open-agents-ai 0.184.2 → 0.184.4

package/dist/index.js

@@ -35580,6 +35580,14 @@ var init_expose = __esm({
       /** Debounce tracking for tunnel restarts */
       _lastRestartAttempt = 0;
       _consecutiveFailures = 0;
+      // ── Sponsor rate limiting ──
+      /** Per-IP sliding window: IP → array of request timestamps */
+      _rateLimitWindows = /* @__PURE__ */ new Map();
+      /** Global token counter for daily budget */
+      _dailyTokensUsed = 0;
+      _dailyTokensResetAt = 0;
+      /** Sponsor rate limits (set via setSponsorLimits) */
+      _sponsorLimits = null;
       _authKey;
       _targetUrl;
       _kind;
@@ -35614,6 +35622,48 @@ var init_expose = __esm({
       get isActive() {
         return this._stats.status === "active";
       }
+      /** Set sponsor rate limits — enables rate limiting middleware in the proxy */
+      setSponsorLimits(limits) {
+        this._sponsorLimits = limits;
+      }
+      /** Check rate limits for a request. Returns null if OK, or error message string if blocked. */
+      checkRateLimit(userIp, model) {
+        if (!this._sponsorLimits)
+          return null;
+        const lim = this._sponsorLimits;
+        if (lim.allowedModels !== "all" && model && !lim.allowedModels.includes(model)) {
+          return `Model '${model}' is not available on this sponsored endpoint. Available: ${lim.allowedModels.join(", ")}`;
+        }
+        if (this._stats.activeConnections >= lim.maxConcurrent) {
+          return `Too many concurrent requests (${this._stats.activeConnections}/${lim.maxConcurrent}). Try again shortly.`;
+        }
+        const now = Date.now();
+        const windowMs = 6e4;
+        let window = this._rateLimitWindows.get(userIp);
+        if (!window) {
+          window = [];
+          this._rateLimitWindows.set(userIp, window);
+        }
+        while (window.length > 0 && window[0] < now - windowMs)
+          window.shift();
+        if (window.length >= lim.maxRequestsPerMinute) {
+          const retryAfterMs = window[0] + windowMs - now;
+          return `Rate limited (${lim.maxRequestsPerMinute} req/min). Retry in ${Math.ceil(retryAfterMs / 1e3)}s.`;
+        }
+        window.push(now);
+        if (this._dailyTokensResetAt < now) {
+          this._dailyTokensUsed = 0;
+          this._dailyTokensResetAt = now + 864e5;
+        }
+        if (this._dailyTokensUsed >= lim.maxTokensPerDay) {
+          return `Daily token budget exhausted (${fmtTokens(lim.maxTokensPerDay)}). Resets in ${Math.ceil((this._dailyTokensResetAt - now) / 36e5)}h.`;
+        }
+        return null;
+      }
+      /** Track token usage from a completed response */
+      trackTokenUsage(tokensIn, tokensOut) {
+        this._dailyTokensUsed += tokensIn + tokensOut;
+      }
       constructor(options) {
         super();
         this.options = options;
@@ -35833,6 +35883,15 @@ var init_expose = __esm({
           user.activeRequests++;
           user.lastSeen = Date.now();
           this.emitStats();
+          const preRateLimitCheck = this.checkRateLimit(userIp, "");
+          if (preRateLimitCheck) {
+            this._stats.activeConnections--;
+            user.activeRequests--;
+            this._stats.errors++;
+            res.writeHead(429, { "Content-Type": "application/json", "Retry-After": "60" });
+            res.end(JSON.stringify({ error: preRateLimitCheck }));
+            return;
+          }
           url.searchParams.delete("key");
           const forwardPath = url.pathname + url.search;
           if (!this._fullAccess) {
@@ -35873,6 +35932,17 @@ var init_expose = __esm({
               } catch {
               }
             }
+            if (requestModel && this._sponsorLimits) {
+              const modelCheck = this.checkRateLimit(userIp, requestModel);
+              if (modelCheck) {
+                this._stats.activeConnections--;
+                user.activeRequests--;
+                this._stats.errors++;
+                res.writeHead(429, { "Content-Type": "application/json", "Retry-After": "60" });
+                res.end(JSON.stringify({ error: modelCheck }));
+                return;
+              }
+            }
             const forwardHeaders = cleanForwardHeaders(req.headers, target.host);
             if (body.length > 0) {
               forwardHeaders["content-length"] = String(body.length);
@@ -35910,6 +35980,7 @@ var init_expose = __esm({
                   const tOut2 = parseInt(evalCount?.[1] ?? "0", 10);
                   this._stats.totalTokensIn += tIn2;
                   this._stats.totalTokensOut += tOut2;
+                  this.trackTokenUsage(tIn2, tOut2);
                   user.tokensIn += tIn2;
                   user.tokensOut += tOut2;
                   if (requestModel) {
@@ -35927,6 +35998,7 @@ var init_expose = __esm({
                     const tOut2 = parseInt(completionTokens?.[1] ?? "0", 10);
                     this._stats.totalTokensIn += tIn2;
                     this._stats.totalTokensOut += tOut2;
+                    this.trackTokenUsage(tIn2, tOut2);
                     user.tokensIn += tIn2;
                     user.tokensOut += tOut2;
                     if (requestModel) {
@@ -47100,8 +47172,14 @@ async function handleSlashCommand(input, ctx) {
           if (config.transport.cloudflared && ctx.exposeStart) {
             try {
               const url = await ctx.exposeStart("ollama", void 0, "tunnel");
-              if (url)
+              if (url) {
                 renderInfo(`Tunnel: ${url}`);
+                const gateway = ctx.getExposeGateway?.();
+                if (gateway && "setSponsorLimits" in gateway) {
+                  gateway.setSponsorLimits(config.rateLimits);
+                  renderInfo(`Rate limits active: ${config.rateLimits.maxRequestsPerMinute} req/min, ${config.rateLimits.maxTokensPerDay.toLocaleString()} tokens/day`);
+                }
+              }
             } catch (err) {
               renderError(`Tunnel start failed: ${err instanceof Error ? err.message : String(err)}`);
             }
@@ -47109,8 +47187,13 @@ async function handleSlashCommand(input, ctx) {
           if (config.transport.libp2p && ctx.exposeStart) {
             try {
               const url = await ctx.exposeStart("ollama", void 0, "libp2p");
-              if (url)
+              if (url) {
                 renderInfo(`P2P: ${url}`);
+                const gateway = ctx.getExposeGateway?.();
+                if (gateway && "setSponsorLimits" in gateway) {
+                  gateway.setSponsorLimits(config.rateLimits);
+                }
+              }
             } catch (err) {
               renderError(`P2P start failed: ${err instanceof Error ? err.message : String(err)}`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-agents-ai",
-  "version": "0.184.2",
+  "version": "0.184.4",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) \u2014 interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",