open-agents-ai 0.34.3 → 0.34.4

package/dist/index.js

@@ -90,7 +90,7 @@ function setConfigValue(key, value) {
   const configPath = join(dir, "config.json");
   const existing = loadConfigFile();
   existing[key] = coerceConfigValue(key, value);
-  writeFileSync(configPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
+  writeFileSync(configPath, JSON.stringify(existing, null, 2) + "\n", { encoding: "utf8", mode: 384 });
 }
 function coerceConfigValue(key, value) {
   const intKeys = /* @__PURE__ */ new Set(["maxRetries", "timeoutMs"]);
@@ -16181,6 +16181,17 @@ function initOaDirectory(repoRoot) {
   for (const sub of SUBDIRS) {
     mkdirSync6(join25(oaPath, sub), { recursive: true });
   }
+  try {
+    const gitignorePath = join25(repoRoot, ".gitignore");
+    const settingsPattern = ".oa/settings.json";
+    if (existsSync19(gitignorePath)) {
+      const content = readFileSync13(gitignorePath, "utf-8");
+      if (!content.includes(settingsPattern)) {
+        writeFileSync6(gitignorePath, content.trimEnd() + "\n" + settingsPattern + "\n", "utf-8");
+      }
+    }
+  } catch {
+  }
   return oaPath;
 }
 function hasOaDirectory(repoRoot) {
@@ -16201,7 +16212,7 @@ function saveProjectSettings(repoRoot, settings) {
   mkdirSync6(oaPath, { recursive: true });
   const existing = loadProjectSettings(repoRoot);
   const merged = { ...existing, ...settings };
-  writeFileSync6(join25(oaPath, "settings.json"), JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  writeFileSync6(join25(oaPath, "settings.json"), JSON.stringify(merged, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
 }
 function loadGlobalSettings() {
   const settingsPath = join25(homedir9(), ".open-agents", "settings.json");
@@ -16218,7 +16229,7 @@ function saveGlobalSettings(settings) {
   mkdirSync6(dir, { recursive: true });
   const existing = loadGlobalSettings();
   const merged = { ...existing, ...settings };
-  writeFileSync6(join25(dir, "settings.json"), JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  writeFileSync6(join25(dir, "settings.json"), JSON.stringify(merged, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
 }
 function resolveSettings(repoRoot) {
   const global = loadGlobalSettings();
@@ -16670,6 +16681,49 @@ function ask(rl, question) {
     rl.question(question, (answer) => resolve23(answer.trim()));
   });
 }
+function askSecret(rl, question) {
+  return new Promise((resolve23) => {
+    process.stdout.write(question);
+    let secret = "";
+    const stdin = process.stdin;
+    const hadRawMode = stdin.isRaw;
+    if (typeof stdin.setRawMode === "function") {
+      stdin.setRawMode(true);
+    }
+    stdin.resume();
+    const onData = (chunk) => {
+      const ch = chunk.toString("utf8");
+      for (const c3 of ch) {
+        if (c3 === "\r" || c3 === "\n") {
+          stdin.removeListener("data", onData);
+          if (typeof stdin.setRawMode === "function") {
+            stdin.setRawMode(hadRawMode ?? false);
+          }
+          process.stdout.write("\n");
+          resolve23(secret.trim());
+          return;
+        } else if (c3 === "") {
+          stdin.removeListener("data", onData);
+          if (typeof stdin.setRawMode === "function") {
+            stdin.setRawMode(hadRawMode ?? false);
+          }
+          process.stdout.write("\n");
+          resolve23("");
+          return;
+        } else if (c3 === "\x7F" || c3 === "\b") {
+          if (secret.length > 0) {
+            secret = secret.slice(0, -1);
+            process.stdout.write("\b \b");
+          }
+        } else if (c3.charCodeAt(0) >= 32) {
+          secret += c3;
+          process.stdout.write("*");
+        }
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
 async function autoInstallOllama(rl) {
   const plat = platform();
   if (plat === "linux") {
@@ -16899,7 +16953,7 @@ async function promptForCustomEndpoint(config, rl) {
   ${c2.bold("Does this endpoint require an API key?")} (y/n) `);
   let apiKey = "";
   if (needsKey.toLowerCase() === "y" || needsKey.toLowerCase() === "yes") {
-    apiKey = await ask(rl, `  ${c2.bold("API key:")} `);
+    apiKey = await askSecret(rl, `  ${c2.bold("API key:")} `);
   }
   process.stdout.write(`
   ${c2.cyan("\u25CF")} Enter the model name for this endpoint.
@@ -18353,7 +18407,7 @@ async function handleEndpoint(arg, ctx, local = false) {
   process.stdout.write(`    ${c2.cyan("Type".padEnd(12))} ${backendType}
 `);
   if (apiKey) {
-    process.stdout.write(`    ${c2.cyan("Auth".padEnd(12))} Bearer ${apiKey.slice(0, 8)}...
+    process.stdout.write(`    ${c2.cyan("Auth".padEnd(12))} Bearer ${apiKey.slice(0, 4)}...
 `);
   } else {
     process.stdout.write(`    ${c2.cyan("Auth".padEnd(12))} ${provider.authRequired ? c2.yellow("none (may be required)") : "none"}
@@ -24654,12 +24708,18 @@ async function statusCommand(opts, config) {
       "OPEN_AGENTS_TIMEOUT_MS",
       "OPEN_AGENTS_DRY_RUN",
       "OPEN_AGENTS_VERBOSE",
-      "VLLM_BASE_URL"
+      "VLLM_BASE_URL",
+      "VLLM_API_KEY"
     ];
+    const sensitiveEnvVars = /* @__PURE__ */ new Set([
+      "OPEN_AGENTS_API_KEY",
+      "VLLM_API_KEY"
+    ]);
     for (const key of envVars) {
       const val = process.env[key];
       if (val !== void 0) {
-        printKeyValue(key, val.includes("key") || val.includes("KEY") ? "[redacted]" : val, 2);
+        const display = sensitiveEnvVars.has(key) ? val.length > 4 ? `[set \u2014 ${val.slice(0, 4)}...]` : val.length > 0 ? "[set]" : "[empty]" : val;
+        printKeyValue(key, display, 2);
       }
     }
   }
@@ -24777,6 +24837,12 @@ __export(config_exports, {
 import { join as join34, resolve as resolve22 } from "node:path";
 import { homedir as homedir13 } from "node:os";
 import { cwd as cwd3 } from "node:process";
+function redactIfSensitive(key, value) {
+  if (SENSITIVE_KEYS.has(key) && typeof value === "string" && value.length > 0) {
+    return value.length > 4 ? `[set \u2014 ${value.slice(0, 4)}...]` : "[set]";
+  }
+  return String(value);
+}
 function coerceForSettings(key, value) {
   if (INT_KEYS.has(key))
     return parseInt(value, 10);
@@ -24812,7 +24878,7 @@ function handleShow(opts, config) {
   if (projectKeys.length > 0) {
     printSection(`Project Overrides (.oa/settings.json)`);
     for (const [k, v] of projectKeys) {
-      printKeyValue(k, String(v), 2);
+      printKeyValue(k, redactIfSensitive(k, v), 2);
     }
   } else {
     printSection("Project Overrides");
@@ -24823,7 +24889,7 @@ function handleShow(opts, config) {
   if (globalKeys.length > 0) {
     printSection("Global Settings (~/.open-agents/settings.json)");
     for (const [k, v] of globalKeys) {
-      printKeyValue(k, String(v), 2);
+      printKeyValue(k, redactIfSensitive(k, v), 2);
     }
   }
   printSection("Config File");
@@ -24865,7 +24931,7 @@ function handleSet(opts, _config) {
       initOaDirectory(repoRoot);
       const coerced = coerceForSettings(key, value);
       saveProjectSettings(repoRoot, { [key]: coerced });
-      printSuccess(`Project override set: ${key} = ${value}`);
+      printSuccess(`Project override set: ${key} = ${redactIfSensitive(key, value)}`);
       printInfo(`Saved to ${join34(repoRoot, ".oa", "settings.json")}`);
       printInfo("This override applies only when running in this workspace.");
     } catch (err) {
@@ -24875,7 +24941,7 @@ function handleSet(opts, _config) {
   } else {
     try {
       setConfigValue(key, value);
-      printSuccess(`Config updated: ${key} = ${value}`);
+      printSuccess(`Config updated: ${key} = ${redactIfSensitive(key, value)}`);
       printInfo(`Saved to ~/.open-agents/config.json`);
       printInfo("Tip: Use --local to set project-specific overrides.");
     } catch (err) {
@@ -24894,7 +24960,7 @@ function handleKeys() {
   printInfo("  oa config set model qwen3.5:122b          # global default");
   printInfo("  oa config set model qwen3.5:122b --local  # this project only");
 }
-var CONFIG_KEYS, INT_KEYS, BOOL_KEYS;
+var CONFIG_KEYS, SENSITIVE_KEYS, INT_KEYS, BOOL_KEYS;
 var init_config3 = __esm({
   "packages/cli/dist/commands/config.js"() {
     "use strict";
@@ -24916,6 +24982,7 @@ var init_config3 = __esm({
       stream: "Enable real-time token streaming with pastel syntax highlighting (true/false)",
       bruteforce: "Brute-force mode: auto re-engage agent when turn limit hit (true/false)"
     };
+    SENSITIVE_KEYS = /* @__PURE__ */ new Set(["apiKey", "api_key", "secret", "password", "token"]);
     INT_KEYS = /* @__PURE__ */ new Set(["maxRetries", "timeoutMs"]);
     BOOL_KEYS = /* @__PURE__ */ new Set(["dryRun", "verbose", "voice", "stream", "bruteforce"]);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-agents-ai",
-  "version": "0.34.3",
+  "version": "0.34.4",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",