open-agents-ai 0.187.300 → 0.187.301

package/dist/index.js

@@ -297407,6 +297407,13 @@ async function handleSlashCommand(input, ctx3) {
             return "handled";
           }
           process.env["OA_ACCESS"] = val2;
+          if (val2 === "any" && !process.env["OA_API_KEY"]) {
+            const { randomBytes: randomBytes23 } = await import("node:crypto");
+            const apiKey = randomBytes23(16).toString("hex");
+            process.env["OA_API_KEY"] = apiKey;
+            renderInfo2(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
+            renderInfo2("Use the Web UI ‘key’ button to paste this token, or set Authorization: Bearer <key> in your client.");
+          }
           if (hasLocal2) {
             ctx4.saveLocalSettings({ oaAccess: val2 });
           } else {
@@ -297436,6 +297443,13 @@ async function handleSlashCommand(input, ctx3) {
         return "handled";
       }
       process.env["OA_ACCESS"] = val;
+      if (val === "any" && !process.env["OA_API_KEY"]) {
+        const { randomBytes: randomBytes23 } = await import("node:crypto");
+        const apiKey = randomBytes23(16).toString("hex");
+        process.env["OA_API_KEY"] = apiKey;
+        renderInfo2(`Generated API key: ${c3.bold(c3.yellow(apiKey))}`);
+        renderInfo2("Use the Web UI ‘key’ button to paste this token, or set Authorization: Bearer <key> in your client.");
+      }
       if (hasLocal) {
         ctx3.saveLocalSettings({ oaAccess: val });
       } else {
@@ -320871,6 +320885,20 @@ async function sendMessage() {
       signal: chatAbortController.signal,
     });
 
+    // Auth prompt on 403 — open the key modal for a clean ingress
+    if (response.status === 401 || response.status === 403) {
+      streaming = false;
+      chatAbortController = null;
+      document.getElementById('send-btn').style.display = 'inline-block';
+      document.getElementById('stop-btn').style.display = 'none';
+      contentDiv.innerHTML = '<div style="background:#2a1e1e;border-left:3px solid #ffcc44;color:#ffcc44;padding:6px 10px 6px 14px;margin:3px 0;font-family:inherit">' +
+        '<div style="color:#ffcc44;font-size:0.6rem;text-transform:uppercase;letter-spacing:0.08em;margin-bottom:2px">▸ auth required</div>' +
+        '<div style="color:#ffe08a">Remote access requires an API key. Click the “key” button in the header and paste your token.</div>' +
+      '</div>';
+      try { document.getElementById('key-modal').classList.add('visible'); } catch {}
+      return;
+    }
+
     // Session continuity — capture session_id from BOTH the response header
     // (set on SSE paths) and the JSON body (set on non-streaming paths).
     // Without this fallback, every message could start a fresh session and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-agents-ai",
-  "version": "0.187.300",
+  "version": "0.187.301",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",