open-agents-ai 0.187.230 → 0.187.232

package/dist/index.js

@@ -10159,7 +10159,7 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
     ];
     NexusTool = class {
       name = "nexus";
-      description = "P2P agent mesh networking. IMPORTANT: You MUST call action='connect' FIRST — it spawns the daemon. Nothing works without it. After connect: join_room, send_message, discover_peers, expose (share models), remote_infer (use remote models). Quick start: connect → join_room → send_message. Also: wallet_create, wallet_status, ledger_status, budget_set, spend, invoke_capability, store_content.";
+      description = "P2P agent mesh networking — invoked ONLY via this tool call. ⚠ DO NOT run 'nexus' as a shell command. DO NOT run 'npm install open-agents-nexus' — it's ALREADY embedded in this binary. DO NOT use the shell tool to look for a 'nexus' binary — there isn't one. Use THIS tool interface. All nexus actions are dispatched through tool calls of the form: nexus({ action: 'connect', agent_name: '...' }). IMPORTANT: You MUST call action='connect' FIRST — it spawns the daemon. Nothing works without it. After connect: join_room, send_message, discover_peers, expose (share models), remote_infer (use remote models). Voice: voice_listen_start (ASR on room audio), voice_publish, voice_speak, jibberlink_send (encrypted data-over-audio). Quick start: connect → join_room → send_message. Also: wallet_create, wallet_status, ledger_status, budget_set, spend, invoke_capability, store_content.";
       parameters = {
         type: "object",
         properties: {
@@ -251346,7 +251346,7 @@ train.py reverted to last kept state. Ready for next experiment.`,
 });
 
 // packages/execution/dist/tools/scheduler.js
-import { execSync as execSync22, exec as execCb } from "node:child_process";
+import { execSync as execSync22, exec as execCb, spawnSync as spawnSync2 } from "node:child_process";
 import { readFile as readFile15, writeFile as writeFile17, mkdir as mkdir12 } from "node:fs/promises";
 import { resolve as resolve24, join as join37 } from "node:path";
 import { homedir as homedir10 } from "node:os";
@@ -251416,7 +251416,18 @@ function getCurrentCrontab() {
 }
 function writeCrontab(lines) {
   const content = lines.join("\n") + "\n";
-  execSync22(`echo ${JSON.stringify(content)} | crontab -`, { stdio: "pipe" });
+  const result = spawnSync2("crontab", ["-"], {
+    input: content,
+    stdio: ["pipe", "pipe", "pipe"],
+    encoding: "utf8"
+  });
+  if (result.error) {
+    throw new Error(`writeCrontab: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    const stderr = (result.stderr || "").toString().trim();
+    throw new Error(`writeCrontab: crontab exited ${result.status}${stderr ? `: ${stderr}` : ""}`);
+  }
 }
 function findOaBinary() {
   for (const cmd of ["oa", "open-agents"]) {
@@ -257631,7 +257642,7 @@ ${output}`, durationMs: performance.now() - start2 };
 });
 
 // packages/execution/dist/tools/gps-location.js
-import { execSync as execSync36, spawnSync as spawnSync2 } from "node:child_process";
+import { execSync as execSync36, spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync35, readFileSync as readFileSync27, writeFileSync as writeFileSync15, mkdirSync as mkdirSync16 } from "node:fs";
 import { join as join50 } from "node:path";
 import { tmpdir as tmpdir13, homedir as homedir15 } from "node:os";
@@ -270898,7 +270909,13 @@ ${memoryLines.join("\n")}`
                 // list) but the dedup detector was flagging it as a wasted call
                 // and blocking the planning workflow. The agent uses todo_write
                 // as its primary checkpoint mechanism so it MUST always execute.
-                "todo_write"
+                "todo_write",
+                // nexus is also a state tool — connect is idempotent but the
+                // dedup warning was causing confused agents to bail out to
+                // shell workarounds (npm install, find /bin, etc.) when they
+                // saw "DUPLICATE CALL" after their first connect. Let the
+                // tool see every call and return the cached state itself.
+                "nexus"
               ].includes(tc.name);
               const cachedResult = recentToolResults.get(toolFingerprint);
               if (isReadLike && cachedResult !== void 0) {
@@ -290797,6 +290814,25 @@ var init_status_bar = __esm({
         } else if (type === "release") {
           this._textSelection.onMouseRelease(row, col);
           this.repaintContent();
+          if (this._textSelection.hasSelection) {
+            try {
+              const ok2 = this._textSelection.copyToClipboard();
+              if (ok2) {
+                const pos2 = this.rowPositions(termRows());
+                if (pos2.metricsRow > 0) {
+                  const origWrite = this._origWrite ?? process.stdout.write.bind(process.stdout);
+                  origWrite(`\x1B[${pos2.metricsRow};1H\x1B[2K\x1B[38;5;${TEXT_PRIMARY}m  ✓ Copied to clipboard\x1B[0m`);
+                  setTimeout(() => {
+                    try {
+                      this.renderFooterAndPositionInput();
+                    } catch {
+                    }
+                  }, 1200);
+                }
+              }
+            } catch {
+            }
+          }
         }
       }
       /** Copy current selection to clipboard. Returns true if copied. */
@@ -300291,15 +300327,15 @@ Error: ${err2 instanceof Error ? err2.message : String(err2)}`
           renderInfo("  ARM device detected — installing build prerequisites then deps individually.");
           const isMac = process.platform === "darwin";
           try {
-            const { spawnSync: spawnSync3 } = await import("node:child_process");
+            const { spawnSync: spawnSync4 } = await import("node:child_process");
             if (process.stdout.isTTY) {
               process.stdout.write("\x1B[?1002l\x1B[?1003l\x1B[?1006l");
             }
             if (isMac) {
               renderInfo("  macOS ARM detected — installing build deps via Homebrew...");
-              const brewCheck = spawnSync3("which", ["brew"], { stdio: "pipe", timeout: 5e3 });
+              const brewCheck = spawnSync4("which", ["brew"], { stdio: "pipe", timeout: 5e3 });
               if (brewCheck.status === 0) {
-                const brewResult = spawnSync3("brew", ["install", "llvm", "gcc", "openblas", "libsndfile"], {
+                const brewResult = spawnSync4("brew", ["install", "llvm", "gcc", "openblas", "libsndfile"], {
                   stdio: "pipe",
                   timeout: 3e5
                 });
@@ -300308,11 +300344,11 @@ Error: ${err2 instanceof Error ? err2.message : String(err2)}`
                   const { renderVerbose: renderVerbose2 } = await Promise.resolve().then(() => (init_render(), render_exports));
                   renderVerbose2(brewResult.stderr.toString());
                 }
-                const llvmPrefix = spawnSync3("brew", ["--prefix", "llvm"], { stdio: "pipe", timeout: 5e3 });
+                const llvmPrefix = spawnSync4("brew", ["--prefix", "llvm"], { stdio: "pipe", timeout: 5e3 });
                 if (llvmPrefix.stdout) {
                   const prefix = llvmPrefix.stdout.toString().trim();
                   process.env.LLVM_CONFIG = `${prefix}/bin/llvm-config`;
-                  const openblas = spawnSync3("brew", ["--prefix", "openblas"], { stdio: "pipe", timeout: 5e3 });
+                  const openblas = spawnSync4("brew", ["--prefix", "openblas"], { stdio: "pipe", timeout: 5e3 });
                   if (openblas.stdout) {
                     const obPrefix = openblas.stdout.toString().trim();
                     process.env.LDFLAGS = `${process.env.LDFLAGS ?? ""} -L${obPrefix}/lib`.trim();
@@ -300325,10 +300361,10 @@ Error: ${err2 instanceof Error ? err2.message : String(err2)}`
               }
             } else {
               renderInfo("  System build tools needed (llvm, gcc). Requesting sudo access...");
-              const sudoCheck = spawnSync3("sudo", ["-v"], { stdio: "inherit", timeout: 6e4 });
+              const sudoCheck = spawnSync4("sudo", ["-v"], { stdio: "inherit", timeout: 6e4 });
               if (sudoCheck.status === 0) {
                 renderInfo("  Installing system build dependencies (this may take a minute)...");
-                const aptResult = spawnSync3("sudo", [
+                const aptResult = spawnSync4("sudo", [
                   "apt-get",
                   "install",
                   "-y",
@@ -306567,8 +306603,8 @@ async function handleUpdate(subcommand, ctx3) {
     renderInfo("Enter your password if prompted...");
     safeWrite("\n");
     try {
-      const { spawnSync: spawnSync3 } = await import("node:child_process");
-      const sudoResult = spawnSync3("sudo", ["-v"], { stdio: "inherit", timeout: 6e4 });
+      const { spawnSync: spawnSync4 } = await import("node:child_process");
+      const sudoResult = spawnSync4("sudo", ["-v"], { stdio: "inherit", timeout: 6e4 });
       if (sudoResult.status !== 0) throw new Error("sudo failed");
     } catch {
       renderWarning("Could not acquire sudo credentials. Try: sudo npm i -g open-agents-ai");
@@ -314969,6 +315005,65 @@ var init_direct_input = __esm({
   }
 });
 
+// packages/cli/src/api/access-policy.ts
+function defaultAccessMode(bindHost) {
+  if (bindHost === "0.0.0.0" || bindHost === "::" || bindHost === "::0") {
+    return "lan";
+  }
+  return "loopback";
+}
+function resolveAccessMode(envValue, bindHost) {
+  const v = (envValue || "").toLowerCase().trim();
+  if (v === "loopback" || v === "lan" || v === "any") return v;
+  return defaultAccessMode(bindHost);
+}
+function stripMappedPrefix(ip) {
+  return ip.replace(/^::ffff:/i, "");
+}
+function isLoopbackIP(ip) {
+  if (!ip) return false;
+  const clean3 = stripMappedPrefix(ip);
+  if (clean3 === "::1") return true;
+  if (/^127\./.test(clean3)) return true;
+  return false;
+}
+function isPrivateIP(ip) {
+  if (!ip) return false;
+  const clean3 = stripMappedPrefix(ip);
+  if (/^10\./.test(clean3)) return true;
+  if (/^192\.168\./.test(clean3)) return true;
+  const m2 = /^172\.(\d{1,3})\./.exec(clean3);
+  if (m2) {
+    const second3 = parseInt(m2[1], 10);
+    if (second3 >= 16 && second3 <= 31) return true;
+  }
+  if (/^169\.254\./.test(clean3)) return true;
+  if (/^f[cd][0-9a-f]{2}:/i.test(clean3)) return true;
+  if (/^fe[89ab][0-9a-f]:/i.test(clean3)) return true;
+  return false;
+}
+function isAllowedIP(ip, mode) {
+  if (mode === "any") return true;
+  if (isLoopbackIP(ip)) return true;
+  if (mode === "lan" && isPrivateIP(ip)) return true;
+  return false;
+}
+function describeAccessMode(mode) {
+  switch (mode) {
+    case "loopback":
+      return "loopback only";
+    case "lan":
+      return "loopback + RFC 1918";
+    case "any":
+      return "any — WIDE OPEN";
+  }
+}
+var init_access_policy = __esm({
+  "packages/cli/src/api/access-policy.ts"() {
+    "use strict";
+  }
+});
+
 // packages/cli/src/api/audit-log.ts
 var audit_log_exports = {};
 __export(audit_log_exports, {
@@ -325781,7 +325876,7 @@ function startApiServer(options2 = {}) {
   if (options2.quiet) setQuiet(true);
   const log22 = options2.quiet ? (_msg) => {
   } : (msg) => process.stderr.write(msg);
-  let host = "127.0.0.1";
+  let host = "0.0.0.0";
   let port = 11435;
   const envHost = process.env["OA_HOST"];
   if (envHost) {
@@ -325957,7 +326052,23 @@ function startApiServer(options2 = {}) {
       process.exit(1);
     }
   }
+  const accessMode = resolveAccessMode(process.env["OA_ACCESS"], host);
+  let _accessRejected = 0;
   const handler = (req2, res) => {
+    const rawIp = req2.socket?.remoteAddress ?? "";
+    if (!isAllowedIP(rawIp, accessMode)) {
+      _accessRejected++;
+      metrics.totalErrors++;
+      try {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({
+          error: "access_denied",
+          message: `Address ${rawIp} is not in the allowed network (mode: ${accessMode}). Set OA_ACCESS=any to disable.`
+        }));
+      } catch {
+      }
+      return;
+    }
     handleRequest(req2, res, ollamaUrl, verbose).catch((err) => {
       metrics.totalErrors++;
       try {
@@ -326028,6 +326139,8 @@ function startApiServer(options2 = {}) {
 `);
     const proto = useTls ? "https" : "http";
     log22(`  Listening on ${proto}://${host}:${port}
+`);
+    log22(`  Access: ${accessMode} (${describeAccessMode(accessMode)})
 `);
     log22(`  Primary: ${config.backendUrl} (${config.backendType || "ollama"})
 `);
@@ -326116,6 +326229,7 @@ var init_serve = __esm({
   "packages/cli/src/api/serve.ts"() {
     "use strict";
     init_config();
+    init_access_policy();
     init_audit_log();
     init_task_manager_singleton();
     init_disk_task_output();
@@ -326247,6 +326361,91 @@ ${incompleteList}${more}`
     }
   };
 }
+function buildSubAgentTools(repoRoot, config) {
+  return [
+    // File + search
+    new FileReadTool(repoRoot),
+    new FileWriteTool(repoRoot),
+    new FileEditTool(repoRoot),
+    new ShellTool(repoRoot),
+    new GrepSearchTool(repoRoot),
+    new GlobFindTool(repoRoot),
+    new ListDirectoryTool(repoRoot),
+    new FileExploreTool(repoRoot),
+    new FilePatchTool(repoRoot),
+    new BatchEditTool(repoRoot),
+    new NotebookEditTool(),
+    // Memory
+    new MemoryReadTool(repoRoot),
+    new MemoryWriteTool(repoRoot),
+    new MemorySearchTool(repoRoot),
+    // Checklist — the critical regression we're closing here
+    new TodoWriteTool(),
+    new TodoReadTool(),
+    new WorkingNotesTool(),
+    // Code understanding + navigation
+    new CodebaseMapTool(repoRoot),
+    new SemanticMapTool(repoRoot),
+    new RepoMapTool(repoRoot),
+    new ImportGraphTool(repoRoot),
+    new DiagnosticTool(repoRoot),
+    new GitInfoTool(repoRoot),
+    new ExploreToolsTool(),
+    new ProcessHealthTool(),
+    // Web research
+    new WebFetchTool(),
+    new WebSearchTool(),
+    new WebCrawlTool(repoRoot),
+    new BrowserActionTool(),
+    new PlaywrightBrowserTool(),
+    // Documents + media reading
+    new ImageReadTool(repoRoot),
+    new OCRTool(repoRoot),
+    new OcrImageAdvancedTool(repoRoot),
+    new OcrPdfTool(repoRoot),
+    new PdfToTextTool(repoRoot),
+    new ScreenshotTool(repoRoot),
+    new StructuredReadTool(repoRoot),
+    new StructuredFileTool(repoRoot),
+    // Audio
+    new AudioPlaybackTool(),
+    new AudioCaptureTool(),
+    new AudioAnalyzeTool(),
+    new AsrListenTool(),
+    new TranscribeFileTool(repoRoot),
+    new TranscribeUrlTool(repoRoot),
+    new YouTubeDownloadTool(repoRoot),
+    // Code execution (sandboxed)
+    new CodeSandboxTool(repoRoot),
+    new ReplTool(repoRoot),
+    // AIWG / SDLC workflow
+    new AiwgSetupTool(repoRoot),
+    new AiwgHealthTool(repoRoot),
+    new AiwgWorkflowTool(repoRoot),
+    // Scheduler + agenda (time-based tooling)
+    new SchedulerTool(repoRoot),
+    new ReminderTool(repoRoot),
+    new AgendaTool(repoRoot),
+    // Vision + multimodal memory
+    new VisionTool(repoRoot),
+    new DesktopClickTool(repoRoot),
+    new DesktopDescribeTool(repoRoot),
+    new VisualMemoryTool(),
+    new MultimodalMemoryTool(),
+    new VideoUnderstandTool(repoRoot),
+    new CameraCaptureTool(),
+    new ImageGenerateTool(repoRoot, config.backendUrl),
+    // Hardware sensors + radios (read-only scans)
+    new GpsLocationTool(),
+    new WifiControlTool(),
+    new BluetoothScanTool(),
+    new SdrScanTool(),
+    new FlipperZeroTool(),
+    new MeshtasticTool(),
+    // Autoresearch (independent ML experiment loop)
+    new AutoresearchTool(repoRoot)
+  ];
+}
 function buildTools(repoRoot, config, contextWindowSize, modelTier) {
   const shellTool = new ShellTool(repoRoot);
   _shellToolRef = shellTool;
@@ -326468,19 +326667,7 @@ function createSubAgentTool(config, repoRoot, ctxWindowSize) {
         recursionDepth: parentDepth + 1,
         maxRecursionDepth: maxDepth
       });
-      const subTools = [
-        new FileReadTool(repoRoot),
-        new FileWriteTool(repoRoot),
-        new FileEditTool(repoRoot),
-        new ShellTool(repoRoot),
-        new GrepSearchTool(repoRoot),
-        new GlobFindTool(repoRoot),
-        new ListDirectoryTool(repoRoot),
-        new WebFetchTool(),
-        new WebSearchTool(),
-        new MemoryReadTool(repoRoot),
-        new MemoryWriteTool(repoRoot)
-      ];
+      const subTools = buildSubAgentTools(repoRoot, config);
       subRunner.registerTools(subTools.map(adaptTool6));
       subRunner.registerTool(createTaskCompleteTool());
       if (background) {
@@ -328354,27 +328541,12 @@ Review its full output in the [${id}] tab or via sub_agent(action='output', id='
             // sub-agents discover their own context window
             modelTier: subTier
           });
-          const subToolInstances = [];
-          const nameSet = new Set(opts.toolNames);
-          const toolMap = {
-            file_read: () => new FileReadTool(repoRoot),
-            file_write: () => new FileWriteTool(repoRoot),
-            file_edit: () => new FileEditTool(repoRoot),
-            shell: () => new ShellTool(repoRoot),
-            grep: () => new GrepSearchTool(repoRoot),
-            glob: () => new GlobFindTool(repoRoot),
-            list_directory: () => new ListDirectoryTool(repoRoot),
-            web_fetch: () => new WebFetchTool(),
-            web_search: () => new WebSearchTool(),
-            memory_read: () => new MemoryReadTool(repoRoot),
-            memory_write: () => new MemoryWriteTool(repoRoot),
-            batch_edit: () => new BatchEditTool(repoRoot),
-            file_patch: () => new FilePatchTool(repoRoot),
-            git_info: () => new GitInfoTool(repoRoot)
-          };
-          for (const [name10, factory] of Object.entries(toolMap)) {
-            if (nameSet.has(name10)) subToolInstances.push(factory());
-          }
+          const allSafe = buildSubAgentTools(repoRoot, config);
+          const nameSet = new Set(opts.toolNames || []);
+          const subToolInstances = nameSet.size > 0 ? allSafe.filter((t2) => nameSet.has(t2.name)) : allSafe.slice();
+          const nameOf = (t2) => t2.name;
+          if (!subToolInstances.some((t2) => nameOf(t2) === "todo_write")) subToolInstances.push(new TodoWriteTool());
+          if (!subToolInstances.some((t2) => nameOf(t2) === "todo_read")) subToolInstances.push(new TodoReadTool());
           subRunner.registerTools(subToolInstances.map(adaptTool6));
           subRunner.registerTool(createTaskCompleteTool(subTier));
           const systemCtx = opts.systemPromptAddition ? `Working directory: ${repoRoot}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-agents-ai",
-  "version": "0.187.230",
+  "version": "0.187.232",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",