open-agents-ai 0.103.66 → 0.103.67

package/dist/index.js

@@ -12402,14 +12402,28 @@ async function handleCmd(cmd) {
         }
 
         // riResult and riTargetPeer are available from either path above
-        // Check if the invoke returned an error message instead of real data
+        // Check if the invoke returned an error message instead of real data.
+        // IMPORTANT: Only flag short non-JSON strings as errors. Valid inference
+        // responses are JSON with model/response/choices \u2014 the model's natural
+        // language output often contains words like "error" or "not found" which
+        // would cause false positives if we checked the entire JSON string.
         var riIsError = false;
         if (typeof riResult === 'string') {
-          var riLower = riResult.toLowerCase();
-          if (riLower.includes('unauthorized') || riLower.includes('forbidden') ||
-              riLower.includes('not found') || riLower.includes('error') ||
-              riLower.includes('payment') || riLower.includes('rejected')) {
-            riIsError = true;
+          // Try to parse as JSON \u2014 if it has model+response or choices, it's valid
+          var riParsedCheck = null;
+          try { riParsedCheck = JSON.parse(riResult); } catch {}
+          if (riParsedCheck && typeof riParsedCheck === 'object' &&
+              (riParsedCheck.model || riParsedCheck.choices || riParsedCheck.response !== undefined)) {
+            // Valid inference response \u2014 NOT an error
+            riIsError = false;
+          } else {
+            // Non-JSON or unstructured response \u2014 check for error keywords
+            var riLower = riResult.toLowerCase();
+            if (riLower.includes('unauthorized') || riLower.includes('forbidden') ||
+                riLower.includes('not found') || riLower.includes('error') ||
+                riLower.includes('payment') || riLower.includes('rejected')) {
+              riIsError = true;
+            }
           }
         }
         if (riIsError) {
@@ -12993,22 +13007,51 @@ async function handleCmd(cmd) {
         // Register system_metrics capability \u2014 returns CPU/GPU/memory utilization
         if (typeof nexus.registerCapability === 'function') {
           nexus.registerCapability('system_metrics', async (request, stream) => {
-            // Auth check for system_metrics too
+            // Collect input via stream data events (auth_key arrives in invoke.chunk, NOT invoke.open)
+            var smDataChunks = [];
+            var smInputDone = false;
+            stream.onData(function(msg) {
+              if (msg.type === 'invoke.chunk') {
+                smDataChunks.push(typeof msg.data === 'string' ? msg.data : JSON.stringify(msg.data));
+              }
+              if (msg.type === 'invoke.done' || msg.type === 'invoke.end') {
+                smInputDone = true;
+              }
+            });
+
+            // Accept invocation so consumer sends data
+            await stream.write({ type: 'invoke.accept', version: 1, requestId: request.requestId, accepted: true });
+
+            // Wait briefly for data (auth key arrives in chunk)
+            var smWait = 0;
+            while (!smInputDone && smDataChunks.length === 0 && smWait < 2000) {
+              await new Promise(function(r) { setTimeout(r, 10); });
+              smWait += 10;
+            }
+
+            // Auth check \u2014 extract auth_key from chunk data
             if (exposeAuthKey) {
               var smAuthKey = '';
-              if (request.data && typeof request.data === 'object' && request.data.auth_key) {
-                smAuthKey = request.data.auth_key;
-              } else if (request.metadata && request.metadata.auth_key) {
+              var smPayload = smDataChunks.join('');
+              try {
+                var smParsed = JSON.parse(smPayload);
+                if (smParsed && typeof smParsed === 'object' && smParsed.auth_key) {
+                  smAuthKey = smParsed.auth_key;
+                }
+              } catch {}
+              // Fallback: check invoke.open metadata (future-proofing)
+              if (!smAuthKey && request.metadata && request.metadata.auth_key) {
                 smAuthKey = request.metadata.auth_key;
               }
               if (smAuthKey !== exposeAuthKey) {
-                await stream.write({ type: 'invoke.accept', version: 1, requestId: request.requestId, accepted: false });
+                dlog('system_metrics: auth REJECTED from ' + (request.from || 'unknown'));
+                await stream.write({ type: 'invoke.event', version: 1, requestId: request.requestId, seq: 0, event: 'error', data: 'Unauthorized' });
                 await stream.write({ type: 'invoke.done', version: 1, requestId: request.requestId, usage: { inputBytes: 0, outputBytes: 0 } });
                 stream.close();
                 return;
               }
+              dlog('system_metrics: auth OK');
             }
-            await stream.write({ type: 'invoke.accept', version: 1, requestId: request.requestId, accepted: true });
             try {
               var os = require('os');
               var loads = os.loadavg();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-agents-ai",
-  "version": "0.103.66",
+  "version": "0.103.67",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",