open-agents-ai 0.187.299 → 0.187.301

package/dist/index.js

@@ -297392,10 +297392,11 @@ async function handleSlashCommand(input, ctx3) {
         description: "Show/set OA_ACCESS (loopback|lan|any)",
         handler: async ({ arg: arg2, hasLocal: hasLocal2, ctx: ctx4 }) => {
           const normalize2 = (v) => v.toLowerCase().trim();
+          const normalizeMode2 = (v) => v === "all" ? "any" : v;
           const curAccess2 = normalize2(process.env["OA_ACCESS"] ?? "");
           const curHost2 = process.env["OA_HOST"] ?? "0.0.0.0:11435";
           const allowed2 = /* @__PURE__ */ new Set(["loopback", "lan", "any"]);
-          const val2 = normalize2(arg2);
+          const val2 = normalizeMode2(normalize2(arg2));
           if (!val2) {
             renderInfo2(`Access: ${curAccess2 || "(default)"}  Host: ${curHost2}`);
             renderInfo2("Use /access loopback|lan|any to change (restarts daemon).\n");
@@ -297406,6 +297407,13 @@ async function handleSlashCommand(input, ctx3) {
             return "handled";
           }
           process.env["OA_ACCESS"] = val2;
+          if (val2 === "any" && !process.env["OA_API_KEY"]) {
+            const { randomBytes: randomBytes23 } = await import("node:crypto");
+            const apiKey = randomBytes23(16).toString("hex");
+            process.env["OA_API_KEY"] = apiKey;
+            renderInfo2(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
+            renderInfo2("Use the Web UI ‘key’ button to paste this token, or set Authorization: Bearer <key> in your client.");
+          }
           if (hasLocal2) {
             ctx4.saveLocalSettings({ oaAccess: val2 });
           } else {
@@ -297420,10 +297428,11 @@ async function handleSlashCommand(input, ctx3) {
         }
       });
       const normalize = (v) => v.toLowerCase().trim();
+      const normalizeMode = (v) => v === "all" ? "any" : v;
       const curAccess = normalize(process.env["OA_ACCESS"] ?? "");
       const curHost = process.env["OA_HOST"] ?? "0.0.0.0:11435";
       const allowed = /* @__PURE__ */ new Set(["loopback", "lan", "any"]);
-      const val = normalize(arg);
+      const val = normalizeMode(normalize(arg));
       if (!val) {
         renderInfo2(`Access: ${curAccess || "(default)"}  Host: ${curHost}`);
         renderInfo2("Use /access loopback|lan|any to change (restarts daemon).\n");
@@ -297434,6 +297443,13 @@ async function handleSlashCommand(input, ctx3) {
         return "handled";
       }
       process.env["OA_ACCESS"] = val;
+      if (val === "any" && !process.env["OA_API_KEY"]) {
+        const { randomBytes: randomBytes23 } = await import("node:crypto");
+        const apiKey = randomBytes23(16).toString("hex");
+        process.env["OA_API_KEY"] = apiKey;
+        renderInfo2(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
+        renderInfo2("Use the Web UI ‘key’ button to paste this token, or set Authorization: Bearer <key> in your client.");
+      }
       if (hasLocal) {
         ctx3.saveLocalSettings({ oaAccess: val });
       } else {
@@ -320869,6 +320885,20 @@ async function sendMessage() {
       signal: chatAbortController.signal,
     });
 
+    // Auth prompt on 403 — open the key modal for a clean ingress
+    if (response.status === 401 || response.status === 403) {
+      streaming = false;
+      chatAbortController = null;
+      document.getElementById('send-btn').style.display = 'inline-block';
+      document.getElementById('stop-btn').style.display = 'none';
+      contentDiv.innerHTML = '<div style="background:#2a1e1e;border-left:3px solid #ffcc44;color:#ffcc44;padding:6px 10px 6px 14px;margin:3px 0;font-family:inherit">' +
+        '<div style="color:#ffcc44;font-size:0.6rem;text-transform:uppercase;letter-spacing:0.08em;margin-bottom:2px">▸ auth required</div>' +
+        '<div style="color:#ffe08a">Remote access requires an API key. Click the “key” button in the header and paste your token.</div>' +
+      '</div>';
+      try { document.getElementById('key-modal').classList.add('visible'); } catch {}
+      return;
+    }
+
     // Session continuity — capture session_id from BOTH the response header
     // (set on SSE paths) and the JSON body (set on non-streaming paths).
     // Without this fallback, every message could start a fresh session and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-agents-ai",
-  "version": "0.187.299",
+  "version": "0.187.301",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",