open-agents-ai 0.187.230 → 0.187.231

package/dist/index.js

@@ -251346,7 +251346,7 @@ train.py reverted to last kept state. Ready for next experiment.`,
 });
 
 // packages/execution/dist/tools/scheduler.js
-import { execSync as execSync22, exec as execCb } from "node:child_process";
+import { execSync as execSync22, exec as execCb, spawnSync as spawnSync2 } from "node:child_process";
 import { readFile as readFile15, writeFile as writeFile17, mkdir as mkdir12 } from "node:fs/promises";
 import { resolve as resolve24, join as join37 } from "node:path";
 import { homedir as homedir10 } from "node:os";
@@ -251416,7 +251416,18 @@ function getCurrentCrontab() {
 }
 function writeCrontab(lines) {
   const content = lines.join("\n") + "\n";
-  execSync22(`echo ${JSON.stringify(content)} | crontab -`, { stdio: "pipe" });
+  const result = spawnSync2("crontab", ["-"], {
+    input: content,
+    stdio: ["pipe", "pipe", "pipe"],
+    encoding: "utf8"
+  });
+  if (result.error) {
+    throw new Error(`writeCrontab: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    const stderr = (result.stderr || "").toString().trim();
+    throw new Error(`writeCrontab: crontab exited ${result.status}${stderr ? `: ${stderr}` : ""}`);
+  }
 }
 function findOaBinary() {
   for (const cmd of ["oa", "open-agents"]) {
@@ -257631,7 +257642,7 @@ ${output}`, durationMs: performance.now() - start2 };
 });
 
 // packages/execution/dist/tools/gps-location.js
-import { execSync as execSync36, spawnSync as spawnSync2 } from "node:child_process";
+import { execSync as execSync36, spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync35, readFileSync as readFileSync27, writeFileSync as writeFileSync15, mkdirSync as mkdirSync16 } from "node:fs";
 import { join as join50 } from "node:path";
 import { tmpdir as tmpdir13, homedir as homedir15 } from "node:os";
@@ -290797,6 +290808,25 @@ var init_status_bar = __esm({
         } else if (type === "release") {
           this._textSelection.onMouseRelease(row, col);
           this.repaintContent();
+          if (this._textSelection.hasSelection) {
+            try {
+              const ok2 = this._textSelection.copyToClipboard();
+              if (ok2) {
+                const pos2 = this.rowPositions(termRows());
+                if (pos2.metricsRow > 0) {
+                  const origWrite = this._origWrite ?? process.stdout.write.bind(process.stdout);
+                  origWrite(`\x1B[${pos2.metricsRow};1H\x1B[2K\x1B[38;5;${TEXT_PRIMARY}m  ✓ Copied to clipboard\x1B[0m`);
+                  setTimeout(() => {
+                    try {
+                      this.renderFooterAndPositionInput();
+                    } catch {
+                    }
+                  }, 1200);
+                }
+              }
+            } catch {
+            }
+          }
         }
       }
       /** Copy current selection to clipboard. Returns true if copied. */
@@ -300291,15 +300321,15 @@ Error: ${err2 instanceof Error ? err2.message : String(err2)}`
           renderInfo("  ARM device detected — installing build prerequisites then deps individually.");
           const isMac = process.platform === "darwin";
           try {
-            const { spawnSync: spawnSync3 } = await import("node:child_process");
+            const { spawnSync: spawnSync4 } = await import("node:child_process");
             if (process.stdout.isTTY) {
               process.stdout.write("\x1B[?1002l\x1B[?1003l\x1B[?1006l");
             }
             if (isMac) {
               renderInfo("  macOS ARM detected — installing build deps via Homebrew...");
-              const brewCheck = spawnSync3("which", ["brew"], { stdio: "pipe", timeout: 5e3 });
+              const brewCheck = spawnSync4("which", ["brew"], { stdio: "pipe", timeout: 5e3 });
               if (brewCheck.status === 0) {
-                const brewResult = spawnSync3("brew", ["install", "llvm", "gcc", "openblas", "libsndfile"], {
+                const brewResult = spawnSync4("brew", ["install", "llvm", "gcc", "openblas", "libsndfile"], {
                   stdio: "pipe",
                   timeout: 3e5
                 });
@@ -300308,11 +300338,11 @@ Error: ${err2 instanceof Error ? err2.message : String(err2)}`
                   const { renderVerbose: renderVerbose2 } = await Promise.resolve().then(() => (init_render(), render_exports));
                   renderVerbose2(brewResult.stderr.toString());
                 }
-                const llvmPrefix = spawnSync3("brew", ["--prefix", "llvm"], { stdio: "pipe", timeout: 5e3 });
+                const llvmPrefix = spawnSync4("brew", ["--prefix", "llvm"], { stdio: "pipe", timeout: 5e3 });
                 if (llvmPrefix.stdout) {
                   const prefix = llvmPrefix.stdout.toString().trim();
                   process.env.LLVM_CONFIG = `${prefix}/bin/llvm-config`;
-                  const openblas = spawnSync3("brew", ["--prefix", "openblas"], { stdio: "pipe", timeout: 5e3 });
+                  const openblas = spawnSync4("brew", ["--prefix", "openblas"], { stdio: "pipe", timeout: 5e3 });
                   if (openblas.stdout) {
                     const obPrefix = openblas.stdout.toString().trim();
                     process.env.LDFLAGS = `${process.env.LDFLAGS ?? ""} -L${obPrefix}/lib`.trim();
@@ -300325,10 +300355,10 @@ Error: ${err2 instanceof Error ? err2.message : String(err2)}`
               }
             } else {
               renderInfo("  System build tools needed (llvm, gcc). Requesting sudo access...");
-              const sudoCheck = spawnSync3("sudo", ["-v"], { stdio: "inherit", timeout: 6e4 });
+              const sudoCheck = spawnSync4("sudo", ["-v"], { stdio: "inherit", timeout: 6e4 });
               if (sudoCheck.status === 0) {
                 renderInfo("  Installing system build dependencies (this may take a minute)...");
-                const aptResult = spawnSync3("sudo", [
+                const aptResult = spawnSync4("sudo", [
                   "apt-get",
                   "install",
                   "-y",
@@ -306567,8 +306597,8 @@ async function handleUpdate(subcommand, ctx3) {
     renderInfo("Enter your password if prompted...");
     safeWrite("\n");
     try {
-      const { spawnSync: spawnSync3 } = await import("node:child_process");
-      const sudoResult = spawnSync3("sudo", ["-v"], { stdio: "inherit", timeout: 6e4 });
+      const { spawnSync: spawnSync4 } = await import("node:child_process");
+      const sudoResult = spawnSync4("sudo", ["-v"], { stdio: "inherit", timeout: 6e4 });
       if (sudoResult.status !== 0) throw new Error("sudo failed");
     } catch {
       renderWarning("Could not acquire sudo credentials. Try: sudo npm i -g open-agents-ai");
@@ -314969,6 +314999,65 @@ var init_direct_input = __esm({
   }
 });
 
+// packages/cli/src/api/access-policy.ts
+function defaultAccessMode(bindHost) {
+  if (bindHost === "0.0.0.0" || bindHost === "::" || bindHost === "::0") {
+    return "lan";
+  }
+  return "loopback";
+}
+function resolveAccessMode(envValue, bindHost) {
+  const v = (envValue || "").toLowerCase().trim();
+  if (v === "loopback" || v === "lan" || v === "any") return v;
+  return defaultAccessMode(bindHost);
+}
+function stripMappedPrefix(ip) {
+  return ip.replace(/^::ffff:/i, "");
+}
+function isLoopbackIP(ip) {
+  if (!ip) return false;
+  const clean3 = stripMappedPrefix(ip);
+  if (clean3 === "::1") return true;
+  if (/^127\./.test(clean3)) return true;
+  return false;
+}
+function isPrivateIP(ip) {
+  if (!ip) return false;
+  const clean3 = stripMappedPrefix(ip);
+  if (/^10\./.test(clean3)) return true;
+  if (/^192\.168\./.test(clean3)) return true;
+  const m2 = /^172\.(\d{1,3})\./.exec(clean3);
+  if (m2) {
+    const second3 = parseInt(m2[1], 10);
+    if (second3 >= 16 && second3 <= 31) return true;
+  }
+  if (/^169\.254\./.test(clean3)) return true;
+  if (/^f[cd][0-9a-f]{2}:/i.test(clean3)) return true;
+  if (/^fe[89ab][0-9a-f]:/i.test(clean3)) return true;
+  return false;
+}
+function isAllowedIP(ip, mode) {
+  if (mode === "any") return true;
+  if (isLoopbackIP(ip)) return true;
+  if (mode === "lan" && isPrivateIP(ip)) return true;
+  return false;
+}
+function describeAccessMode(mode) {
+  switch (mode) {
+    case "loopback":
+      return "loopback only";
+    case "lan":
+      return "loopback + RFC 1918";
+    case "any":
+      return "any — WIDE OPEN";
+  }
+}
+var init_access_policy = __esm({
+  "packages/cli/src/api/access-policy.ts"() {
+    "use strict";
+  }
+});
+
 // packages/cli/src/api/audit-log.ts
 var audit_log_exports = {};
 __export(audit_log_exports, {
@@ -325781,7 +325870,7 @@ function startApiServer(options2 = {}) {
   if (options2.quiet) setQuiet(true);
   const log22 = options2.quiet ? (_msg) => {
   } : (msg) => process.stderr.write(msg);
-  let host = "127.0.0.1";
+  let host = "0.0.0.0";
   let port = 11435;
   const envHost = process.env["OA_HOST"];
   if (envHost) {
@@ -325957,7 +326046,23 @@ function startApiServer(options2 = {}) {
       process.exit(1);
     }
   }
+  const accessMode = resolveAccessMode(process.env["OA_ACCESS"], host);
+  let _accessRejected = 0;
   const handler = (req2, res) => {
+    const rawIp = req2.socket?.remoteAddress ?? "";
+    if (!isAllowedIP(rawIp, accessMode)) {
+      _accessRejected++;
+      metrics.totalErrors++;
+      try {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({
+          error: "access_denied",
+          message: `Address ${rawIp} is not in the allowed network (mode: ${accessMode}). Set OA_ACCESS=any to disable.`
+        }));
+      } catch {
+      }
+      return;
+    }
     handleRequest(req2, res, ollamaUrl, verbose).catch((err) => {
       metrics.totalErrors++;
       try {
@@ -326028,6 +326133,8 @@ function startApiServer(options2 = {}) {
 `);
     const proto = useTls ? "https" : "http";
     log22(`  Listening on ${proto}://${host}:${port}
+`);
+    log22(`  Access: ${accessMode} (${describeAccessMode(accessMode)})
 `);
     log22(`  Primary: ${config.backendUrl} (${config.backendType || "ollama"})
 `);
@@ -326116,6 +326223,7 @@ var init_serve = __esm({
   "packages/cli/src/api/serve.ts"() {
     "use strict";
     init_config();
+    init_access_policy();
     init_audit_log();
     init_task_manager_singleton();
     init_disk_task_output();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-agents-ai",
-  "version": "0.187.230",
+  "version": "0.187.231",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",