@automagik/omni 2.260430.7 → 2.260430.9

package/dist/commands/doctor.d.ts

@@ -41,7 +41,7 @@ import { type Config, type ServerConfig } from '../config.js';
 /** Severity levels reported by each check. */
 export type CheckLevel = 'OK' | 'WARN' | 'FAIL';
 /** Identifier used in tests and --json output. */
-export type CheckId = 'pm2-env-drift' | 'cli-key-valid' | 'pgserve-reachable' | 'omni-db-exists' | 'orphaned-data-dirs' | 'version-match' | 'pm2-status' | 'pm2-max-restarts' | 'pm2-logrotate-installed';
+export type CheckId = 'pm2-env-drift' | 'cli-key-valid' | 'pgserve-reachable' | 'omni-db-exists' | 'orphaned-data-dirs' | 'version-match' | 'pm2-status' | 'pm2-max-restarts' | 'pm2-logrotate-installed' | 'cli-signing-key-for-locked-instances';
 export interface CheckResult {
     id: CheckId;
     level: CheckLevel;
@@ -117,6 +117,24 @@ export interface DoctorDeps {
     sleepMs: (ms: number) => Promise<void>;
     /** Capture `pm2 conf` stdout (or null on error). Used by pm2-logrotate check. */
     capturePm2Conf: () => Promise<string | null>;
+    /**
+     * List instances that have `requireGenieSignature: true` set. Used by the
+     * signature-key-for-locked-instances check (omni-host-fingerprint-trust
+     * P2). Returns an empty array when the API is unreachable — the check
+     * then becomes a no-op rather than false-positive WARN.
+     */
+    listLockedInstances: () => Promise<{
+        id: string;
+        name: string;
+    }[]>;
+    /**
+     * Return true when the running CLI has a usable ed25519 keypair (i.e.
+     * `omni trust handshake` has been run). Locked instances refuse
+     * bearer-only requests, so an operator without a key can only do the
+     * unlock-only PATCH escape — anything else fails with 401. We surface
+     * that as a WARN so it's caught before the operator hits the wall.
+     */
+    cliHasSigningKey: () => boolean;
 }
 /**
  * Run all checks and optionally apply fixes. Returns a structured

package/dist/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAMH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,YAAY,EAA4C,MAAM,cAAc,CAAC;AAcxG,8CAA8C;AAC9C,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhD,kDAAkD;AAClD,MAAM,MAAM,OAAO,GACf,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,gBAAgB,GAChB,oBAAoB,GACpB,eAAe,GACf,YAAY,GACZ,kBAAkB,GAClB,yBAAyB,CAAC;AAE9B,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,UAAU,QAAQ;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;QACzC,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7B;AAoCD,uEAAuE;AACvE,MAAM,WAAW,UAAU;IACzB,mDAAmD;IACnD,eAAe,EAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;IAClD,+DAA+D;IAC/D,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,uEAAuE;IACvE,YAAY,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,oEAAoE;IACpE,oBAAoB,EAAE,MAAM,MAAM,EAAE,CAAC;IACrC,qDAAqD;IACrD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChE,8DAA8D;IAC9D,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,6CAA6C;IAC7C,SAAS,EAAE,MAAM;QAAE,YAAY,EAAE,YAAY,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE;;;OAGG;IACH,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,oEAAoE;IACpE,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,2DAA2D;IAC3D,eAAe,EAAE,MAAM,MAAM,CAAC;IAC9B,0DAA0D;IAC1D,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,mEAAmE;IACnE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,iFAAiF;IACjF,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC9C;AAseD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBxG;AA2BD,wBAAgB,mBAAmB,IAAI,OAAO,CA+C7C"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAMH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,YAAY,EAA4C,MAAM,cAAc,CAAC;AAexG,8CAA8C;AAC9C,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhD,kDAAkD;AAClD,MAAM,MAAM,OAAO,GACf,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,gBAAgB,GAChB,oBAAoB,GACpB,eAAe,GACf,YAAY,GACZ,kBAAkB,GAClB,yBAAyB,GACzB,sCAAsC,CAAC;AAE3C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,UAAU,QAAQ;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;QACzC,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7B;AAoCD,uEAAuE;AACvE,MAAM,WAAW,UAAU;IACzB,mDAAmD;IACnD,eAAe,EAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;IAClD,+DAA+D;IAC/D,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,uEAAuE;IACvE,YAAY,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,oEAAoE;IACpE,oBAAoB,EAAE,MAAM,MAAM,EAAE,CAAC;IACrC,qDAAqD;IACrD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChE,8DAA8D;IAC9D,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,6CAA6C;IAC7C,SAAS,EAAE,MAAM;QAAE,YAAY,EAAE,YAAY,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE;;;OAGG;IACH,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,oEAAoE;IACpE,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,2DAA2D;IAC3D,eAAe,EAAE,MAAM,MAAM,CAAC;IAC9B,0DAA0D;IAC1D,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,mEAAmE;IACnE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,iFAAiF;IACjF,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACnE;;;;;;OAMG;IACH,gBAAgB,EAAE,MAAM,OAAO,CAAC;CACjC;AAyiBD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBxG;AA2BD,wBAAgB,mBAAmB,IAAI,OAAO,CA+C7C"}

package/dist/index.js

@@ -114079,7 +114079,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260430.7",
+  version: "2.260430.9",
   description: "LLM-optimized CLI for Omni",
   type: "module",
   bin: {
@@ -118866,7 +118866,22 @@ function productionDeps() {
       if (code !== 0)
         return null;
       return stdout;
-    }
+    },
+    listLockedInstances: async () => {
+      const cliConfig = loadConfig();
+      if (!cliConfig.apiKey)
+        return [];
+      try {
+        const apiPort = loadServerConfig().port;
+        const baseUrl = cliConfig.apiUrl ?? `http://localhost:${apiPort}`;
+        const client = createOmniClient({ baseUrl, apiKey: cliConfig.apiKey, cliVersion: VERSION });
+        const { items } = await client.instances.list({ limit: 200 });
+        return items.filter((i) => i.requireGenieSignature === true).map((i) => ({ id: i.id, name: i.name }));
+      } catch {
+        return [];
+      }
+    },
+    cliHasSigningKey: () => loadSigningContext() !== null
   };
 }
 function scanForOrphans(dir, acc, depth, maxDepth = 4) {
@@ -119148,6 +119163,31 @@ function fixOrphanedDataDirs(deps) {
   raw("");
   return `printed ${found.length} rm-rf suggestion(s)`;
 }
+async function checkSigningKeyForLockedInstances(deps) {
+  const locked = await deps.listLockedInstances();
+  if (locked.length === 0) {
+    return {
+      id: "cli-signing-key-for-locked-instances",
+      level: "OK",
+      detail: "no instances require signed requests (or API unreachable \u2014 check pgserve-reachable / omni-db-exists)"
+    };
+  }
+  const hasKey = deps.cliHasSigningKey();
+  if (hasKey) {
+    return {
+      id: "cli-signing-key-for-locked-instances",
+      level: "OK",
+      detail: `${locked.length} instance(s) require signing; CLI has a signing key \u2014 admin will sign automatically`
+    };
+  }
+  const names = locked.slice(0, 3).map((i) => i.name || i.id.slice(0, 8)).join(", ");
+  const more = locked.length > 3 ? ` (+${locked.length - 3} more)` : "";
+  return {
+    id: "cli-signing-key-for-locked-instances",
+    level: "WARN",
+    detail: `${locked.length} instance(s) require signing (${names}${more}) but this CLI has no key in ~/.omni/keys/. Bearer-only admin against these instances will fail with 401 GENIE_SIGNATURE_REQUIRED. Run \`omni trust handshake\` to enable signed requests. (The unlock-only PATCH escape from omni#568 still works without a key.)`
+  };
+}
 async function runAllChecks(deps) {
   return [
     await checkPm2EnvDrift(deps),
@@ -119158,7 +119198,8 @@ async function runAllChecks(deps) {
     await checkVersionMatch(deps),
     await checkPm2Status(deps),
     await checkPm2MaxRestarts(deps),
-    await checkPm2LogrotateInstalled(deps)
+    await checkPm2LogrotateInstalled(deps),
+    await checkSigningKeyForLockedInstances(deps)
   ];
 }
 async function applyFix(deps, check) {

package/dist/server/index.js

@@ -224556,7 +224556,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package8 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260430.7",
+    version: "2.260430.9",
     type: "module",
     exports: {
       ".": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260430.7",
+  "version": "2.260430.9",
   "description": "LLM-optimized CLI for Omni",
   "type": "module",
   "bin": {
@@ -50,15 +50,15 @@
     "qrcode-terminal": "^0.12.0"
   },
   "devDependencies": {
-    "@omni/api": "2.260430.6",
-    "@omni/channel-discord": "2.260430.6",
-    "@omni/channel-gupshup": "2.260430.6",
-    "@omni/channel-sdk": "2.260430.6",
-    "@omni/channel-slack": "2.260430.6",
-    "@omni/channel-telegram": "2.260430.6",
-    "@omni/channel-whatsapp": "2.260430.6",
-    "@omni/core": "2.260430.6",
-    "@omni/sdk": "2.260430.6",
+    "@omni/api": "2.260430.8",
+    "@omni/channel-discord": "2.260430.8",
+    "@omni/channel-gupshup": "2.260430.8",
+    "@omni/channel-sdk": "2.260430.8",
+    "@omni/channel-slack": "2.260430.8",
+    "@omni/channel-telegram": "2.260430.8",
+    "@omni/channel-whatsapp": "2.260430.8",
+    "@omni/core": "2.260430.8",
+    "@omni/sdk": "2.260430.8",
     "@types/node": "^22.10.3",
     "@types/qrcode-terminal": "^0.12.2",
     "typescript": "^5.7.3"