osai-agent 4.2.23 → 4.2.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osai-agent",
-  "version": "4.2.23",
+  "version": "4.2.25",
   "type": "module",
   "description": "OS AI Agent - YOUR AI AGENT",
   "main": "src/index.js",

package/src/commands/admin.js

@@ -12,7 +12,7 @@ const promptSecret = () => new Promise((resolve) => {
   });
 });
 
-const adminFetch = async (serverArg, path, method = 'GET', body = null) => {
+const adminFetch = async (serverArg, path, method = 'GET', body = null, pathPrefix = '/auth') => {
   const config = new Conf({ projectName: 'osai-agent' });
   const serverUrl = serverArg || config.get('server') || DEFAULT_SERVER_URL;
   const httpUrl = toHttpUrl(serverUrl);
@@ -32,7 +32,7 @@ const adminFetch = async (serverArg, path, method = 'GET', body = null) => {
     options.body = JSON.stringify(body);
   }
 
-  const response = await fetch(`${httpUrl}/auth${path}`, options);
+  const response = await fetch(`${httpUrl}${pathPrefix}${path}`, options);
   const data = await response.json().catch(() => null);
 
   if (!response.ok) {
@@ -80,3 +80,14 @@ export const enableUser = async ({ server, email }) => {
   const data = await adminFetch(server, '/admin/enable-user', 'POST', { email });
   const spinner = ora().succeed(chalk.green(`User enabled: ${data.email}`));
 };
+
+export const generateProKeys = async ({ server, count, type }) => {
+  const spinner = ora('Generating Pro keys...').start();
+  const data = await adminFetch(server, '/generate', 'POST', { type, count }, '/pro');
+  spinner.stop();
+  console.log(chalk.green(`\n  ${data.count} Pro keys generated (${data.type}, ${data.duration_days} days):\n`));
+  for (const key of data.keys) {
+    console.log(`    ${chalk.hex('#ff9e64')(key)}`);
+  }
+  console.log();
+};

package/src/index.js

@@ -26,7 +26,7 @@ import { handleMcpCommand } from './commands/mcp.js';
 import { stopSubagent } from './commands/stop-subagent.js';
 import { claimProKey } from './commands/pro.js';
 import { deleteAccount } from './commands/account.js';
-import { listUsers, disableUser, enableUser } from './commands/admin.js';
+import { listUsers, disableUser, enableUser, generateProKeys } from './commands/admin.js';
 import minimist from 'minimist';
 import updateNotifier from 'update-notifier';
 import { createRequire } from 'module';
@@ -153,6 +153,10 @@ switch (cmd) {
     } else if (args._[1] === 'enable') {
       if (!args._[2]) { console.error('Usage: osai-agent admin enable <email>'); process.exit(1); }
       await enableUser({ server: args.server, email: args._[2] });
+    } else if (args._[1] === 'pro-gen') {
+      const count = Math.min(Math.max(1, parseInt(args._[2]) || 1), 50);
+      const type = args.type || 'monthly';
+      await generateProKeys({ server: args.server, count, type });
     } else {
       console.log();
       console.log('Usage: osai-agent admin <subcommand> [args]');
@@ -161,6 +165,7 @@ switch (cmd) {
       console.log('  users                     List all users');
       console.log('  disable <email>           Disable a user account');
       console.log('  enable <email>            Re-enable a user account');
+      console.log('  pro-gen <count>           Generate Pro keys (--type monthly|yearly)');
       console.log();
       process.exit(1);
     }

package/src/tools/local.js

@@ -15,6 +15,13 @@ const COMMAND_TIMEOUT = parseInt(process.env.OSAI_COMMAND_TIMEOUT) || DEFAULTS.C
 const FETCH_TIMEOUT = parseInt(process.env.OSAI_FETCH_TIMEOUT) || DEFAULTS.FETCH_TIMEOUT;
 const MAX_COMMAND_OUTPUT_CHARS = parseInt(process.env.OSAI_MAX_COMMAND_OUTPUT_CHARS || '40000', 10);
 
+const SAFE_ENV_KEYS = new Set([
+  'PATH', 'HOME', 'USER', 'USERNAME', 'HOSTNAME', 'HOST',
+  'LANG', 'LC_ALL', 'LC_CTYPE', 'TERM', 'SHELL',
+  'TMPDIR', 'TMP', 'TEMP', 'XDG_*', 'DISPLAY', 'WAYLAND_DISPLAY',
+  'NODE_ENV', 'PYTHONIOENCODING', 'LANG',
+]);
+
 /** Commands that spawn interactive shells — must be blocked */
 const INTERACTIVE_COMMANDS = [
   /^cmd(\s+\/k)?$/i, /^powershell(\s+-noexit)?$/i, /^bash$/i, /^sh$/i,
@@ -211,6 +218,12 @@ export const executeLocal = async (command, sudoPassword = null) => {
     }
   }
 
+  // Block dangerous patterns
+  const safety = validateLocalCommand(trimmedCmd);
+  if (!safety.safe) {
+    return { success: false, output: '', error: safety.reason };
+  }
+
   logger.debug('Executing local command', { cmd: trimmedCmd, timeout: COMMAND_TIMEOUT });
 
   const isWindows = detectOS() === 'windows';
@@ -220,6 +233,12 @@ export const executeLocal = async (command, sudoPassword = null) => {
     finalCommand = finalCommand.replace(/^sudo\b/, 'sudo -S');
   }
 
+  // Apply resource limits via shell (non-Windows)
+  if (!isWindows) {
+    const cpuSecs = Math.ceil(COMMAND_TIMEOUT / 1000);
+    finalCommand = `ulimit -t ${cpuSecs} -v 524288 2>/dev/null; ${finalCommand}`;
+  }
+
   return await new Promise((resolve) => {
     let output = '';
     let truncatedChars = 0;
@@ -233,10 +252,20 @@ export const executeLocal = async (command, sudoPassword = null) => {
       if (text.length > remaining) truncatedChars += text.length - remaining;
     };
 
+    const filteredEnv = Object.fromEntries(
+      Object.entries(process.env).filter(([key]) => {
+        if (SAFE_ENV_KEYS.has(key)) return true;
+        if (key.startsWith('XDG_')) return true;
+        return false;
+      })
+    );
+    filteredEnv.PYTHONIOENCODING = 'utf-8';
+    filteredEnv.LANG = 'en_US.UTF-8';
+
     const child = spawn(finalCommand, {
       shell: isWindows ? 'cmd.exe' : '/bin/sh',
       windowsHide: true,
-      env: { ...process.env, PYTHONIOENCODING: 'utf-8', LANG: 'en_US.UTF-8' },
+      env: filteredEnv,
     });
 
     if (sudoPassword) {
@@ -761,12 +790,18 @@ export const getFileInfo = async (filePath) => {
  * Fetch content from a URL (for documentation, API data, etc.)
  * {"tool":"FETCH_URL","url":"<url>","description":"<why>"}
  */
+const PRIVATE_IP_RE = /^(https?:\/\/)(127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.|0\.|::1|fc00:|fe80:)/i;
+
 export const fetchUrl = async (url, description = '') => {
   try {
     if (!url || !url.startsWith('http')) {
       return { success: false, output: '', error: 'Invalid URL. Must start with http:// or https://' };
     }
 
+    if (PRIVATE_IP_RE.test(url)) {
+      return { success: false, output: '', error: 'Blocked: URL points to a private/internal network address' };
+    }
+
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT);