bridgerator 1.0.8 → 1.1.0

package/README.md

@@ -34,35 +34,46 @@ Details: https://bridgerator.recondeck.com/pricing
    ```powershell
    & ([scriptblock]::Create((irm https://bridgerator.recondeck.com/install.ps1)))
    ```
-   It downloads portable Node.js LTS if missing (checksum-verified, no admin), installs this package and runs `bridgerator.cmd setup`.
+   It downloads the signed Bridgerator app for Windows (`bridgerator.exe` with Node.js inside — nothing else to install; x64 and ARM64), checks it (SHA256 of the download and of every file), puts it into `%LOCALAPPDATA%\Bridgerator\app` and runs `bridgerator.cmd setup`. An older npm install is replaced, its key and settings kept. `-UseNpm` installs this npm package instead (your Node.js 22+, or a portable Node.js 24 LTS, checksum-verified; the package SHA256-checked, `--ignore-scripts`). Works under the default Restricted execution policy. `-NoTelemetry` turns off the usage counts (see Privacy).
 3. A browser tab opens with a code: check that it matches the one in PowerShell and click **Connect this computer**. Done — no key to copy.
 
 Update later with the same line (the key and folder settings are kept). Prefer to read first? Download `install.ps1`, read it, then run it.
 Servers or PCs without a browser: create a device key in your account (Add a computer → Advanced) and add `-Token <device key>` to the line.
 
-Manual install (PowerShell): `$env:PUPPETEER_SKIP_DOWNLOAD=1; npm.cmd install -g bridgerator`, then `bridgerator.cmd setup` (or `bridgerator.cmd setup --token <key>`). The variable skips a ~700 MB Chrome download that only PDF export needs; PDF export fetches a browser itself on first use.
+Manual install (PowerShell): `$env:PUPPETEER_SKIP_DOWNLOAD=1; npm.cmd install -g bridgerator --ignore-scripts`, then `bridgerator.cmd setup` (or `bridgerator.cmd setup --token <key>`). The variable skips a ~700 MB Chrome download that only PDF export needs; PDF export fetches a browser itself on first use.
 
 Other MCP clients: server URL `https://mcp.bridgerator.recondeck.com/mcp`, OAuth sign-in.
 
 ## Access rules — what the assistant can and cannot touch
 
-Config: `%APPDATA%\Bridgerator\config.json` (written by `setup`, edit and restart to change).
+Config: `%APPDATA%\Bridgerator\config.json` (written by `setup` and the window; a running bridge picks up a hand edit within seconds — lowering protection waits for Apply in a notification on the PC). Every setting can also be read and changed by the assistant with `bridgerator_settings` (lowering protection / widening access → your OK on the PC).
+
+By default nothing is restricted (like the engine on its own), except that **deletions go to the Recycle Bin** and **file changes can be undone**.
 
 | Key | Meaning | Default |
 |---|---|---|
-| `allowedDirectories` | File tools work only inside these folders (enforced by the engine). Empty = whole disk. | your user folder |
-| `deniedDirectories` | Folders excluded **inside** the allowed ones (enforced by Bridgerator, see below). | `~\.ssh`, `~\AppData` |
-| `blockedCommands` | Commands the engine refuses to run. Leave it out to keep the built-in list. | built-in list (`format`, `diskpart`, `reg`, `net`, `sc`, `runas`, `netsh`, `takeown`, …) |
-| `disabledTools` | Tools never shown to the assistant, e.g. `["start_process","interact_with_process"]` to turn the terminal off. | none |
+| `allowedDirectories` | File tools work only inside these folders. Empty = all folders except the always-blocked ones. | empty (all folders) |
+| `deniedDirectories` | Folders excluded **inside** the allowed ones (enforced by Bridgerator, see below). Always excluded, can't be removed: Bridgerator itself — `%APPDATA%\Bridgerator`, `%LOCALAPPDATA%\Bridgerator` (snapshots too), the package in `%APPDATA%\npm`. | none |
+| `protectSensitive` | "Protect sensitive folders": also excludes `%APPDATA%\npm`, Startup, `Documents\WindowsPowerShell`/`PowerShell`, `~\.ssh .aws .azure .kube .docker .gnupg .config .npmrc .git-credentials .gitconfig .claude`, `~\AppData`. | `false` |
+| `recycleBin` | A plain delete command (`Remove-Item`, `del`, `erase`, `rd`/`rmdir`, `rm` with literal paths or a wildcard in the last part) moves the items to the Recycle Bin instead; no Recycle Bin on that drive (network, many USB sticks) → asked on the PC first. Scripts, pipelines and other programs that delete are not caught: a safety net, not a guarantee. | `true` |
+| `snapshots` | `{enabled, days, maxMb, maxFileMb}`: a copy of a file before the assistant writes, edits, moves or (through the Recycle Bin path) deletes it, in `%LOCALAPPDATA%\Bridgerator\snapshots`; Undo in the window (Recent → Undo, "Undo AI changes…" per task / batch) and `bridgerator_undo`. A file changed after the assistant's action is never overwritten. Bigger files get no copy ("no undo"). | on, 7 days, 500 MB, 50 MB |
+| `fuse` | `{enabled, limit}`: more than `limit` deletions / moves within a minute → Bridgerator pauses itself and asks on the PC whether to continue (no answer = stays paused). | off, 20 |
+| `keepAwake` | The PC doesn't go to sleep while the assistant works or the task queue has work (mains power only; the screen can still turn off). | `true` |
+| `readOnlyDirectories` | Readable, but `write_file`, `edit_block`, `move_file` (either side), `create_directory` are refused. The terminal is not bound by it. `bridgerator.cmd read-only add\|remove <dir>` | none |
+| `confirm.ini` (next to config.json) | Off by default. When on, a Windows notification on the PC (Allow / Allow 10 min / Deny, "Allow always" in its `...` menu; no answer in 2 min = Deny) before **risky** calls: `delete` and `dangerous_commands` (pattern lists, a safety net — an obfuscated command can slip through), optionally `write_files`, `move`, `any_command`, plus your own `[patterns]`. Re-read on every call. `bridgerator.cmd confirm on\|off [category]`; the assistant can only ask (`request_confirm_off`, approved on the PC). If notifications are off for Bridgerator, a small window in the bottom-right is used instead; with Do Not Disturb the request is denied after 2 minutes. | off |
+| `blockedCommands` | A safety net of the engine: refuses commands by their first word. Not a security boundary. Leave it out to keep the built-in list. | built-in list (`format`, `diskpart`, `reg`, `net`, `sc`, `runas`, `netsh`, `takeown`, …) |
+| `telemetryEnabled` | Anonymous usage counts (see Privacy). `bridgerator.cmd telemetry off\|on` | `true` |
+| `disabledTools` | Tools the assistant can't use. The access presets set the terminal here: Read only (terminal off + every folder read-only), Files (terminal off), Full (default). `start_process`, `interact_with_process`, `kill_process` stay listed and are refused while the terminal is off. | none |
 
 Full file, search and terminal toolset, including ChatGPT widgets (file preview,
 config view). Hidden: `set_config_value` (would let the assistant change its own limits), feedback and
-usage-stats tools.
+usage-stats tools, `write_pdf` and `get_recent_tool_calls`; `read_file` with `isUrl` and UNC / device
+paths (`\\server\share`, `\\?\`, `\\.\`) are refused. Path arguments are checked at any depth.
 
 How exclusions work (`src/policy.mjs`): every path argument is resolved (symlinks and junctions
 included) and refused if it lies inside an excluded folder; result lines that mention an excluded
-path (search hits, recursive listings) are removed; `set_config_value` is never exposed, so the
-assistant cannot change these limits.
+path (search hits, recursive listings) are removed. The file tools can't reach the settings folder; the
+settings tool (`bridgerator_settings`) can only lower protection after your OK on the PC.
 
 ⚠ **The terminal is not a folder sandbox.** A shell command runs with your Windows user's rights
 and can read anything you can. Bridgerator refuses commands that literally name an excluded folder,
@@ -71,15 +82,60 @@ but that is a courtesy, not a boundary. If folder limits must be strict, add the
 
 The bridge runs as **your** Windows user (hidden scheduled task at logon), never as SYSTEM.
 
-Bridgerator gives its bundled engine its **own** config folder (`%APPDATA%\Bridgerator\dc`, see `src/dc-isolate.mjs`): if you already run the same open-source MCP server for Claude or another app, its settings and folder limits are not touched. The engine keeps a local log of recent tool calls in that folder; it never leaves your PC.
+Bridgerator gives its bundled engine its **own** config folder (`%APPDATA%\Bridgerator\dc`, see `src/dc-isolate.mjs`): if you already run the same open-source MCP server for Claude or another app, its settings and folder limits are not touched. The engine keeps a local log of recent tool calls in that folder (the per-call argument log is turned off); it never leaves your PC.
+
+## Tray, window and task queue
+
+While the bridge runs, a tray icon shows its state (green online, grey offline, yellow paused; a
+yellow / red badge when Pro is ending or the Free limit is near). Right-click: status line, **Open
+Bridgerator**, **Task queue**, **Confirm on this PC** (on / off), **Pause** (15 min, 1 hour, until
+resumed), **Open account**, **Help**, **Quit**. Double-click opens the window: Status, Task queue,
+Recent on this PC, Safety (confirmations, folders, read-only folders), Notifications, Settings
+(theme System / Light / Dark for the window and our pop-ups, English / Russian, computer name,
+start with Windows, usage stats, local history, updates, uninstall), Help.
+The tray helper (`src/tray.ps1`, hidden PowerShell, stdin/stdout JSON lines, no network) also shows
+the confirmation and setup notifications. The window is WebView2 (`ui/`; SDK DLLs in
+`vendor/webview2`, official NuGet package Microsoft.Web.WebView2 1.0.4258.31, SHA256 in
+`vendor/webview2/SHA256SUMS.txt`); without the runtime the account page opens instead.
+Stored only on this PC: the task queue (`%APPDATA%\Bridgerator\queue.json`; tools `queue_list`,
+`queue_next`, `queue_update`, `queue_add`, `queue_edit`, `queue_reorder`) and the recent calls with
+their command / path (memory; `recent.jsonl` for 7 days only with "Keep a local history" on).
+
+**Several chats at once.** Several ChatGPT chats can work on the same PC in parallel: calls run
+concurrently (a slow command doesn't hold up other chats), `queue_next` never hands the same task to
+two chats, and at most 8 actions run at a time — extra ones wait up to 30 s, then get a "busy" answer
+that is not counted.
+
+## Talk to ChatGPT
+
+Say these in any ChatGPT chat with Bridgerator connected (several chats can work at once):
+
+| Say | What happens |
+|---|---|
+| `Set up Bridgerator` | ChatGPT asks a few questions and suggests settings; you confirm them on the PC. |
+| `Add these tasks to my Bridgerator queue: …` | The tasks go into the queue on this PC (up to 100 at a time). |
+| `Work through my Bridgerator queue` | ChatGPT takes the tasks one by one and marks each done / failed with a note. |
+| `Continue my Bridgerator queue` | In a new chat: picks up tasks another chat left unfinished for 30 min. |
+| `Show my Bridgerator settings` | Folders, confirmations, notifications — what is set now (`bridgerator_settings`). |
+| `Turn on confirmations for deletions` | Raising protection applies at once; turning it off needs your OK on the PC. |
+
+Folders: with no list (the default) ChatGPT may work in all folders except the always-blocked ones;
+with a list, only in those folders. Narrowing access applies directly; widening it (adding a folder to
+the list, going back to all folders) needs your OK on the PC.
 
 ## Commands
 
 ```
-bridgerator.cmd setup [--token <key> | --pair] [--allow <dir>]... [--deny <dir>]...  # pair in the browser (no key yet, key rejected, or --pair) + config + autostart + start
+bridgerator.cmd setup [--token <key> | --pair] [--allow <dir>]... [--deny <dir>]... [--read-only <dir>]... [--no-telemetry]
+                                                                          # pair in the browser (no key yet, key rejected, or --pair) + config + autostart + start
 bridgerator.cmd run                                                       # foreground (what autostart runs)
-bridgerator.cmd status                                                    # config (token masked) + log tail
-bridgerator.cmd uninstall --all                                           # THE uninstall: stop, remove autostart, settings + key, the package and the Node.js the installer added
+bridgerator.cmd stop                                                      # stop it (starts again at the next logon)
+bridgerator.cmd status [--json]                                           # running / online / key rejected (+ config with --json)
+bridgerator.cmd confirm on|off [category]                                 # confirmation on this PC (confirm.ini)
+bridgerator.cmd setup done                                                # skip the guided setup in ChatGPT (bridgerator_setup)
+bridgerator.cmd read-only add|remove <dir>                                # read-only folders
+bridgerator.cmd telemetry on|off                                          # anonymous usage counts
+bridgerator.cmd uninstall --all                                           # THE uninstall: stop, remove autostart, settings + key, the program files (app folder or npm package) and the Node.js the installer added
 bridgerator.cmd uninstall [--keep-config]                                 # stop, remove autostart and %APPDATA%\Bridgerator (kept with --keep-config); program files stay
 ```
 Log: `%APPDATA%\Bridgerator\bridge.log`. Stopping the bridge cuts access immediately. After uninstalling, also remove the computer on the account page: https://bridgerator.recondeck.com/app
@@ -88,6 +144,12 @@ Log: `%APPDATA%\Bridgerator\bridge.log`. Stopping the bridge cuts access immedia
 
 File contents and command output go to ChatGPT (OpenAI) as tool results; the relay forwards them
 in memory and does not store them. Engine telemetry, remote feature flags and any browser pop-ups are turned off by the bridge.
+
+Bridgerator's own usage counts (`src/telemetry.mjs`, HTTPS to `https://bridgerator.recondeck.com/t`):
+events install, update, uninstall and a daily heartbeat with a random install id, bridge version,
+Windows version, OS language, Node.js version, and per-tool call / error counts of the last 24 h.
+Never paths, file names, commands, arguments, outputs or your e-mail. Off: `bridgerator.cmd telemetry off`,
+`"telemetryEnabled": false`, or the installer's `-NoTelemetry`.
 Policy: https://bridgerator.recondeck.com/privacy
 
 ## Development

package/assets/logo.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64"><rect width="64" height="64" rx="15" fill="#2251E6"/><path d="M17 42 Q32 12 47 42" fill="none" stroke="#fff" stroke-width="5.5" stroke-linecap="round"/><circle cx="17" cy="44" r="6.5" fill="#fff"/><circle cx="47" cy="44" r="6.5" fill="#7fe0ff"/></svg>