@openape/ape-agent 2.9.0 → 2.9.2

package/dist/bridge.mjs

@@ -1541,7 +1541,62 @@ import { basename, join as join22 } from "path";
 
 // ../../packages/core/dist/index.js
 import * as jose from "jose";
+import { lookup } from "dns/promises";
+import { isIP } from "net";
 var HKDF_INFO = new TextEncoder().encode("openape-sealed-box-v1");
+function isBlockedAddress(ip) {
+  const fam = isIP(ip);
+  if (fam === 4) {
+    const o3 = ip.split(".");
+    const a2 = Number(o3[0]);
+    const b2 = Number(o3[1]);
+    if (a2 === 0) return true;
+    if (a2 === 127) return true;
+    if (a2 === 10) return true;
+    if (a2 === 172 && b2 >= 16 && b2 <= 31) return true;
+    if (a2 === 192 && b2 === 168) return true;
+    if (a2 === 169 && b2 === 254) return true;
+    if (a2 === 100 && b2 >= 64 && b2 <= 127) return true;
+    return false;
+  }
+  const low = ip.toLowerCase().replace(/^\[|\]$/g, "");
+  if (low === "::" || low === "::1") return true;
+  if (low.startsWith("fe80")) return true;
+  if (low.startsWith("fc") || low.startsWith("fd")) return true;
+  const mapped = low.match(/^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/);
+  if (mapped) return isBlockedAddress(mapped[1]);
+  return false;
+}
+async function assertPublicUrl(rawUrl, opts = {}) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new Error(`Invalid URL: ${rawUrl}`);
+  }
+  const allowedSchemes = opts.allowHttp === true ? /* @__PURE__ */ new Set(["https:", "http:"]) : /* @__PURE__ */ new Set(["https:"]);
+  if (!allowedSchemes.has(url.protocol)) {
+    const expected = opts.allowHttp === true ? "http(s)" : "https";
+    throw new Error(`URL must use ${expected}:// (got ${url.protocol}//) \u2014 ${rawUrl}`);
+  }
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  const addresses = [];
+  if (isIP(host)) {
+    addresses.push(host);
+  } else {
+    const results = await lookup(host, { all: true });
+    for (const r3 of results) addresses.push(r3.address);
+  }
+  if (addresses.length === 0) {
+    throw new Error(`Host did not resolve: ${host}`);
+  }
+  for (const addr of addresses) {
+    if (isBlockedAddress(addr)) {
+      throw new Error(`Refusing to fetch a private/loopback address (${addr}) for ${rawUrl}`);
+    }
+  }
+  return url;
+}
 
 // ../../packages/grants/dist/index.js
 function normalizeSelector(selector) {
@@ -3090,8 +3145,6 @@ import { dirname, normalize, resolve } from "path";
 import { homedir as homedir23 } from "os";
 import { resolve as resolve2 } from "path";
 import process2 from "process";
-import { lookup } from "dns/promises";
-import { isIP } from "net";
 import { execFileSync } from "child_process";
 import { execFileSync as execFileSync2 } from "child_process";
 var DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
@@ -3584,59 +3637,10 @@ var gitWorktreeTools = [
     }
   }
 ];
-function isBlockedAddress(ip) {
-  const fam = isIP(ip);
-  if (fam === 4) {
-    const o3 = ip.split(".");
-    const a2 = Number(o3[0]);
-    const b2 = Number(o3[1]);
-    if (a2 === 0) return true;
-    if (a2 === 127) return true;
-    if (a2 === 10) return true;
-    if (a2 === 172 && b2 >= 16 && b2 <= 31) return true;
-    if (a2 === 192 && b2 === 168) return true;
-    if (a2 === 169 && b2 === 254) return true;
-    if (a2 === 100 && b2 >= 64 && b2 <= 127) return true;
-    return false;
-  }
-  const low = ip.toLowerCase().replace(/^\[|\]$/g, "");
-  if (low === "::" || low === "::1") return true;
-  if (low.startsWith("fe80")) return true;
-  if (low.startsWith("fc") || low.startsWith("fd")) return true;
-  const mapped = low.match(/^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/);
-  if (mapped) return isBlockedAddress(mapped[1]);
-  return false;
-}
-async function assertPublicUrl(rawUrl) {
-  let url;
-  try {
-    url = new URL(rawUrl);
-  } catch {
-    throw new Error(`Invalid URL: ${rawUrl}`);
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:") {
-    throw new Error(`url must be http(s) (got ${url.protocol})`);
-  }
-  const host = url.hostname.replace(/^\[|\]$/g, "");
-  const addresses = [];
-  if (isIP(host)) {
-    addresses.push(host);
-  } else {
-    const results = await lookup(host, { all: true });
-    for (const r3 of results) addresses.push(r3.address);
-  }
-  if (addresses.length === 0) throw new Error(`Host did not resolve: ${host}`);
-  for (const addr of addresses) {
-    if (isBlockedAddress(addr)) {
-      throw new Error(`Refusing to fetch a private/loopback address (${addr}) for ${rawUrl}`);
-    }
-  }
-  return url;
-}
 async function safeFetch(rawUrl, init2 = {}, maxRedirects = 5) {
   let current = rawUrl;
   for (let hop = 0; hop <= maxRedirects; hop += 1) {
-    await assertPublicUrl(current);
+    await assertPublicUrl(current, { allowHttp: true });
     const res = await fetch(current, { ...init2, redirect: "manual" });
     if (res.status >= 300 && res.status < 400) {
       const location = res.headers.get("location");
@@ -4707,6 +4711,8 @@ function createThrottle(fn, intervalMs) {
 
 // src/thread-session.ts
 var PATCH_INTERVAL_MS = 300;
+var NO_ACTIVITY_TIMEOUT_MS = 6e4;
+var NO_RESPONSE_MESSAGE = "(no response from the model backend \u2014 it may be unavailable or its API auth expired; nothing was changed, please retry)";
 var ThreadSession = class {
   constructor(deps) {
     this.deps = deps;
@@ -4768,6 +4774,18 @@ var ThreadSession = class {
     };
     const { systemPrompt, tools } = this.deps.resolveConfig();
     await this.backfillHistoryOnce(replyToMessageId, body);
+    let sawActivity = false;
+    let turnSettled = false;
+    const settleOnce = () => {
+      if (turnSettled) return true;
+      turnSettled = true;
+      return false;
+    };
+    const watchdog = setTimeout(() => {
+      if (sawActivity || this.active !== turn || settleOnce()) return;
+      this.deps.log(`turn watchdog: no model activity in ${NO_ACTIVITY_TIMEOUT_MS}ms \u2014 failing turn (room=${this.deps.roomId} thread=${this.deps.threadId})`);
+      void this.failTurn(NO_RESPONSE_MESSAGE);
+    }, NO_ACTIVITY_TIMEOUT_MS);
     try {
       const result = await runLoop({
         config: this.deps.runtimeConfig,
@@ -4778,11 +4796,13 @@ var ThreadSession = class {
         history: this.history,
         handlers: {
           onTextDelta: (delta) => {
+            sawActivity = true;
             if (!this.active) return;
             this.active.accumulated += delta;
             this.active.throttle.schedule();
           },
           onToolCall: ({ name }) => {
+            sawActivity = true;
             this.deps.log(`[${this.deps.roomId}/${this.deps.threadId.slice(0, 8)}] tool_call: ${name}`);
             void setStatus(`\u{1F527} ${name}`);
           },
@@ -4796,15 +4816,23 @@ var ThreadSession = class {
           }
         }
       });
+      clearTimeout(watchdog);
+      if (settleOnce()) return;
       this.history.push({ role: "user", content: body });
       if (result.finalMessage) {
         this.history.push({ role: "assistant", content: result.finalMessage });
       }
       if (result.status === "error") {
         this.deps.log(`runtime done with status=error (room=${this.deps.roomId} thread=${this.deps.threadId})`);
+        if (!turn.accumulated) {
+          await this.failTurn("(the model run ended with an error and produced no output \u2014 please retry)");
+          return;
+        }
       }
       await this.endTurn();
     } catch (err) {
+      clearTimeout(watchdog);
+      if (settleOnce()) return;
       const message = err instanceof Error ? err.message : String(err);
       this.deps.log(`runtime error (room=${this.deps.roomId} thread=${this.deps.threadId}): ${message}`);
       await this.failTurn(`(runtime error: ${message})`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openape/ape-agent",
-  "version": "2.9.0",
+  "version": "2.9.2",
   "description": "OpenApe agent runtime: per-agent process that connects to chat.openape.ai, runs the LLM loop with tools + cron tasks, and streams replies back to owners.",
   "type": "module",
   "license": "MIT",
@@ -23,9 +23,9 @@
     "ofetch": "^1.4.1",
     "ws": "^8.18.0",
     "yaml": "^2.8.0",
-    "@openape/cli-auth": "0.5.0",
-    "@openape/apes": "1.29.0",
-    "@openape/prompt-injection-detector": "0.1.0"
+    "@openape/apes": "1.30.0",
+    "@openape/prompt-injection-detector": "0.1.0",
+    "@openape/cli-auth": "0.5.0"
   },
   "devDependencies": {
     "@antfu/eslint-config": "^7.6.1",