open-agents-ai 0.184.32 → 0.184.33

package/dist/index.js

@@ -67254,15 +67254,46 @@ function listJobs() {
   }
   return jobs;
 }
-function checkAuth(req, res) {
-  const apiKey = process.env["OA_API_KEY"];
-  if (!apiKey)
-    return true;
+function resolveAuth(req) {
   const authHeader = req.headers["authorization"];
-  if (!authHeader || authHeader !== `Bearer ${apiKey}`) {
+  const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
+  const multiKeys = process.env["OA_API_KEYS"];
+  if (multiKeys) {
+    if (!token)
+      return { authenticated: false, scope: "read" };
+    for (const entry of multiKeys.split(",")) {
+      const [key, scope, user] = entry.trim().split(":");
+      if (key === token) {
+        return { authenticated: true, scope: scope || "admin", user: user || void 0 };
+      }
+    }
+    return { authenticated: false, scope: "read" };
+  }
+  const singleKey = process.env["OA_API_KEY"];
+  if (!singleKey)
+    return { authenticated: true, scope: "admin" };
+  if (token === singleKey)
+    return { authenticated: true, scope: "admin" };
+  return { authenticated: false, scope: "read" };
+}
+function checkAuth(req, res, requiredScope = "read") {
+  const scopeLevel = { read: 1, run: 2, admin: 3 };
+  const auth = resolveAuth(req);
+  if (!auth.authenticated) {
     jsonResponse(res, 401, { error: "Unauthorized", message: "Invalid or missing Bearer token" });
     return false;
   }
+  if (scopeLevel[auth.scope] < scopeLevel[requiredScope]) {
+    jsonResponse(res, 403, {
+      error: "Forbidden",
+      message: `Scope '${auth.scope}' insufficient \u2014 requires '${requiredScope}'`,
+      scope: auth.scope,
+      required: requiredScope
+    });
+    return false;
+  }
+  req._authUser = auth.user;
+  req._authScope = auth.scope;
   return true;
 }
 function handleHealth(res) {
@@ -67534,7 +67565,20 @@ async function handleV1Run(req, res) {
   }
   const id = `job-${randomBytes16(3).toString("hex")}`;
   const dir = jobsDir2();
-  const repoRoot = resolve35(process.cwd());
+  const workingDir = requestBody["working_directory"];
+  const isolate = requestBody["isolate"] === true;
+  let cwd4;
+  if (workingDir) {
+    cwd4 = resolve35(workingDir);
+  } else if (isolate) {
+    const wsDir = join71(dir, "..", "workspaces", id);
+    mkdirSync26(wsDir, { recursive: true });
+    cwd4 = wsDir;
+  } else {
+    cwd4 = resolve35(process.cwd());
+  }
+  const authUser = req._authUser || "anonymous";
+  const authScope = req._authScope || "admin";
   const job = {
     id,
     pid: 0,
@@ -67542,14 +67586,39 @@ async function handleV1Run(req, res) {
     status: "running",
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
+  job.user = authUser;
+  job.scope = authScope;
+  job.cwd = cwd4;
+  job.isolate = isolate;
   const oaBin = process.argv[1] || "oa";
   const args = [task, "--json"];
   const modelArg = requestBody["model"];
   if (modelArg)
     args.push("--model", modelArg);
+  const maxTurns = requestBody["max_turns"];
+  if (maxTurns && maxTurns > 0)
+    args.push("--max-turns", String(maxTurns));
+  const timeout = requestBody["timeout_s"];
+  if (timeout && timeout > 0)
+    args.push("--timeout", String(timeout));
+  const runEnv = {
+    ...process.env,
+    OA_JOB_ID: id,
+    __OPEN_AGENTS_NO_AUTO_RUN: "",
+    OA_RUN_USER: authUser,
+    OA_RUN_SCOPE: authScope
+  };
+  const customEnv = requestBody["env"];
+  if (customEnv && typeof customEnv === "object") {
+    for (const [k, v] of Object.entries(customEnv)) {
+      if (k.startsWith("OA_") && typeof v === "string") {
+        runEnv[k] = v;
+      }
+    }
+  }
   const child = spawn21("node", [oaBin, ...args], {
-    cwd: repoRoot,
-    env: { ...process.env, OA_JOB_ID: id, __OPEN_AGENTS_NO_AUTO_RUN: "" },
+    cwd: cwd4,
+    env: runEnv,
     stdio: ["ignore", "pipe", "pipe"],
     detached: true
   });
@@ -67829,7 +67898,12 @@ async function handleRequest(req, res, ollamaUrl, verbose) {
       return;
     }
     if (pathname.startsWith("/v1/")) {
-      if (!checkAuth(req, res)) {
+      const isWrite = method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
+      const isRun = pathname === "/v1/run" || pathname.startsWith("/v1/runs");
+      const isConfigWrite = pathname.startsWith("/v1/config") && isWrite;
+      const isCommand = pathname.startsWith("/v1/commands") && method === "POST";
+      const requiredScope = isConfigWrite ? "admin" : isRun || isCommand ? "run" : "read";
+      if (!checkAuth(req, res, requiredScope)) {
         status = 401;
         return;
       }
@@ -67956,11 +68030,15 @@ function startApiServer(options = {}) {
 `);
     process.stderr.write(`  Ollama proxy: ${ollamaUrl}
 `);
-    if (process.env["OA_API_KEY"]) {
-      process.stderr.write(`  Auth: Bearer token required for /v1/* endpoints
+    if (process.env["OA_API_KEYS"]) {
+      const keyCount = process.env["OA_API_KEYS"].split(",").length;
+      process.stderr.write(`  Auth: ${keyCount} scoped key(s) (read/run/admin)
+`);
+    } else if (process.env["OA_API_KEY"]) {
+      process.stderr.write(`  Auth: single Bearer token (admin scope)
 `);
     } else {
-      process.stderr.write(`  Auth: disabled (set OA_API_KEY to enable)
+      process.stderr.write(`  Auth: disabled (set OA_API_KEY or OA_API_KEYS to enable)
 `);
     }
     process.stderr.write(`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-agents-ai",
-  "version": "0.184.32",
+  "version": "0.184.33",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) \u2014 interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",