open-agents-ai 0.184.31 → 0.184.33

package/README.md

@@ -239,6 +239,98 @@ Pipe to `jq`, ingest into monitoring systems, or feed to other agents.
 
 Shows per-process RAM and CPU usage before killing. Detects: cloudflared tunnels, nexus daemons, headless Chrome, TTS servers, Python REPLs, stale OA instances.
 
+### REST API Service (Port 11435)
+
+Open Agents runs a persistent REST API — like Ollama's `/api/` surface but with agentic task execution, OpenAI compatibility, and full TUI command access.
+
+```bash
+oa serve                          # Start on default port 11435
+oa serve --port 9999              # Custom port
+OA_API_KEY=secret oa serve        # Enable Bearer token auth
+```
+
+**Health & Observability:**
+
+```bash
+curl http://localhost:11435/health          # → {"status":"ok","uptime_s":123}
+curl http://localhost:11435/health/ready     # → {"status":"ready","ollama":"reachable"} or 503
+curl http://localhost:11435/version          # → {"version":"0.184.31","node":"v24.14.0","platform":"linux"}
+curl http://localhost:11435/metrics          # → Prometheus text format (request counts, tokens, errors)
+```
+
+**OpenAI-Compatible Inference** (drop-in for any OpenAI client library):
+
+```bash
+# List models (52 models in OpenAI format)
+curl http://localhost:11435/v1/models
+
+# Chat completions (non-streaming)
+curl -X POST http://localhost:11435/v1/chat/completions \
+  -H "Content-Type: application/json" \
+  -d '{"model":"qwen3.5:9b","messages":[{"role":"user","content":"Hello"}]}'
+# → {"id":"chatcmpl-...","choices":[{"message":{"role":"assistant","content":"Hi there!"}}],"usage":{"prompt_tokens":25,"completion_tokens":5}}
+
+# Chat completions (SSE streaming)
+curl -N -X POST http://localhost:11435/v1/chat/completions \
+  -H "Content-Type: application/json" \
+  -d '{"model":"qwen3.5:9b","messages":[{"role":"user","content":"Hello"}],"stream":true}'
+# → data: {"choices":[{"delta":{"content":"Hi"}}]}\n\ndata: {"choices":[{"delta":{"content":" there"}}]}\n\n...data: [DONE]
+```
+
+**Agentic Task Execution** (the unique OA capability):
+
+```bash
+# Submit an agentic task
+curl -X POST http://localhost:11435/v1/run \
+  -H "Content-Type: application/json" \
+  -d '{"prompt":"fix the null check in auth.ts","model":"qwen3.5:9b","stream":true}'
+
+# List runs
+curl http://localhost:11435/v1/runs
+
+# Abort a run
+curl -X DELETE http://localhost:11435/v1/runs/run-abc123
+```
+
+**Configuration:**
+
+```bash
+curl http://localhost:11435/v1/config              # Get all settings
+curl http://localhost:11435/v1/config/model         # → {"model":"qwen3.5:122b"}
+curl -X PUT http://localhost:11435/v1/config/model \
+  -H "Content-Type: application/json" -d '{"model":"qwen3.5:27b"}'
+curl http://localhost:11435/v1/config/endpoint      # → {"url":"...","backendType":"..."}
+```
+
+**Slash Commands via REST:**
+
+```bash
+curl http://localhost:11435/v1/commands              # List all 100+ commands
+curl -X POST http://localhost:11435/v1/commands/stats  # Execute /stats
+curl -X POST http://localhost:11435/v1/commands/nexus  # Execute /nexus status
+```
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| GET | `/health` | Liveness check |
+| GET | `/health/ready` | Readiness (probes Ollama) |
+| GET | `/health/startup` | Startup complete |
+| GET | `/version` | OA + Node version |
+| GET | `/metrics` | Prometheus metrics |
+| GET | `/v1/models` | List models (OpenAI format) |
+| POST | `/v1/chat/completions` | Chat inference (OpenAI compatible, streaming + non-streaming) |
+| POST | `/v1/embeddings` | Generate embeddings |
+| POST | `/v1/run` | Submit agentic task |
+| GET | `/v1/runs` | List runs |
+| GET | `/v1/runs/:id` | Run status |
+| DELETE | `/v1/runs/:id` | Abort run |
+| GET | `/v1/config` | All settings |
+| PATCH | `/v1/config` | Update settings |
+| GET/PUT | `/v1/config/model` | Current/switch model |
+| GET/PUT | `/v1/config/endpoint` | Current/switch endpoint |
+| GET | `/v1/commands` | List slash commands |
+| POST | `/v1/commands/:cmd` | Execute command |
+
 ### Enterprise Licensing
 
 Free for non-commercial use under CC-BY-NC-4.0. For enterprise/commercial licensing, contact [zoomerconsulting.com](https://zoomerconsulting.com).

package/dist/index.js

@@ -67254,15 +67254,46 @@ function listJobs() {
   }
   return jobs;
 }
-function checkAuth(req, res) {
-  const apiKey = process.env["OA_API_KEY"];
-  if (!apiKey)
-    return true;
+function resolveAuth(req) {
   const authHeader = req.headers["authorization"];
-  if (!authHeader || authHeader !== `Bearer ${apiKey}`) {
+  const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
+  const multiKeys = process.env["OA_API_KEYS"];
+  if (multiKeys) {
+    if (!token)
+      return { authenticated: false, scope: "read" };
+    for (const entry of multiKeys.split(",")) {
+      const [key, scope, user] = entry.trim().split(":");
+      if (key === token) {
+        return { authenticated: true, scope: scope || "admin", user: user || void 0 };
+      }
+    }
+    return { authenticated: false, scope: "read" };
+  }
+  const singleKey = process.env["OA_API_KEY"];
+  if (!singleKey)
+    return { authenticated: true, scope: "admin" };
+  if (token === singleKey)
+    return { authenticated: true, scope: "admin" };
+  return { authenticated: false, scope: "read" };
+}
+function checkAuth(req, res, requiredScope = "read") {
+  const scopeLevel = { read: 1, run: 2, admin: 3 };
+  const auth = resolveAuth(req);
+  if (!auth.authenticated) {
     jsonResponse(res, 401, { error: "Unauthorized", message: "Invalid or missing Bearer token" });
     return false;
   }
+  if (scopeLevel[auth.scope] < scopeLevel[requiredScope]) {
+    jsonResponse(res, 403, {
+      error: "Forbidden",
+      message: `Scope '${auth.scope}' insufficient \u2014 requires '${requiredScope}'`,
+      scope: auth.scope,
+      required: requiredScope
+    });
+    return false;
+  }
+  req._authUser = auth.user;
+  req._authScope = auth.scope;
   return true;
 }
 function handleHealth(res) {
@@ -67534,7 +67565,20 @@ async function handleV1Run(req, res) {
   }
   const id = `job-${randomBytes16(3).toString("hex")}`;
   const dir = jobsDir2();
-  const repoRoot = resolve35(process.cwd());
+  const workingDir = requestBody["working_directory"];
+  const isolate = requestBody["isolate"] === true;
+  let cwd4;
+  if (workingDir) {
+    cwd4 = resolve35(workingDir);
+  } else if (isolate) {
+    const wsDir = join71(dir, "..", "workspaces", id);
+    mkdirSync26(wsDir, { recursive: true });
+    cwd4 = wsDir;
+  } else {
+    cwd4 = resolve35(process.cwd());
+  }
+  const authUser = req._authUser || "anonymous";
+  const authScope = req._authScope || "admin";
   const job = {
     id,
     pid: 0,
@@ -67542,14 +67586,39 @@ async function handleV1Run(req, res) {
     status: "running",
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
+  job.user = authUser;
+  job.scope = authScope;
+  job.cwd = cwd4;
+  job.isolate = isolate;
   const oaBin = process.argv[1] || "oa";
   const args = [task, "--json"];
   const modelArg = requestBody["model"];
   if (modelArg)
     args.push("--model", modelArg);
+  const maxTurns = requestBody["max_turns"];
+  if (maxTurns && maxTurns > 0)
+    args.push("--max-turns", String(maxTurns));
+  const timeout = requestBody["timeout_s"];
+  if (timeout && timeout > 0)
+    args.push("--timeout", String(timeout));
+  const runEnv = {
+    ...process.env,
+    OA_JOB_ID: id,
+    __OPEN_AGENTS_NO_AUTO_RUN: "",
+    OA_RUN_USER: authUser,
+    OA_RUN_SCOPE: authScope
+  };
+  const customEnv = requestBody["env"];
+  if (customEnv && typeof customEnv === "object") {
+    for (const [k, v] of Object.entries(customEnv)) {
+      if (k.startsWith("OA_") && typeof v === "string") {
+        runEnv[k] = v;
+      }
+    }
+  }
   const child = spawn21("node", [oaBin, ...args], {
-    cwd: repoRoot,
-    env: { ...process.env, OA_JOB_ID: id, __OPEN_AGENTS_NO_AUTO_RUN: "" },
+    cwd: cwd4,
+    env: runEnv,
     stdio: ["ignore", "pipe", "pipe"],
     detached: true
   });
@@ -67829,7 +67898,12 @@ async function handleRequest(req, res, ollamaUrl, verbose) {
       return;
     }
     if (pathname.startsWith("/v1/")) {
-      if (!checkAuth(req, res)) {
+      const isWrite = method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
+      const isRun = pathname === "/v1/run" || pathname.startsWith("/v1/runs");
+      const isConfigWrite = pathname.startsWith("/v1/config") && isWrite;
+      const isCommand = pathname.startsWith("/v1/commands") && method === "POST";
+      const requiredScope = isConfigWrite ? "admin" : isRun || isCommand ? "run" : "read";
+      if (!checkAuth(req, res, requiredScope)) {
         status = 401;
         return;
       }
@@ -67956,11 +68030,15 @@ function startApiServer(options = {}) {
 `);
     process.stderr.write(`  Ollama proxy: ${ollamaUrl}
 `);
-    if (process.env["OA_API_KEY"]) {
-      process.stderr.write(`  Auth: Bearer token required for /v1/* endpoints
+    if (process.env["OA_API_KEYS"]) {
+      const keyCount = process.env["OA_API_KEYS"].split(",").length;
+      process.stderr.write(`  Auth: ${keyCount} scoped key(s) (read/run/admin)
+`);
+    } else if (process.env["OA_API_KEY"]) {
+      process.stderr.write(`  Auth: single Bearer token (admin scope)
 `);
     } else {
-      process.stderr.write(`  Auth: disabled (set OA_API_KEY to enable)
+      process.stderr.write(`  Auth: disabled (set OA_API_KEY or OA_API_KEYS to enable)
 `);
     }
     process.stderr.write(`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-agents-ai",
-  "version": "0.184.31",
+  "version": "0.184.33",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) \u2014 interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",