open-agents-ai 0.184.38 → 0.184.39

package/README.md

@@ -505,6 +505,88 @@ OA_API_KEYS="grafana-key:read:grafana,ci-key:run:github-actions,ops-key:admin:op
 curl -H "Authorization: Bearer ops-key" http://localhost:11435/v1/models
 ```
 
+#### Tool-Use Profiles
+
+Enterprise access control — define which tools, shell commands, and settings the agent can use per API key or per request.
+
+**3 built-in presets:**
+
+| Profile | Description | Tools |
+|---------|-------------|-------|
+| `full` | No restrictions | All tools and commands |
+| `ci-safe` | CI/CD — read + test only | file_read, grep, shell (npm test only) |
+| `readonly` | Read-only analysis | No writes, no shell mutations |
+
+```bash
+# List all profiles (presets + custom)
+curl -H "Authorization: Bearer $KEY" http://localhost:11435/v1/profiles
+```
+```json
+{"profiles":[{"name":"readonly","description":"Read-only","encrypted":false,"source":"preset"},{"name":"ci-safe",...}]}
+```
+
+```bash
+# Get profile details
+curl -H "Authorization: Bearer $KEY" http://localhost:11435/v1/profiles/ci-safe
+```
+```json
+{"profile":{"name":"ci-safe","tools":{"allow":["file_read","grep_search","shell"],"shell_allow":["npm test","npx eslint"]},"limits":{"max_turns":15}}}
+```
+
+```bash
+# Create custom profile (admin only)
+curl -X POST http://localhost:11435/v1/profiles \
+  -H "Authorization: Bearer $ADMIN_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "name": "frontend-dev",
+    "description": "Frontend team — no backend access",
+    "tools": {
+      "allow": ["file_read", "file_write", "file_edit", "shell", "grep_search"],
+      "shell_deny": ["rm -rf", "sudo", "docker", "kubectl"]
+    },
+    "commands": { "deny": ["destroy", "expose", "sponsor"] },
+    "limits": { "max_turns": 20, "timeout_s": 300 }
+  }'
+```
+
+```bash
+# Create password-protected profile (AES-256-GCM encrypted)
+curl -X POST http://localhost:11435/v1/profiles \
+  -H "Authorization: Bearer $ADMIN_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"name":"prod-ops","password":"s3cret","tools":{"deny":["file_write"]}}'
+```
+
+```bash
+# Use a profile with /v1/run (header or body)
+curl -X POST http://localhost:11435/v1/run \
+  -H "Authorization: Bearer $KEY" \
+  -H "X-Tool-Profile: ci-safe" \
+  -H "X-Working-Directory: $(pwd)" \
+  -H "Content-Type: application/json" \
+  -d '{"task":"run the test suite and report failures"}'
+
+# Or in the body:
+curl -X POST http://localhost:11435/v1/run \
+  -H "Authorization: Bearer $KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"task":"analyze code quality","profile":"readonly"}'
+```
+
+```bash
+# Load encrypted profile (password in header)
+curl -H "Authorization: Bearer $KEY" \
+  -H "X-Profile-Password: s3cret" \
+  http://localhost:11435/v1/profiles/prod-ops
+```
+
+```bash
+# Delete a custom profile (admin only, presets cannot be deleted)
+curl -X DELETE -H "Authorization: Bearer $ADMIN_KEY" \
+  http://localhost:11435/v1/profiles/frontend-dev
+```
+
 #### Endpoint Reference
 
 | Method | Path | Auth | Description |
@@ -529,6 +611,10 @@ curl -H "Authorization: Bearer ops-key" http://localhost:11435/v1/models
 | PUT | `/v1/config/endpoint` | admin | Switch endpoint |
 | GET | `/v1/commands` | read | List commands |
 | POST | `/v1/commands/:cmd` | run | Execute command |
+| GET | `/v1/profiles` | read | List all profiles (presets + custom) |
+| GET | `/v1/profiles/:name` | read | Get profile details (X-Profile-Password for encrypted) |
+| POST | `/v1/profiles` | admin | Create/update profile (password field for encryption) |
+| DELETE | `/v1/profiles/:name` | admin | Delete custom profile |
 
 ### Enterprise Licensing
 

package/dist/index.js

@@ -65041,14 +65041,12 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
     }
     try {
       const apiPort = parseInt(process.env["OA_PORT"] || "11435", 10);
+      const isWin2 = process.platform === "win32";
       const portFree = await new Promise((resolve36) => {
         const net = __require("net");
         const tester = net.createServer();
         tester.once("error", (err) => {
-          if (err.code === "EADDRINUSE")
-            resolve36(false);
-          else
-            resolve36(true);
+          resolve36(err.code !== "EADDRINUSE");
         });
         tester.once("listening", () => {
           tester.close(() => resolve36(true));
@@ -65056,7 +65054,58 @@ Rationale: ${proposal.rationale}${provenanceNote}`;
         tester.listen(apiPort, "127.0.0.1");
       });
       if (!portFree) {
-      } else {
+        let isOurServer = false;
+        try {
+          const probe = await fetch(`http://127.0.0.1:${apiPort}/health`, { signal: AbortSignal.timeout(2e3) });
+          if (probe.ok) {
+            const data = await probe.json();
+            isOurServer = data.status === "ok";
+          }
+        } catch {
+        }
+        if (isOurServer) {
+        } else {
+          try {
+            const { execSync: nodeExec } = __require("child_process");
+            if (isWin2) {
+              const out = nodeExec(`netstat -ano | findstr :${apiPort} | findstr LISTENING`, { encoding: "utf8", timeout: 3e3 }).trim();
+              const pid = out.split(/\s+/).pop();
+              if (pid && parseInt(pid, 10) > 0 && parseInt(pid, 10) !== process.pid) {
+                nodeExec(`taskkill /PID ${pid} /F`, { timeout: 3e3 });
+                writeContent(() => renderInfo(`Killed orphaned process on port ${apiPort} (PID ${pid})`));
+                await new Promise((r) => setTimeout(r, 1e3));
+              }
+            } else {
+              try {
+                const out = nodeExec(`lsof -ti :${apiPort} 2>/dev/null || fuser ${apiPort}/tcp 2>/dev/null`, { encoding: "utf8", timeout: 3e3 }).trim();
+                const pids = out.split(/\s+/).map((s) => parseInt(s, 10)).filter((p) => p > 0 && p !== process.pid);
+                for (const pid of pids) {
+                  try {
+                    process.kill(pid, "SIGTERM");
+                  } catch {
+                  }
+                }
+                if (pids.length > 0) {
+                  writeContent(() => renderInfo(`Killed ${pids.length} orphaned process(es) on port ${apiPort}`));
+                  await new Promise((r) => setTimeout(r, 1e3));
+                }
+              } catch {
+              }
+            }
+          } catch {
+          }
+        }
+      }
+      const portNowFree = await new Promise((resolve36) => {
+        const net = __require("net");
+        const tester = net.createServer();
+        tester.once("error", () => resolve36(false));
+        tester.once("listening", () => {
+          tester.close(() => resolve36(true));
+        });
+        tester.listen(apiPort, "127.0.0.1");
+      });
+      if (portNowFree) {
         const { startApiServer: startApiServer2 } = await Promise.resolve().then(() => (init_serve(), serve_exports));
         const apiServer = startApiServer2({
           port: apiPort,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-agents-ai",
-  "version": "0.184.38",
+  "version": "0.184.39",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) \u2014 interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",