@automagik/omni 2.260717.4 → 2.260717.6

package/dist/index.js

@@ -125164,7 +125164,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260717.4",
+  version: "2.260717.6",
   description: "LLM-optimized CLI for Omni",
   type: "module",
   bin: {

package/dist/server/index.js

@@ -225883,7 +225883,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package7 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260717.4",
+    version: "2.260717.6",
     type: "module",
     exports: {
       ".": {
@@ -284984,16 +284984,26 @@ var init_genie_signature = __esm(() => {
   log59 = createLogger("api:genie-signature");
   ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
   genieSignatureMiddleware = createMiddleware(async (c, next) => {
-    const services = c.get("services");
-    if (!services?.genieHosts) {
-      return next();
-    }
     const hostIdHeader = c.req.header(HEADER_HOST_ID);
     const timestampHeader = c.req.header(HEADER_TIMESTAMP);
     const signatureHeader = c.req.header(HEADER_SIGNATURE);
     if (!hostIdHeader && !timestampHeader && !signatureHeader) {
       return next();
     }
+    const services = c.get("services");
+    if (!services?.genieHosts) {
+      log59.warn("genie signature verification service unavailable", {
+        hostId: hostIdHeader,
+        method: c.req.method,
+        path: new URL(c.req.url).pathname
+      });
+      return c.json({
+        error: {
+          code: "GENIE_SIGNATURE_SERVICE_UNAVAILABLE",
+          message: "Genie host signature verification is temporarily unavailable."
+        }
+      }, 503);
+    }
     let body = "";
     if (c.req.method !== "GET" && c.req.method !== "HEAD") {
       body = await c.req.text();
@@ -285684,16 +285694,27 @@ var init_scopes = __esm(() => {
 });
 
 // ../api/src/lib/signed-host-scope-context.ts
+function hasAnyGenieSignatureHeader(c) {
+  return GENIE_SIGNATURE_HEADERS.some((header) => c.req.header(header) !== undefined);
+}
 function readSignedHostScopeContext(c) {
   const hostId = c.get("signedBy");
-  if (!hostId)
+  if (!hostId) {
+    if (hasAnyGenieSignatureHeader(c)) {
+      return { kind: "invalid", hostId: c.req.header("x-genie-host-id") ?? "unknown" };
+    }
     return { kind: "unsigned" };
+  }
   const scopes = c.get("signedByScopes");
   if (!Array.isArray(scopes) || !scopes.every((scope) => typeof scope === "string")) {
     return { kind: "invalid", hostId };
   }
   return { kind: "valid", hostId, scopes };
 }
+var GENIE_SIGNATURE_HEADERS;
+var init_signed_host_scope_context = __esm(() => {
+  GENIE_SIGNATURE_HEADERS = ["x-genie-host-id", "x-genie-timestamp", "x-genie-signature"];
+});
 
 // ../api/src/middleware/scope-enforcer.ts
 function buildSegmentRegex(patternPath) {
@@ -285878,6 +285899,7 @@ var init_scope_enforcer = __esm(() => {
   init_factory2();
   init_profiles();
   init_scopes();
+  init_signed_host_scope_context();
   init_api_keys();
   log61 = createLogger("api:scope-enforcer");
   OUTBOUND_SEND_PREFIXES = ["/messages/send"];
@@ -356823,6 +356845,20 @@ function enforceScopeCeiling(c, requestedScopes) {
     }
   }, 403);
 }
+function enforceInstanceCeiling(c, requestedInstanceIds) {
+  const apiKey = c.get("apiKey");
+  if (apiKey?.instanceIds === null)
+    return null;
+  const exceedsCaller = !apiKey || !Array.isArray(apiKey.instanceIds) || requestedInstanceIds === null || requestedInstanceIds.some((instanceId) => !apiKey.instanceIds?.includes(instanceId));
+  if (!exceedsCaller)
+    return null;
+  return c.json({
+    error: {
+      code: "FORBIDDEN",
+      message: "Cannot grant instance access that exceeds the caller's own."
+    }
+  }, 403);
+}
 async function handleProfileCreate(c, data, services) {
   try {
     const resolved = resolveProfile({
@@ -356837,6 +356873,9 @@ async function handleProfileCreate(c, data, services) {
     const ceilingDenied = enforceScopeCeiling(c, resolved.scopes);
     if (ceilingDenied)
       return ceilingDenied;
+    const instanceCeilingDenied = enforceInstanceCeiling(c, data.instanceIds ?? null);
+    if (instanceCeilingDenied)
+      return instanceCeilingDenied;
     const result = await services.apiKeys.create({
       name: data.name,
       description: data.description,
@@ -356872,6 +356911,9 @@ async function handleLegacyCreate(c, data, services) {
   const ceilingDenied = enforceScopeCeiling(c, data.scopes);
   if (ceilingDenied)
     return ceilingDenied;
+  const instanceCeilingDenied = enforceInstanceCeiling(c, data.instanceIds ?? null);
+  if (instanceCeilingDenied)
+    return instanceCeilingDenied;
   const result = await services.apiKeys.create({
     name: data.name,
     description: data.description,
@@ -356889,6 +356931,7 @@ var init_keys = __esm(() => {
   init_dist2();
   init_zod();
   init_resolve_profile();
+  init_signed_host_scope_context();
   init_date_query();
   init_api_keys();
   keysRoutes = new Hono2;
@@ -356998,6 +357041,11 @@ var init_keys = __esm(() => {
       if (ceilingDenied)
         return ceilingDenied;
     }
+    if (data.instanceIds !== undefined) {
+      const instanceCeilingDenied = enforceInstanceCeiling(c, data.instanceIds);
+      if (instanceCeilingDenied)
+        return instanceCeilingDenied;
+    }
     try {
       const updated = await services.apiKeys.update(id, {
         ...data,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260717.4",
+  "version": "2.260717.6",
   "description": "LLM-optimized CLI for Omni",
   "type": "module",
   "bin": {