@automagik/omni 2.260914.11 → 2.260914.13

package/db/drizzle/0070_config_audit_logs.sql

@@ -0,0 +1,41 @@
+-- Config-mutation audit log (issue #1152).
+--
+-- api_key_audit_logs records method/path/status only and is dominated by
+-- polling GETs. tenant_audit_logs needs a tenant FK + credential uuid, so it
+-- does not fit single-tenant legacy keys. This table holds one row per
+-- POST/PATCH/PUT/DELETE on config resources (instances, agents, providers,
+-- routes, automations, keys, settings) with actor, request id, client IP,
+-- user agent, target, and before/after of changed fields. Secret-bearing
+-- values are stored only as sha256 prefix fingerprints.
+--
+-- Retention: reads are never written here; keep ~180d.
+--
+-- Hand-written following the 0043/0044/0052 precedent (additive, idempotent).
+-- No explicit BEGIN/COMMIT — the boot migrator executes this file on a pooled
+-- postgres-js connection, which rejects raw transaction control.
+
+CREATE TABLE IF NOT EXISTS "config_audit_logs" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "api_key_id" varchar(100),
+  "api_key_name" varchar(255),
+  "actor" varchar(255),
+  "request_id" varchar(100),
+  "ip_address" varchar(64),
+  "user_agent" text,
+  "method" varchar(10) NOT NULL,
+  "path" varchar(500) NOT NULL,
+  "status_code" integer NOT NULL,
+  "action" varchar(100) NOT NULL,
+  "target_type" varchar(50) NOT NULL,
+  "target_id" varchar(255),
+  "changed_fields" text[] DEFAULT '{}'::text[] NOT NULL,
+  "changes" jsonb DEFAULT '{}'::jsonb NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS "config_audit_logs_target_idx"
+  ON "config_audit_logs" ("target_type", "target_id");
+CREATE INDEX IF NOT EXISTS "config_audit_logs_actor_idx"
+  ON "config_audit_logs" ("actor");
+CREATE INDEX IF NOT EXISTS "config_audit_logs_created_at_idx"
+  ON "config_audit_logs" ("created_at");

package/db/drizzle/meta/_journal.json

@@ -491,6 +491,13 @@
       "when": 1786900000000,
       "tag": "0069_automation_allow_instance_senders",
       "breakpoints": true
+    },
+    {
+      "idx": 70,
+      "version": "7",
+      "when": 1787000000000,
+      "tag": "0070_config_audit_logs",
+      "breakpoints": true
     }
   ]
 }

package/dist/client.d.ts

@@ -24,4 +24,12 @@ export declare function getClient(): OmniClient;
  * Returns null if not authenticated.
  */
 export declare function getOptionalClient(): OmniClient | null;
+/**
+ * Tag every request to the configured Omni server with `X-Omni-Actor` from
+ * `OMNI_ACTOR` (e.g. `claude-session:<id>`, `cli:alice`) so the config audit
+ * log (#1152) can tell agents and humans apart. Wraps global fetch because many
+ * commands call the API directly instead of through the SDK; requests to any
+ * other host are left untouched.
+ */
+export declare function installActorHeader(): void;
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,WAAW,CAAC;AAW9D;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI,KAAK,CAQ5C;AAED;;;GAGG;AACH,wBAAgB,SAAS,IAAI,UAAU,CAyBtC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,GAAG,IAAI,CAyBrD"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,WAAW,CAAC;AAW9D;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI,KAAK,CAQ5C;AAED;;;GAGG;AACH,wBAAgB,SAAS,IAAI,UAAU,CAyBtC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,GAAG,IAAI,CAyBrD;AA2BD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAazC"}

package/dist/commands/audit.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Audit Commands (issue #1152)
+ *
+ * omni audit list [--target <id>] [--type <type>] [--actor <x>] [--since <iso>] [--limit <n>]
+ * omni audit show <id>
+ *
+ * Reads the config-mutation audit log. Set OMNI_ACTOR to tag your own calls.
+ */
+import { Command } from 'commander';
+export declare function createAuditCommand(): Command;
+//# sourceMappingURL=audit.d.ts.map

package/dist/commands/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/commands/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BpC,wBAAgB,kBAAkB,IAAI,OAAO,CAyC5C"}

package/dist/index.js

@@ -81874,6 +81874,7 @@ __export(exports_schema, {
   connectorWindowSemanticsValues: () => connectorWindowSemanticsValues,
   connectorMutationPolicies: () => connectorMutationPolicies,
   connectorLivenessStatuses: () => connectorLivenessStatuses,
+  configAuditLogs: () => configAuditLogs,
   conditionOperators: () => conditionOperators,
   closeContactOutcomes: () => closeContactOutcomes,
   closeContactLogs: () => closeContactLogs,
@@ -81922,7 +81923,7 @@ __export(exports_schema, {
   accessRules: () => accessRules,
   accessModes: () => accessModes
 });
-var channelTypes, agentTypes, agentSystems, agentEntityTypes, debounceMode, splitDelayMode, supersedeMode, replyFilterMode, agentSessionStrategies, ruleTypes, accessModes, settingValueTypes, apiKeyStatuses, apiKeyProfiles, eventTypes, contentTypes, chatTypes, messageSources, messageTypes, messageStatuses, deliveryStatuses, scheduledMessageDeliveryModes, scheduledMessageStatuses, jobStatuses, providerSchemas, agentProviders, agents, agentRoutes, agentSessions, apiKeys, apiKeyAuditLogs, apiKeysRelations, apiKeyAuditLogsRelations, instances, whatsappTemplates, whatsappFlowKeys, scheduledMessages, persons, platformIdentities, conversations, chats, chatParticipants, omniGroups, messages2, omniEvents, handoffLogs, closeContactOutcomes, closeContactLogs, accessRules, globalSettings, settingChangeHistory, batchJobs, syncJobTypes, syncJobs, mediaContent, chatIdMappings, pluginStorage, agentProvidersRelations, agentsRelations, instancesRelations, syncJobsRelations, personsRelations, platformIdentitiesRelations, conversationsRelations, chatsRelations, chatParticipantsRelations, messagesRelations, omniEventsRelations, accessRulesRelations, globalSettingsRelations, settingChangeHistoryRelations, batchJobsRelations, mediaContentRelations, chatIdMappingsRelations, deadLetterStatuses, deadLetterEvents, payloadStorageConfig, payloadStages, eventPayloads, webhookSignatureAlgorithms, connectorLivenessStatuses, connectorWindowSemanticsValues, connectorMutationPolicies, webhookSources, eventSchemas, conditionOperators, actionTypes, automationDebounceModes, automations2, automationLogStatuses, automationLogs, consumerOffsets, durableConsumers, automationsRelations, automationLogsRelations, triggerLogs, triggerLogsRelations, agentRoutesRelations, agentTaskStatuses, agentTasks, agentTasksRelations, turnStatuses, turnActions, turns, turnsRelations, followUpDisarmReasons, chatFollowUpState, chatFollowUpStateRelations, processedEvents, genieHosts, tenantStatuses, principalTypes, principalStatuses, tenantRoles, membershipStatuses, credentialClasses, authCredentialStatuses, platformApiKeyStatuses, tenants, principals, tenantMemberships, tenantRolePolicies, platformApiKeys, tenantKeyLineage, authCredentials, tenantAuditLogs, platformAuditLogs, platformProviderCatalog, tenantProviderConfig, platformSettings, tenantSettings, platformSettingChangeHistory, tenantSettingChangeHistory, platformPluginStorage, tenantPluginStorage, platformPayloadStorageConfig, tenantPayloadStorageOverrides, tenantMigrationLedger, tenantMigrationLedgerHistory;
+var channelTypes, agentTypes, agentSystems, agentEntityTypes, debounceMode, splitDelayMode, supersedeMode, replyFilterMode, agentSessionStrategies, ruleTypes, accessModes, settingValueTypes, apiKeyStatuses, apiKeyProfiles, eventTypes, contentTypes, chatTypes, messageSources, messageTypes, messageStatuses, deliveryStatuses, scheduledMessageDeliveryModes, scheduledMessageStatuses, jobStatuses, providerSchemas, agentProviders, agents, agentRoutes, agentSessions, apiKeys, apiKeyAuditLogs, apiKeysRelations, apiKeyAuditLogsRelations, instances, whatsappTemplates, whatsappFlowKeys, scheduledMessages, persons, platformIdentities, conversations, chats, chatParticipants, omniGroups, messages2, omniEvents, handoffLogs, closeContactOutcomes, closeContactLogs, accessRules, globalSettings, settingChangeHistory, batchJobs, syncJobTypes, syncJobs, mediaContent, chatIdMappings, pluginStorage, agentProvidersRelations, agentsRelations, instancesRelations, syncJobsRelations, personsRelations, platformIdentitiesRelations, conversationsRelations, chatsRelations, chatParticipantsRelations, messagesRelations, omniEventsRelations, accessRulesRelations, globalSettingsRelations, settingChangeHistoryRelations, batchJobsRelations, mediaContentRelations, chatIdMappingsRelations, deadLetterStatuses, deadLetterEvents, payloadStorageConfig, payloadStages, eventPayloads, webhookSignatureAlgorithms, connectorLivenessStatuses, connectorWindowSemanticsValues, connectorMutationPolicies, webhookSources, eventSchemas, conditionOperators, actionTypes, automationDebounceModes, automations2, automationLogStatuses, automationLogs, consumerOffsets, durableConsumers, automationsRelations, automationLogsRelations, triggerLogs, triggerLogsRelations, agentRoutesRelations, agentTaskStatuses, agentTasks, agentTasksRelations, turnStatuses, turnActions, turns, turnsRelations, followUpDisarmReasons, chatFollowUpState, chatFollowUpStateRelations, processedEvents, genieHosts, tenantStatuses, principalTypes, principalStatuses, tenantRoles, membershipStatuses, credentialClasses, authCredentialStatuses, platformApiKeyStatuses, tenants, principals, tenantMemberships, tenantRolePolicies, platformApiKeys, tenantKeyLineage, authCredentials, tenantAuditLogs, platformAuditLogs, platformProviderCatalog, tenantProviderConfig, platformSettings, tenantSettings, platformSettingChangeHistory, tenantSettingChangeHistory, platformPluginStorage, tenantPluginStorage, platformPayloadStorageConfig, tenantPayloadStorageOverrides, tenantMigrationLedger, tenantMigrationLedgerHistory, configAuditLogs;
 var init_schema2 = __esm(() => {
   init_events();
   init_types4();
@@ -83995,6 +83996,28 @@ var init_schema2 = __esm(() => {
     revisionUq: uniqueIndex("tenant_migration_ledger_history_revision_uq").on(table3.ledgerId, table3.revision),
     ledgerIdx: index("tenant_migration_ledger_history_ledger_idx").on(table3.ledgerId)
   }));
+  configAuditLogs = pgTable("config_audit_logs", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    apiKeyId: varchar("api_key_id", { length: 100 }),
+    apiKeyName: varchar("api_key_name", { length: 255 }),
+    actor: varchar("actor", { length: 255 }),
+    requestId: varchar("request_id", { length: 100 }),
+    ipAddress: varchar("ip_address", { length: 64 }),
+    userAgent: text("user_agent"),
+    method: varchar("method", { length: 10 }).notNull(),
+    path: varchar("path", { length: 500 }).notNull(),
+    statusCode: integer("status_code").notNull(),
+    action: varchar("action", { length: 100 }).notNull(),
+    targetType: varchar("target_type", { length: 50 }).notNull(),
+    targetId: varchar("target_id", { length: 255 }),
+    changedFields: text("changed_fields").array().notNull().default(sql`'{}'::text[]`),
+    changes: jsonb("changes").$type().notNull().default({}),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  }, (table3) => ({
+    targetIdx: index("config_audit_logs_target_idx").on(table3.targetType, table3.targetId),
+    actorIdx: index("config_audit_logs_actor_idx").on(table3.actor),
+    createdAtIdx: index("config_audit_logs_created_at_idx").on(table3.createdAt)
+  }));
 });
 
 // ../../node_modules/.bun/drizzle-orm@0.45.2+803b5ba9c660628f/node_modules/drizzle-orm/cache/core/index.js
@@ -137266,7 +137289,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260914.11",
+  version: "2.260914.13",
   repository: {
     type: "git",
     url: "git+https://github.com/automagik-dev/omni.git",
@@ -137508,6 +137531,22 @@ function signRequestIfHandshook(baseUrl) {
   const bound = ctx;
   return (method, path, body) => bound.signRequest(method, path, body);
 }
+function installActorHeader() {
+  const actor = process.env.OMNI_ACTOR?.trim();
+  if (!actor)
+    return;
+  const original = globalThis.fetch;
+  const wrapped = (input, init) => {
+    const url = input instanceof Request ? input.url : String(input);
+    const base = (loadConfig().apiUrl ?? DEFAULT_API_URL2).replace(/\/$/, "");
+    if (!url.startsWith(base))
+      return original(input, init);
+    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+    headers.set("x-omni-actor", actor);
+    return original(input, { ...init, headers });
+  };
+  globalThis.fetch = Object.assign(wrapped, original);
+}
 
 // src/commands/a2a.ts
 init_output();
@@ -138615,6 +138654,50 @@ function createAgentsCommand() {
   return agents;
 }
 
+// src/commands/audit.ts
+init_config();
+init_output();
+async function auditFetch(path) {
+  if (!hasAuth())
+    exitNotAuthenticated();
+  const config2 = loadConfig();
+  const res = await fetch(`${config2.apiUrl ?? "http://localhost:8882"}/api/v2/audit${path}`, {
+    headers: { "x-api-key": config2.apiKey ?? "" }
+  });
+  if (!res.ok)
+    error(`Audit request failed: HTTP ${res.status} ${await res.text().catch(() => "")}`);
+  return await res.json();
+}
+function createAuditCommand() {
+  const audit = new Command("audit").description("Config-mutation audit log (who changed what)");
+  audit.command("list").description("List config changes, newest first").option("--target <id>", "Filter by target id (instance, agent, provider, ...)").option("--type <type>", "Filter by target type (instance|agent|provider|route|automation|api_key|setting)").option("--actor <actor>", "Filter by X-Omni-Actor or API key name").option("--since <iso>", "Only changes at or after this timestamp").option("--limit <n>", "Max results", "50").action(async (opts) => {
+    const params = new URLSearchParams({ limit: opts.limit });
+    if (opts.target)
+      params.set("target", opts.target);
+    if (opts.type)
+      params.set("targetType", opts.type);
+    if (opts.actor)
+      params.set("actor", opts.actor);
+    if (opts.since)
+      params.set("since", opts.since);
+    const { items } = await auditFetch(`?${params}`);
+    list(items.map((e10) => ({
+      id: e10.id,
+      time: e10.createdAt,
+      actor: e10.actor ?? e10.apiKeyName ?? "-",
+      action: e10.action,
+      target: e10.targetId ?? "-",
+      status: e10.statusCode,
+      changed: e10.changedFields.join(", ") || "-"
+    })), { emptyMessage: "No audit entries.", rawData: items });
+  });
+  audit.command("show <id>").description("Show one audit entry with before/after (secrets as fingerprints)").action(async (id) => {
+    const { data: data2 } = await auditFetch(`/${encodeURIComponent(id)}`);
+    data(data2);
+  });
+  return audit;
+}
+
 // src/commands/auth.ts
 init_config();
 
@@ -153996,6 +154079,12 @@ var COMMANDS = [
     helpGroup: "Management",
     helpDescription: "Agent routing configuration"
   },
+  {
+    create: createAuditCommand,
+    category: "core",
+    helpGroup: "Management",
+    helpDescription: "Config-mutation audit log"
+  },
   {
     create: createKeysCommand,
     category: "core",
@@ -154303,6 +154392,7 @@ program2.configureOutput({
   }
 });
 selfHealManifestPin();
+installActorHeader();
 var argv = process.argv.slice(2);
 var isRootVersionOnly = argv.length > 0 && argv.every((arg) => arg === "--version" || arg === "-V");
 if (isRootVersionOnly) {