.env["BRIDGE_STATE"] || join2(bridgeHome(), "state.json");
+}
+function emptyState() {
+  return { telegramOffsets: {} };
+}
+async function loadState(statePath = defaultStatePath()) {
+  try {
+    const raw = await readFile2(statePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    return {
+      telegramOffsets: parsed.telegramOffsets && typeof parsed.telegramOffsets === "object" ? parsed.telegramOffsets : {}
+    };
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+      return emptyState();
+    }
+    throw err;
+  }
+}
+async function saveState(state, statePath = defaultStatePath()) {
+  await mkdir2(dirname2(statePath), { recursive: true, mode: 448 });
+  await writeFile2(statePath, `${JSON.stringify(state, null, 2)}
+`, { encoding: "utf-8", mode: 384 });
+  await chmod2(statePath, 384);
+}
+
+// src/lib/doctor.ts
+function isNotFound(err) {
+  return Boolean(err && typeof err === "object" && "code" in err && err.code === "ENOENT");
+}
+async function privateFileCheck(name, path) {
+  try {
+    const info = await stat(path);
+    const mode = info.mode & 511;
+    const ok = (mode & 63) === 0;
+    return { name, ok, detail: `${path} mode=${mode.toString(8)}` };
+  } catch (err) {
+    if (isNotFound(err))
+      return { name, ok: true, detail: `not created yet: ${path}` };
+    return { name, ok: false, detail: `${path}: ${err instanceof Error ? err.message : String(err)}` };
+  }
+}
 async function commandExists(command) {
   const proc = Bun.spawn(["sh", "-lc", `command -v ${command} >/dev/null 2>&1`], {
     stdout: "ignore",
@@ -4242,15 +4315,11 @@ async function commandExists(command) {
   });
   return await proc.exited === 0;
 }
-async function doctor(configPath = defaultConfigPath()) {
+async function doctor(configPath = defaultConfigPath(), statePath = defaultStatePath()) {
   const checks = [];
   let config = await loadConfig(configPath);
-  try {
-    await access(configPath);
-    checks.push({ name: "config", ok: true, detail: configPath });
-  } catch {
-    checks.push({ name: "config", ok: true, detail: `not created yet: ${configPath}` });
-  }
+  checks.push(await privateFileCheck("config", configPath));
+  checks.push(await privateFileCheck("state", statePath));
   for (const command of ["bridge", "codewith", "claude", "aicopilot"]) {
     checks.push({
       name: `command:${command}`,
@@ -4342,6 +4411,8 @@ function telegramUpdateToMessage(channelId, update) {
 // src/lib/router.ts
 function matchingRoutes(config, message) {
   const channel = config.channels[message.channelId];
+  if (!channel || channel.enabled === false)
+    return [];
   if (channel?.kind === "telegram" && !telegramChatAllowed(channel, message.chatId)) {
     return [];
   }
@@ -4369,6 +4440,10 @@ async function routeMessage(config, message, options = {}) {
     let deliveredResponse = false;
     const channel = responseChannel(config, route, message);
     const responseText = agent.stdout.trim();
+    if (channel?.enabled === false) {
+      results.push({ route, agent, deliveredResponse });
+      continue;
+    }
     if (responseText && channel?.kind === "telegram" && message.chatId) {
       if (!telegramChatAllowed(channel, message.chatId)) {
         results.push({ route, agent, deliveredResponse });
@@ -4385,35 +4460,6 @@ async function routeMessage(config, message, options = {}) {
   }
   return results;
 }
-// src/lib/state.ts
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2, join as join2 } from "path";
-function defaultStatePath() {
-  return process.env["BRIDGE_STATE"] || join2(bridgeHome(), "state.json");
-}
-function emptyState() {
-  return { telegramOffsets: {} };
-}
-async function loadState(statePath = defaultStatePath()) {
-  try {
-    const raw = await readFile2(statePath, "utf-8");
-    const parsed = JSON.parse(raw);
-    return {
-      telegramOffsets: parsed.telegramOffsets && typeof parsed.telegramOffsets === "object" ? parsed.telegramOffsets : {}
-    };
-  } catch (err) {
-    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
-      return emptyState();
-    }
-    throw err;
-  }
-}
-async function saveState(state, statePath = defaultStatePath()) {
-  await mkdir2(dirname2(statePath), { recursive: true, mode: 448 });
-  await writeFile2(statePath, `${JSON.stringify(state, null, 2)}
-`, { encoding: "utf-8", mode: 384 });
-  await chmod2(statePath, 384);
-}
 export {
   upsertRoute,
   upsertProfile,
@@ -4428,6 +4474,7 @@ export {
   runAgent,
   routeMessage,
   resolveAgent,
+  redactConfig,
   parseConfig,
   matchingRoutes,
   loadState,

package/dist/lib/config.d.ts

@@ -1,6 +1,7 @@
 import { type AgentConfig, type BridgeConfig, type ChannelConfig, type ProfileConfig, type RouteConfig } from "../types.js";
 export declare function emptyConfig(): BridgeConfig;
 export declare function parseConfig(value: unknown): BridgeConfig;
+export declare function redactConfig(config: BridgeConfig): BridgeConfig;
 export declare function loadConfig(configPath?: string): Promise<BridgeConfig>;
 export declare function saveConfig(config: BridgeConfig, configPath?: string): Promise<void>;
 export declare function ensureConfig(configPath?: string): Promise<BridgeConfig>;

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAmF5I,wBAAgB,WAAW,IAAI,YAAY,CAQ1C;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAGxD;AAED,wBAAsB,UAAU,CAAC,UAAU,SAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAUxF;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,SAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtG;AAED,wBAAsB,YAAY,CAAC,UAAU,SAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAI1F;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,SAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAKnH;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,SAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAKnH;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,SAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAK7G;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,SAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAK7G"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAqF5I,wBAAgB,WAAW,IAAI,YAAY,CAQ1C;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAGxD;AAeD,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAW/D;AAED,wBAAsB,UAAU,CAAC,UAAU,SAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAUxF;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,SAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtG;AAED,wBAAsB,YAAY,CAAC,UAAU,SAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAI1F;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,SAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAKnH;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,SAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAKnH;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,SAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAK7G;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,SAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAK7G"}

package/dist/lib/doctor.d.ts

@@ -1,3 +1,3 @@
 import type { DoctorReport } from "../types.js";
-export declare function doctor(configPath?: string): Promise<DoctorReport>;
+export declare function doctor(configPath?: string, statePath?: string): Promise<DoctorReport>;
 //# sourceMappingURL=doctor.d.ts.map

package/dist/lib/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/lib/doctor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAe,YAAY,EAAE,MAAM,aAAa,CAAC;AAU7D,wBAAsB,MAAM,CAAC,UAAU,SAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CA2CpF"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/lib/doctor.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,YAAY,EAAE,MAAM,aAAa,CAAC;AA0B7D,wBAAsB,MAAM,CAAC,UAAU,SAAsB,EAAE,SAAS,SAAqB,GAAG,OAAO,CAAC,YAAY,CAAC,CAuCpH"}

package/dist/lib/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/lib/router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAiB,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAsC,MAAM,eAAe,CAAC;AAExF,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,OAAO,QAAQ,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1C,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC;CACjD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,GAAG,WAAW,EAAE,CAa1F;AAMD,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CA2BhC"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/lib/router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAiB,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAsC,MAAM,eAAe,CAAC;AAExF,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,OAAO,QAAQ,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1C,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC;CACjD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,GAAG,WAAW,EAAE,CAc1F;AAMD,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAgChC"}

package/dist/mcp/index.js

@@ -4101,6 +4101,7 @@ function defaultConfigPath() {
 }
 
 // src/lib/config.ts
+var REDACTED_VALUE = "[redacted]";
 var channelSchema = exports_external.discriminatedUnion("kind", [
   exports_external.object({
     id: exports_external.string().min(1),
@@ -4188,6 +4189,31 @@ function parseConfig(value) {
   const parsed = configSchema.parse(value);
   return parsed;
 }
+function redactEnv(env) {
+  if (!env)
+    return;
+  return Object.fromEntries(Object.keys(env).map((key) => [key, REDACTED_VALUE]));
+}
+function redactEnvRecord(items) {
+  return Object.fromEntries(Object.entries(items).map(([id, item]) => {
+    const clone = { ...item };
+    if (item.env)
+      clone.env = redactEnv(item.env);
+    return [id, clone];
+  }));
+}
+function redactConfig(config) {
+  return {
+    ...config,
+    channels: Object.fromEntries(Object.entries(config.channels).map(([id, channel]) => [id, { ...channel }])),
+    profiles: redactEnvRecord(config.profiles),
+    agents: redactEnvRecord(config.agents),
+    routes: config.routes.map((route) => ({
+      ...route,
+      match: route.match ? { ...route.match, chatIds: route.match.chatIds ? [...route.match.chatIds] : undefined } : undefined
+    }))
+  };
+}
 async function loadConfig(configPath = defaultConfigPath()) {
   try {
     const raw = await readFile(configPath, "utf-8");
@@ -4200,7 +4226,30 @@ async function loadConfig(configPath = defaultConfigPath()) {
   }
 }
 // src/lib/doctor.ts
-import { access } from "fs/promises";
+import { stat } from "fs/promises";
+
+// src/lib/state.ts
+import { dirname, join as join2 } from "path";
+function defaultStatePath() {
+  return process.env["BRIDGE_STATE"] || join2(bridgeHome(), "state.json");
+}
+
+// src/lib/doctor.ts
+function isNotFound(err) {
+  return Boolean(err && typeof err === "object" && "code" in err && err.code === "ENOENT");
+}
+async function privateFileCheck(name, path) {
+  try {
+    const info = await stat(path);
+    const mode = info.mode & 511;
+    const ok = (mode & 63) === 0;
+    return { name, ok, detail: `${path} mode=${mode.toString(8)}` };
+  } catch (err) {
+    if (isNotFound(err))
+      return { name, ok: true, detail: `not created yet: ${path}` };
+    return { name, ok: false, detail: `${path}: ${err instanceof Error ? err.message : String(err)}` };
+  }
+}
 async function commandExists(command) {
   const proc = Bun.spawn(["sh", "-lc", `command -v ${command} >/dev/null 2>&1`], {
     stdout: "ignore",
@@ -4208,15 +4257,11 @@ async function commandExists(command) {
   });
   return await proc.exited === 0;
 }
-async function doctor(configPath = defaultConfigPath()) {
+async function doctor(configPath = defaultConfigPath(), statePath = defaultStatePath()) {
   const checks = [];
   let config = await loadConfig(configPath);
-  try {
-    await access(configPath);
-    checks.push({ name: "config", ok: true, detail: configPath });
-  } catch {
-    checks.push({ name: "config", ok: true, detail: `not created yet: ${configPath}` });
-  }
+  checks.push(await privateFileCheck("config", configPath));
+  checks.push(await privateFileCheck("state", statePath));
   for (const command of ["bridge", "codewith", "claude", "aicopilot"]) {
     checks.push({
       name: `command:${command}`,
@@ -4279,6 +4324,8 @@ async function sendTelegramMessage(token, chatId, text) {
 // src/lib/router.ts
 function matchingRoutes(config, message) {
   const channel = config.channels[message.channelId];
+  if (!channel || channel.enabled === false)
+    return [];
   if (channel?.kind === "telegram" && !telegramChatAllowed(channel, message.chatId)) {
     return [];
   }
@@ -4306,6 +4353,10 @@ async function routeMessage(config, message, options = {}) {
     let deliveredResponse = false;
     const channel = responseChannel(config, route, message);
     const responseText = agent.stdout.trim();
+    if (channel?.enabled === false) {
+      results.push({ route, agent, deliveredResponse });
+      continue;
+    }
     if (responseText && channel?.kind === "telegram" && message.chatId) {
       if (!telegramChatAllowed(channel, message.chatId)) {
         results.push({ route, agent, deliveredResponse });
@@ -4327,9 +4378,9 @@ function text(value) {
   return { content: [{ type: "text", text: typeof value === "string" ? value : JSON.stringify(value, null, 2) }] };
 }
 function buildServer() {
-  const server = new McpServer({ name: "bridge", version: "0.1.0" });
+  const server = new McpServer({ name: "bridge", version: "0.1.1" });
   server.tool("bridge_status", {}, async () => text(await doctor()));
-  server.tool("bridge_config", {}, async () => text(await loadConfig()));
+  server.tool("bridge_config", {}, async () => text(redactConfig(await loadConfig())));
   server.tool("bridge_route_message", {
     channelId: exports_external.string(),
     text: exports_external.string(),

package/docs/architecture.md

@@ -43,5 +43,9 @@ Telegram channels fail closed unless `allowedChatIds` are configured or
 before route matching. Routes can also add narrower `match.chatIds` filters, but
 they cannot expand beyond the channel allowlist.
 
+Disabled channels do not match inbound routes and do not deliver responses.
+MCP config inspection redacts profile and agent environment values so local
+secrets are not exposed through `bridge_config`.
+
 Long-poll offsets are persisted in a private state file so process restarts do
 not replay already-seen updates and re-run agents.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/bridge",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Agent messaging bridge for Telegram and other channels",
   "type": "module",
   "main": "dist/index.js",
@@ -29,7 +29,7 @@
     "dev:cli": "bun run src/cli/index.ts",
     "dev:mcp": "bun run src/mcp/index.ts",
     "prepublishOnly": "bun run build",
-    "postinstall": "bun -e \"const fs=require('node:fs');const path=require('node:path');const dir=path.join(process.env.HOME||process.cwd(),'.hasna','bridge');fs.mkdirSync(dir,{recursive:true,mode:0o700});try{fs.chmodSync(dir,0o700)}catch{}\""
+    "postinstall": "node -e \"const fs=require('node:fs');const path=require('node:path');const dir=path.join(process.env.HOME||process.cwd(),'.hasna','bridge');fs.mkdirSync(dir,{recursive:true,mode:0o700});try{fs.chmodSync(dir,0o700)}catch{}\""
   },
   "keywords": [
     "bridge",