FastMCP.from_fastapi() uses an internal httpx client to call the
FastAPI routes. Without auth headers, every tool call (run_command,
read_file, etc.) hits the verify_api_key guard and returns 401.
Fixes tool calls returning: 'HTTP error 401: Unauthorized - Invalid API key'
All LLM-exposed file endpoints (list_files, read_file, write_file,
display_file, replace_file_content, grep_search, glob_search) now
read the X-Session-Id header and resolve relative paths against the
session's working directory instead of always using fs.home.
- Added optional cwd parameter to UserFS.resolve_path()
- Relative paths join against cwd if provided, else fs.home
- Absolute paths are unaffected
- execute endpoint also resolves relative cwd param against session cwd
All LLM-exposed file endpoints (list_files, read_file, write_file,
display_file, replace_file_content, grep_search, glob_search) now
read the X-Session-Id header and resolve relative paths against the
session's working directory instead of always using fs.home.
- Added optional cwd parameter to UserFS.resolve_path()
- Relative paths join against cwd if provided, else fs.home
- Absolute paths are unaffected
- execute endpoint also resolves relative cwd param against session cwd
Replace the process-global os.chdir() with an in-memory dictionary
keyed by session ID (passed via X-Session-Id header). Multiple
concurrent chat sessions now maintain independent working directories.
- GET/POST /files/cwd read X-Session-Id to resolve per-session cwd
- POST /execute falls back to session cwd when no cwd param provided
- POST /api/terminals spawns PTY in the session's cwd
- 7-day sliding TTL for session entries
- Fully backward compatible: no header = fs.home default
- Increase auto-generated API key entropy from 192-bit to 384-bit
- Use hmac.compare_digest() for constant-time key comparison (HTTP + WS)
- Refuse to start without OPEN_TERMINAL_API_KEY configured
- Add prominent CORS wildcard warning at startup
- Bump version to 0.11.30
_chown() transferred file ownership to the provisioned user but didn't
set group-write permission, leaving files at 644. The server process
(a group member) could create new files but couldn't overwrite them on
subsequent saves, returning PermissionError. Now sets chmod g+w after
chown, matching the 2770 treatment already applied to directories.
Fixes#93
Add a single POST /files/archive endpoint that bundles one or more
files and directories into a ZIP archive for download.
- Accepts a list of paths (files and/or directories)
- Directories are recursively included with relative paths preserved
- Multi-user access control enforced via UserFS
- Cross-platform ZIP format (Windows, macOS, Linux)
- Archive name derived from input (single item = item name, multiple = download.zip)
Closes#92
- GET /system returns a structured system prompt grounding the LLM in
the environment (OS, hostname, user, shell, Python version) with
directives for tool usage
- Gated by OPEN_TERMINAL_ENABLE_SYSTEM_PROMPT env var (default: true)
- Advertised via features.system in GET /api/config for consumer discovery
- OPEN_TERMINAL_SYSTEM_PROMPT env var for full prompt override
- Endpoint excluded from OpenAPI schema, auth-protected
Moved all document text extraction logic from read_file() into a
dedicated utils/documents.py module with an EXTRACTORS registry.
The read_file endpoint now iterates the registry in a 15-line loop
instead of inlining ~330 lines of per-format parsing.
Adding a new format requires only a single extract_* function and
a one-line registry entry. No behaviour changes.
Extended document text extraction to seven more formats:
- .rtf: strips formatting to plain text (striprtf, BSD)
- .xls: legacy Excel, renders sheets as tab-separated values (xlrd, BSD)
- .odt: OpenDocument text, extracts paragraphs (stdlib + lxml, BSD)
- .ods: OpenDocument spreadsheet, extracts all sheets (stdlib + lxml, BSD)
- .odp: OpenDocument presentation, extracts slide text (stdlib + lxml, BSD)
- .epub: extracts body text in spine reading order (stdlib + lxml, BSD)
- .eml: extracts headers and body with HTML stripping (stdlib + lxml, BSD)
All support start_line/end_line range selection.
Office documents are now automatically converted to text and returned
in the standard JSON format, making them readable by LLMs.
- .docx: extracts paragraphs and table contents (python-docx, MIT)
- .xlsx: renders all sheets as tab-separated values (openpyxl, MIT)
- .pptx: extracts text from all slides (python-pptx, MIT)
Supports start_line/end_line range selection, consistent with the
existing PDF handler.
The _FILE mutual-exclusivity guard silently passed when the plain env
var was set to an empty string, because empty strings are falsy.
Python: changed `if value and file_path` to
`if value is not None and file_path is not None`, and the fallback
return from `value or default` to
`value if value is not None else default`.
entrypoint.sh: changed ${!var:-} to ${!var+set} to test whether the
variable is defined at all, not just non-empty.
entrypoint-slim.sh: changed -n tests to ${var+set} via eval, matching
the bash entrypoint semantics.
list_ports triggered full user provisioning (useradd) just to filter
ports by UID. On runtimes that reject useradd (e.g. Azure Container
Apps), this crashed with an unhandled CalledProcessError.
Now catches provisioning failures and returns an empty port list —
an unprovisioned user has no listening ports to show.
setcap cap_setgid+ep on the system Python binary made all Python
processes non-dumpable, blocking /proc/[pid]/fd/ access needed by
_pid_from_inode() to resolve socket inodes to PIDs.
Fix: copy the Python binary to python3-ot and setcap only the copy.
The open-terminal server uses python3-ot (has CAP_SETGID for
multi-user os.setgroups()), while user-spawned python3 stays
capability-free and dumpable.
Slim/Alpine: removed setcap entirely (multi-user mode requires sudo,
which only the full image has). Kept libcap packages installed.
README: corrected Image Variants table — multi-user mode is
full-image only.
ensure_os_user() no longer unconditionally requires sudo; when the
process is already root (e.g. user: '0:0' in Docker Compose), user
provisioning commands run directly. check_environment() now only
requires sudo when not running as root.
Directories created by run_command (as the provisioned user via sudo -u)
get default 755 permissions, leaving the server process without group-write.
Both makedirs (creating subdirs) and aiofiles.open (creating files) fail
with EPERM.
UserFS._ensure_parents now:
- Creates directories as the provisioned user (sudo -u mkdir -p) to bypass
755 restrictions on existing parent directories
- Sets 2770 (setgid + group rwx) on all intermediate directories up to the
user's home, matching the home directory's permissions
- Falls through to plain makedirs in single-user mode (no behavior change)
Closes#70
