@xenon-device-management/xenon 1.1.28 → 1.3.0

package/README.md

@@ -421,6 +421,80 @@ npm run test:ios              # iOS integration
 
 ---
 
+## 🔐 Authentication
+
+Xenon REST endpoints under `/xenon/api/*` require an API key passed in the `X-Xenon-API-Key` header.
+
+### Bootstrap key
+
+On first start, Xenon writes a one-time bootstrap key (admin-scoped) to:
+
+```
+~/.cache/xenon/bootstrap-key.txt   (0600 permissions)
+```
+
+The startup log prints a WARN pointing at this path. **Rotate the bootstrap key within 24 hours.**
+
+### Creating a permanent key
+
+```bash
+# Create a scoped key for CI
+curl -X POST \
+  -H "X-Xenon-API-Key: $(cat ~/.cache/xenon/bootstrap-key.txt)" \
+  -H 'Content-Type: application/json' \
+  -d '{"name":"ci","scopes":["sessions","read"],"rateLimit":600}' \
+  http://localhost:4723/xenon/api/apikeys
+
+# Revoke the bootstrap key after saving the returned `key` value
+curl -X DELETE \
+  -H "X-Xenon-API-Key: $NEW_ADMIN_KEY" \
+  http://localhost:4723/xenon/api/apikeys/<bootstrap-id>
+```
+
+### Scopes
+
+| Scope | Access |
+|-------|--------|
+| `read` | GET sessions, devices, logs, apps |
+| `sessions` | Create/delete sessions and reservations |
+| `devices` | Block/unblock devices, install apps |
+| `admin` | API key management, webhooks, node registration |
+
+### Hub-node channel
+
+Set `--plugin-xenon-node-secret` (or `XENON_NODE_SECRET`) to the **same value** on both hub and node. When unset, the channel permits with a WARN (back-compat for single-node installs).
+
+For zero-downtime secret rotation, set `XENON_NODE_SECRET` to the new secret and `XENON_NODE_SECRET_PREVIOUS` to the old one. The hub accepts either during the overlap window — flip nodes one at a time, then drop `XENON_NODE_SECRET_PREVIOUS`.
+
+### Local development
+
+Pass `--plugin-xenon-auth-disabled` to skip auth entirely. A WARN is logged every 60 s as a reminder.
+
+---
+
+## 🌱 Environment Variables
+
+Xenon reads these env vars in addition to the CLI flags. Prefer env vars for credentials so keys don't end up in shell history or config files.
+
+| Variable | Purpose |
+|----------|---------|
+| `XENON_AI_PROVIDER` | AI backend: `gemini`, `openai`, `anthropic`, or `ollama`. Same as `--plugin-xenon-aiProvider`. |
+| `XENON_AI_MODEL` | Override the default model for the selected provider. |
+| `XENON_AI_BASE_URL` | Custom base URL (local Ollama, OpenAI-compatible gateway). |
+| `XENON_GEMINI_API_KEY` / `GEMINI_API_KEY` | Gemini credentials. `XENON_`-prefixed form wins if both set. |
+| `XENON_OPENAI_API_KEY` / `OPENAI_API_KEY` | OpenAI credentials. |
+| `XENON_ANTHROPIC_API_KEY` / `ANTHROPIC_API_KEY` | Anthropic credentials. |
+| `XENON_OPENAI_MODEL` | Alternate way to set the OpenAI model. |
+| `XENON_OTEL_DEBUG` | When `true`, OpenTelemetry adds a ConsoleSpanExporter so every span is logged. Dev/tracing only. |
+| `XENON_DB_PROVIDER` | `sqlite` or `postgresql`. Same as `--plugin-xenon-databaseProvider`. |
+| `DATABASE_URL` | Prisma database URL. Falls back to `file:~/.cache/xenon/xenon.db`. |
+| `XENON_NODE_SECRET` | Shared hub↔node secret (see above). |
+| `XENON_NODE_SECRET_PREVIOUS` | Secondary secret accepted during rotation overlap. |
+
+See [`docs/server-args.md`](docs/server-args.md) for the full CLI-flag reference and how these variables interact with config files.
+
+---
+
 ## 🤝 Contributing
 
 We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

package/lib/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@xenon-device-management/xenon",
-    "version": "1.1.28",
+    "version": "1.3.0",
     "description": "Xenon - Intelligent Mobile Infrastructure. A self-healing device orchestration platform for Appium.",
     "main": "./lib/src/index.js",
     "exports": {

package/lib/public/assets/{Layouts-D0WSzKOh.js → Layouts-D6IPfwoe.js}

@@ -1,4 +1,4 @@
-import{c,j as e,g as l}from"./index-S71J2rWg.js";/**
+import{c,j as e,g as l}from"./index-BaTiUCeH.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/lib/public/assets/{ai-settings-DQWDdNd7.js → ai-settings-CflyFKan.js}

@@ -1,4 +1,4 @@
-import{c as j,r as l,j as e,B as u,d as f,g as C,i as A,T as z}from"./index-S71J2rWg.js";import{X as x}from"./index-C1DBaoSh.js";import{A as P}from"./Layouts-D0WSzKOh.js";import{C as w}from"./cpu-DNC8n7kK.js";import{L as v}from"./lock-BstCxnX6.js";/**
+import{c as j,r as l,j as e,B as u,d as f,g as C,i as A,T as z}from"./index-BaTiUCeH.js";import{X as x}from"./index-C1DBaoSh.js";import{A as P}from"./Layouts-D6IPfwoe.js";import{C as w}from"./cpu-tuyMVZ4I.js";import{L as v}from"./lock-C6CoqSr2.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/lib/public/assets/{apps-1sLWHOGO.js → apps-Da4dvQ1J.js}

@@ -1,4 +1,4 @@
-import{c as g,u as X,r,j as e,S as z,g as q,X as V}from"./index-S71J2rWg.js";import{X as c}from"./index-C1DBaoSh.js";import{S as H,B as S,D as K}from"./badge-BiR1gmMm.js";import{A as D,B as T,U as Z,C as J,a as Q,T as ee}from"./button-BVazt4Z1.js";import{Z as se}from"./zap-ZrK5B58i.js";import{T as ae}from"./trash-2-CZWUMK5b.js";/**
+import{c as g,u as X,r,j as e,S as z,g as q,X as V}from"./index-BaTiUCeH.js";import{X as c}from"./index-C1DBaoSh.js";import{S as H,B as S,D as K}from"./badge-BNR9umdu.js";import{A as D,B as T,U as Z,C as J,a as Q,T as ee}from"./button-hZFV1ypT.js";import{Z as se}from"./zap-CssSMAN5.js";import{T as ae}from"./trash-2-NJMZJ2Ol.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/lib/public/assets/{badge-BiR1gmMm.js → badge-BNR9umdu.js}

@@ -1,4 +1,4 @@
-import{c as ye,j as Ve}from"./index-S71J2rWg.js";/**
+import{c as ye,j as Ve}from"./index-BaTiUCeH.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/lib/public/assets/{button-BVazt4Z1.js → button-hZFV1ypT.js}

@@ -1,4 +1,4 @@
-import{c as t,r as c,j as i}from"./index-S71J2rWg.js";import{c as r,a as u}from"./badge-BiR1gmMm.js";/**
+import{c as t,r as c,j as i}from"./index-BaTiUCeH.js";import{c as r,a as u}from"./badge-BNR9umdu.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/lib/public/assets/{calendar-yMyP2_Nc.js → calendar-fehdBtun.js}

@@ -1,4 +1,4 @@
-import{c as e}from"./index-S71J2rWg.js";/**
+import{c as e}from"./index-BaTiUCeH.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/lib/public/assets/{clock-CsVplnJ2.js → clock-DrpxSvCL.js}

@@ -1,4 +1,4 @@
-import{c}from"./index-S71J2rWg.js";/**
+import{c}from"./index-BaTiUCeH.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/lib/public/assets/{cpu-DNC8n7kK.js → cpu-tuyMVZ4I.js}

@@ -1,4 +1,4 @@
-import{c as h}from"./index-S71J2rWg.js";/**
+import{c as h}from"./index-BaTiUCeH.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/lib/public/assets/{device-explorer-DFu8Gxj4.js → device-explorer-DOfRH3zm.js}

@@ -1,4 +1,4 @@
-import{c as E,r,a as At,j as e,X as tt,C as Lt,u as ft,b as nt,R as qe,S as st,d as it,e as yt,T as Tt,f as jt,L as He,g as rt}from"./index-S71J2rWg.js";import{p as lt,H as zt,C as bt,a as Ke,u as Et}from"./useSocket-CliVeWS3.js";import{X as D}from"./index-C1DBaoSh.js";import{C as Nt}from"./clock-CsVplnJ2.js";import{P as wt}from"./plus-DfjM7G6e.js";import{A as kt,T as at,C as Je,a as Ze,U as It,B as Qe}from"./button-BVazt4Z1.js";import{C as Rt}from"./cpu-DNC8n7kK.js";import{M as Mt}from"./mouse-pointer-2-CSn_Wnc9.js";import{S as Xe,D as _t,B as Pe}from"./badge-BiR1gmMm.js";import{Z as Ut}from"./zap-ZrK5B58i.js";import{L as Ft}from"./lock-BstCxnX6.js";import{T as Be}from"./trash-2-CZWUMK5b.js";/**
+import{c as E,r,a as At,j as e,X as tt,C as Lt,u as ft,b as nt,R as qe,S as st,d as it,e as yt,T as Tt,f as jt,L as He,g as rt}from"./index-BaTiUCeH.js";import{p as lt,H as zt,C as bt,a as Ke,u as Et}from"./useSocket-Ct2wo7P2.js";import{X as D}from"./index-C1DBaoSh.js";import{C as Nt}from"./clock-DrpxSvCL.js";import{P as wt}from"./plus-B4B1Hukt.js";import{A as kt,T as at,C as Je,a as Ze,U as It,B as Qe}from"./button-hZFV1ypT.js";import{C as Rt}from"./cpu-tuyMVZ4I.js";import{M as Mt}from"./mouse-pointer-2-CXdnjXIg.js";import{S as Xe,D as _t,B as Pe}from"./badge-BNR9umdu.js";import{Z as Ut}from"./zap-CssSMAN5.js";import{L as Ft}from"./lock-C6CoqSr2.js";import{T as Be}from"./trash-2-NJMZJ2Ol.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.