open-agents-ai 0.103.30 → 0.103.32

package/dist/index.js

@@ -12402,14 +12402,28 @@ async function handleCmd(cmd) {
         }
 
         // riResult and riTargetPeer are available from either path above
-        var riOutput = {
-          success: true,
-          model: riModel,
-          peer: riTargetPeer,
-          capability: riCapName,
-          result: riResult,
-        };
-        writeResp(id, { ok: true, output: JSON.stringify(riOutput, null, 2) });
+        // Check if the invoke returned an error message instead of real data
+        var riIsError = false;
+        if (typeof riResult === 'string') {
+          var riLower = riResult.toLowerCase();
+          if (riLower.includes('unauthorized') || riLower.includes('forbidden') ||
+              riLower.includes('not found') || riLower.includes('error') ||
+              riLower.includes('payment') || riLower.includes('rejected')) {
+            riIsError = true;
+          }
+        }
+        if (riIsError) {
+          writeResp(id, { ok: false, output: 'Remote peer error: ' + riResult });
+        } else {
+          var riOutput = {
+            success: true,
+            model: riModel,
+            peer: riTargetPeer,
+            capability: riCapName,
+            result: riResult,
+          };
+          writeResp(id, { ok: true, output: JSON.stringify(riOutput, null, 2) });
+        }
         break;
       }
       case 'store_content': {
@@ -12692,26 +12706,9 @@ async function handleCmd(cmd) {
               const logFile = join(invocationsDir, Date.now() + '-' + capName + '.json');
               try { writeFileSync(logFile, JSON.stringify(logEntry, null, 2)); } catch {}
 
-              // Auth key validation \u2014 if expose was started with auth_key, require it
-              if (exposeAuthKey) {
-                var reqAuthKey = '';
-                if (request.data && typeof request.data === 'object' && request.data.auth_key) {
-                  reqAuthKey = request.data.auth_key;
-                } else if (request.metadata && request.metadata.auth_key) {
-                  reqAuthKey = request.metadata.auth_key;
-                }
-                if (reqAuthKey !== exposeAuthKey) {
-                  dlog('expose: auth REJECTED for ' + capName + ' from ' + (request.from || 'unknown'));
-                  await stream.write({ type: 'invoke.accept', version: 1, requestId: request.requestId, accepted: false });
-                  await stream.write({ type: 'invoke.event', version: 1, requestId: request.requestId, seq: 0, event: 'error', data: 'Unauthorized \u2014 invalid or missing auth key' });
-                  await stream.write({ type: 'invoke.done', version: 1, requestId: request.requestId, usage: { inputBytes: 0, outputBytes: 0 } });
-                  stream.close();
-                  return;
-                }
-                dlog('expose: auth OK for ' + capName);
-              }
-
               // Collect input via stream data events
+              // NOTE: auth_key arrives in invoke.chunk data, NOT in invoke.open (request).
+              // We must accept + read data FIRST, then validate auth.
               let prompt = '';
               var dataChunks = [];
               var inputDone = false;
@@ -12725,7 +12722,7 @@ async function handleCmd(cmd) {
                 }
               });
 
-              // Accept
+              // Accept the invocation so the consumer sends data
               await stream.write({
                 type: 'invoke.accept', version: 1,
                 requestId: request.requestId, accepted: true,
@@ -12740,6 +12737,31 @@ async function handleCmd(cmd) {
               prompt = dataChunks.join('');
               dlog('expose: received ' + dataChunks.length + ' chunks, prompt_len=' + prompt.length + ' inputDone=' + inputDone);
 
+              // Auth key validation \u2014 check AFTER data is received.
+              // Auth key is in the invoke.chunk data payload, not in invoke.open.
+              if (exposeAuthKey) {
+                var reqAuthKey = '';
+                // Try extracting auth_key from parsed data payload
+                try {
+                  var authCheckData = JSON.parse(prompt);
+                  if (authCheckData && typeof authCheckData === 'object' && authCheckData.auth_key) {
+                    reqAuthKey = authCheckData.auth_key;
+                  }
+                } catch (authParseErr) { /* not JSON or no auth_key field */ }
+                // Fallback: check invoke.open metadata (future-proofing)
+                if (!reqAuthKey && request.metadata && request.metadata.auth_key) {
+                  reqAuthKey = request.metadata.auth_key;
+                }
+                if (reqAuthKey !== exposeAuthKey) {
+                  dlog('expose: auth REJECTED for ' + capName + ' from ' + (request.from || 'unknown'));
+                  await stream.write({ type: 'invoke.event', version: 1, requestId: request.requestId, seq: 0, event: 'error', data: 'Unauthorized \u2014 invalid or missing auth key' });
+                  await stream.write({ type: 'invoke.done', version: 1, requestId: request.requestId, usage: { inputBytes: 0, outputBytes: 0 } });
+                  stream.close();
+                  return;
+                }
+                dlog('expose: auth OK for ' + capName);
+              }
+
               // Forward to Ollama \u2014 supports both flat prompt and structured messages
               try {
                 var parsedReq = null;
@@ -29911,7 +29933,7 @@ async function fetchOpenAIModels(baseUrl, apiKey) {
     parameterSize: m.owned_by ?? void 0
   })).sort((a, b) => a.name.localeCompare(b.name));
 }
-async function fetchPeerModels(peerId) {
+async function fetchPeerModels(peerId, authKey) {
   try {
     const { NexusTool: NexusTool2 } = await Promise.resolve().then(() => (init_dist2(), dist_exports));
     const { existsSync: existsSync42, readFileSync: readFileSync31 } = await import("node:fs");
@@ -29969,7 +29991,8 @@ async function fetchPeerModels(peerId) {
     try {
       const capsResult = await nexusTool.execute({
         action: "query_peer_caps",
-        peer_id: peerId
+        peer_id: peerId,
+        ...authKey ? { auth_key: authKey } : {}
       });
       if (capsResult.success && capsResult.output) {
         let capsData = null;
@@ -30086,7 +30109,7 @@ async function fetchPeerModels(peerId) {
 }
 async function fetchModels(baseUrl, apiKey) {
   if (baseUrl.startsWith("peer://")) {
-    return fetchPeerModels(baseUrl.slice(7));
+    return fetchPeerModels(baseUrl.slice(7), apiKey);
   }
   const provider = detectProvider(baseUrl);
   if (provider.id === "ollama") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-agents-ai",
-  "version": "0.103.30",
+  "version": "0.103.32",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",
@@ -81,7 +81,7 @@
   },
   "optionalDependencies": {
     "moondream": "^0.2.0",
-    "open-agents-nexus": "^1.5.6",
+    "open-agents-nexus": "^1.5.8",
     "viem": "^2.47.4"
   }
 }