omnikey-cli 1.0.16 → 1.0.18

package/dist/daemon.js

@@ -4,18 +4,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startDaemon = startDaemon;
-const child_process_1 = require("child_process");
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
-const child_process_2 = require("child_process");
+const child_process_1 = require("child_process");
+const inquirer_1 = __importDefault(require("inquirer"));
 const utils_1 = require("./utils");
 /**
  * Start the Omnikey API backend as a daemon on the specified port.
  * On macOS: creates and registers a launchd agent for persistence.
- * On Windows: creates a wrapper script and registers a Windows Task Scheduler task.
+ * On Windows: installs an NSSM Windows service for boot-time persistence.
  * @param port The port to run the backend on
  */
-function startDaemon(port = 7071) {
+async function startDaemon(port = 7071) {
     const backendPath = path_1.default.resolve(__dirname, '../backend-dist/index.js');
     const configDir = (0, utils_1.getConfigDir)();
     const configPath = (0, utils_1.getConfigPath)();
@@ -33,7 +33,7 @@ function startDaemon(port = 7071) {
     const logPath = path_1.default.join(configDir, 'daemon.log');
     const errorLogPath = path_1.default.join(configDir, 'daemon-error.log');
     if (utils_1.isWindows) {
-        startDaemonWindows({
+        await startDaemonWindows({
             port,
             configDir,
             configVars,
@@ -47,53 +47,108 @@ function startDaemon(port = 7071) {
         startDaemonMacOS({ port, configDir, configVars, nodePath, backendPath, logPath, errorLogPath });
     }
 }
-function startDaemonWindows(opts) {
-    const { port, configDir, configVars, nodePath, backendPath, logPath, errorLogPath } = opts;
-    // Write a wrapper .cmd script that sets env vars and launches the backend
-    const wrapperPath = path_1.default.join(configDir, 'start-daemon.cmd');
-    const envSetLines = Object.entries({ ...configVars, OMNIKEY_PORT: String(port) })
-        .map(([k, v]) => `set "${k}=${v}"`)
-        .join('\r\n');
-    const wrapperContent = [
-        '@echo off',
-        envSetLines,
-        `"${nodePath}" "${backendPath}" >> "${logPath}" 2>> "${errorLogPath}"`,
-        '',
-    ].join('\r\n');
+function resolveNssm() {
     try {
-        fs_1.default.mkdirSync(configDir, { recursive: true });
-        fs_1.default.writeFileSync(wrapperPath, wrapperContent, 'utf-8');
+        return (0, child_process_1.execSync)('where nssm', { stdio: 'pipe' }).toString().trim().split('\n')[0].trim();
     }
-    catch (e) {
-        console.error('Failed to write start-daemon.cmd:', e);
-        return;
+    catch {
+        return null;
     }
-    // Register with Windows Task Scheduler so the daemon persists across reboots
-    const taskName = 'OmnikeyDaemon';
+}
+async function startDaemonWindows(opts) {
+    const { port, configDir, configVars, nodePath, backendPath, logPath, errorLogPath } = opts;
+    const serviceName = 'OmnikeyDaemon';
+    let nssmPath = resolveNssm();
+    if (!nssmPath) {
+        const { install } = await inquirer_1.default.prompt([
+            {
+                type: 'confirm',
+                name: 'install',
+                message: 'NSSM is required but not found. Install it now via winget?',
+                default: true,
+            },
+        ]);
+        if (!install) {
+            console.log('Aborted. Install NSSM manually and re-run in an elevated (Administrator) terminal.');
+            return;
+        }
+        console.log('Installing NSSM via winget...');
+        try {
+            (0, child_process_1.execSync)('winget install nssm --accept-package-agreements --accept-source-agreements', {
+                stdio: 'inherit',
+            });
+        }
+        catch (e) {
+            console.error('winget install failed:', e?.message ?? e);
+            console.log('Try manually: scoop install nssm  or  choco install nssm');
+            return;
+        }
+        // winget updates the machine PATH in the registry but the current process
+        // won't see it — spawn a fresh cmd to resolve the new location.
+        try {
+            nssmPath = (0, child_process_1.execSync)('cmd /c where nssm', { stdio: 'pipe' })
+                .toString().trim().split('\n')[0].trim();
+        }
+        catch {
+            nssmPath = null;
+        }
+        if (!nssmPath) {
+            console.log('NSSM installed successfully.');
+            console.log('Please open a new elevated (Administrator) terminal and re-run this command.');
+            return;
+        }
+    }
+    (0, utils_1.initLogFiles)(logPath, errorLogPath);
+    // Remove any existing service (stop first, then remove)
     try {
-        // Delete existing task silently before creating a fresh one
-        (0, child_process_2.execSync)(`schtasks /delete /tn "${taskName}" /f`, { stdio: 'pipe' });
+        (0, child_process_1.execFileSync)(nssmPath, ['stop', serviceName], { stdio: 'pipe' });
     }
-    catch {
-        // Task may not exist — that's fine
+    catch { /* not running */ }
+    try {
+        (0, child_process_1.execFileSync)(nssmPath, ['remove', serviceName, 'confirm'], { stdio: 'pipe' });
     }
+    catch { /* didn't exist */ }
+    // NSSM services run as LocalSystem; pass USERPROFILE so the backend's
+    // getHomeDir() resolves to the correct user config directory.
+    const env = {
+        ...configVars,
+        OMNIKEY_PORT: String(port),
+        USERPROFILE: process.env.USERPROFILE || configDir.replace(/[/\\]\.omnikey$/, ''),
+        HOME: process.env.USERPROFILE || configDir.replace(/[/\\]\.omnikey$/, ''),
+    };
     try {
-        (0, child_process_2.execSync)(`schtasks /create /tn "${taskName}" /tr "cmd /c \\"${wrapperPath}\\"" /sc ONLOGON /f`, { stdio: 'pipe' });
-        console.log(`Windows Task Scheduler task created: ${taskName}`);
-        console.log('Omnikey daemon will auto-start on next logon.');
+        // Install: nssm install <name> <application> [args...]
+        (0, child_process_1.execFileSync)(nssmPath, ['install', serviceName, nodePath, backendPath], { stdio: 'pipe' });
+        (0, child_process_1.execFileSync)(nssmPath, ['set', serviceName, 'AppDirectory', configDir], { stdio: 'pipe' });
+        // Pass all env vars in a single call (replaces the entire AppEnvironmentExtra key)
+        const envEntries = Object.entries(env).map(([k, v]) => `${k}=${v}`);
+        (0, child_process_1.execFileSync)(nssmPath, ['set', serviceName, 'AppEnvironmentExtra', ...envEntries], { stdio: 'pipe' });
+        (0, child_process_1.execFileSync)(nssmPath, ['set', serviceName, 'AppStdout', logPath], { stdio: 'pipe' });
+        (0, child_process_1.execFileSync)(nssmPath, ['set', serviceName, 'AppStderr', errorLogPath], { stdio: 'pipe' });
+        (0, child_process_1.execFileSync)(nssmPath, ['set', serviceName, 'AppRotateFiles', '1'], { stdio: 'pipe' });
+        // Restart automatically after a 3-second delay on any exit
+        (0, child_process_1.execFileSync)(nssmPath, ['set', serviceName, 'AppExit', 'Default', 'Restart'], { stdio: 'pipe' });
+        (0, child_process_1.execFileSync)(nssmPath, ['set', serviceName, 'AppRestartDelay', '3000'], { stdio: 'pipe' });
+        // Start automatically at boot (no login required)
+        (0, child_process_1.execFileSync)(nssmPath, ['set', serviceName, 'Start', 'SERVICE_AUTO_START'], { stdio: 'pipe' });
+        (0, child_process_1.execFileSync)(nssmPath, ['set', serviceName, 'DisplayName', 'Omnikey API Backend'], { stdio: 'pipe' });
+        (0, child_process_1.execFileSync)(nssmPath, ['set', serviceName, 'Description', 'Omnikey API Backend Daemon'], { stdio: 'pipe' });
+        (0, child_process_1.execFileSync)(nssmPath, ['start', serviceName], { stdio: 'pipe' });
+        console.log(`NSSM service installed and started: ${serviceName}`);
+        console.log('Omnikey daemon runs on boot, without login, and auto-restarts on crash.');
+        console.log(`Logs: ${logPath}`);
+        console.log(`      ${errorLogPath}`);
     }
     catch (e) {
-        console.error('Failed to create Windows Task Scheduler task:', e);
+        const msg = e?.stderr?.toString() || e?.message || String(e);
+        if (msg.toLowerCase().includes('access') || msg.toLowerCase().includes('privilege')) {
+            console.error('Failed to install NSSM service: administrator privileges are required.');
+            console.error('Re-run this command in an elevated (Administrator) terminal.');
+        }
+        else {
+            console.error('Failed to install NSSM service:', msg);
+        }
     }
-    // Also start the backend immediately for the current session
-    const { out, err } = (0, utils_1.initLogFiles)(logPath, errorLogPath);
-    const child = (0, child_process_1.spawn)(nodePath, [backendPath], {
-        env: { ...configVars, OMNIKEY_PORT: String(port) },
-        detached: true,
-        stdio: ['ignore', out, err],
-    });
-    child.unref();
-    console.log(`Omnikey API backend started as a daemon on port ${port}. PID: ${child.pid}`);
 }
 function startDaemonMacOS(opts) {
     const { port, configDir, configVars, nodePath, backendPath, logPath, errorLogPath } = opts;
@@ -136,8 +191,8 @@ function startDaemonMacOS(opts) {
         fs_1.default.mkdirSync(launchAgentsDir, { recursive: true });
         fs_1.default.writeFileSync(plistPath, plistContent, 'utf-8');
         (0, utils_1.initLogFiles)(logPath, errorLogPath);
-        (0, child_process_2.execSync)(`launchctl unload "${plistPath}" || true`);
-        (0, child_process_2.execSync)(`launchctl load "${plistPath}"`);
+        (0, child_process_1.execSync)(`launchctl unload "${plistPath}" || true`);
+        (0, child_process_1.execSync)(`launchctl load "${plistPath}"`);
         console.log(`Launch agent created and loaded: ${plistPath}`);
         console.log('Omnikey daemon will auto-restart and persist across reboots.');
         // launchd starts the process via RunAtLoad — no manual spawn needed here.

package/dist/index.js

@@ -8,6 +8,8 @@ const killDaemon_1 = require("./killDaemon");
 const removeConfig_1 = require("./removeConfig");
 const status_1 = require("./status");
 const showLogs_1 = require("./showLogs");
+const showConfig_1 = require("./showConfig");
+const setConfig_1 = require("./setConfig");
 const program = new commander_1.Command();
 program
     .name('omnikey')
@@ -23,9 +25,9 @@ program
     .command('daemon')
     .description('Start the Omnikey API backend as a daemon on a specified port')
     .option('--port <port>', 'Port to run the backend on', '7071')
-    .action((options) => {
+    .action(async (options) => {
     const port = Number(options.port) || 7071;
-    (0, daemon_1.startDaemon)(port);
+    await (0, daemon_1.startDaemon)(port);
 });
 program
     .command('kill-daemon')
@@ -56,4 +58,25 @@ program
     const errorsOnly = !!options.errors;
     (0, showLogs_1.showLogs)(lines, errorsOnly);
 });
+program
+    .command('config')
+    .description('Show the current Omnikey configuration (API keys are masked)')
+    .action(() => {
+    (0, showConfig_1.showConfig)();
+});
+program
+    .command('set <key> <value>')
+    .description('Set a single configuration key (e.g. omnikey set OMNIKEY_PORT 8080)')
+    .action((key, value) => {
+    (0, setConfig_1.setConfig)(key, value);
+});
+program
+    .command('restart-daemon')
+    .description('Restart the Omnikey API backend daemon')
+    .option('--port <port>', 'Port to run the backend on', '7071')
+    .action(async (options) => {
+    (0, killDaemon_1.killDaemon)();
+    const port = Number(options.port) || 7071;
+    await (0, daemon_1.startDaemon)(port);
+});
 program.parseAsync(process.argv);

package/dist/removeConfig.js

@@ -29,29 +29,47 @@ function killLaunchdAgent() {
     }
 }
 function killWindowsTask() {
-    const taskName = 'OmnikeyDaemon';
+    const serviceName = 'OmnikeyDaemon';
+    // Try NSSM first (current implementation)
+    let nssmPath = null;
     try {
-        (0, child_process_1.execSync)(`schtasks /end /tn "${taskName}"`, { stdio: 'pipe' });
+        nssmPath = (0, child_process_1.execSync)('where nssm', { stdio: 'pipe' }).toString().trim().split('\n')[0].trim();
     }
-    catch {
-        // Task may not be running — that's fine
-    }
-    try {
-        (0, child_process_1.execSync)(`schtasks /delete /tn "${taskName}" /f`, { stdio: 'pipe' });
-        console.log(`Removed Windows Task Scheduler task: ${taskName}`);
+    catch { /* NSSM not installed */ }
+    if (nssmPath) {
+        try {
+            (0, child_process_1.execFileSync)(nssmPath, ['stop', serviceName], { stdio: 'pipe' });
+        }
+        catch { /* not running */ }
+        try {
+            (0, child_process_1.execFileSync)(nssmPath, ['remove', serviceName, 'confirm'], { stdio: 'pipe' });
+            console.log(`Removed NSSM service: ${serviceName}`);
+        }
+        catch {
+            console.log(`NSSM service does not exist: ${serviceName}`);
+        }
     }
-    catch {
-        console.log(`Windows Task Scheduler task does not exist: ${taskName}`);
+    else {
+        // Fallback: remove legacy Task Scheduler task from previous installs
+        try {
+            (0, child_process_1.execSync)(`schtasks /end /tn "${serviceName}"`, { stdio: 'pipe' });
+        }
+        catch { /* not running */ }
+        try {
+            (0, child_process_1.execSync)(`schtasks /delete /tn "${serviceName}" /f`, { stdio: 'pipe' });
+            console.log(`Removed Windows Task Scheduler task: ${serviceName}`);
+        }
+        catch {
+            console.log(`Windows Task Scheduler task does not exist: ${serviceName}`);
+        }
     }
-    // Also remove the wrapper script
+    // Remove legacy wrapper script if present
     const wrapperPath = path_1.default.join((0, utils_1.getConfigDir)(), 'start-daemon.cmd');
     if (fs_1.default.existsSync(wrapperPath)) {
         try {
             fs_1.default.rmSync(wrapperPath);
         }
-        catch {
-            // Ignore
-        }
+        catch { /* ignore */ }
     }
 }
 /**
@@ -117,14 +135,22 @@ function removeConfigAndDb(includeDb = false) {
     else {
         console.log('Skipping SQLite database removal (use --db to remove it).');
     }
-    // Remove .omnikey directory
+    // Remove all files/folders inside .omnikey except the SQLite database
     if (fs_1.default.existsSync(configDir)) {
         try {
-            fs_1.default.rmSync(configDir, { recursive: true, force: true });
-            console.log(`Removed config directory: ${configDir}`);
+            const entries = fs_1.default.readdirSync(configDir);
+            for (const entry of entries) {
+                if (entry.endsWith('.sqlite')) {
+                    continue;
+                }
+                const entryPath = path_1.default.join(configDir, entry);
+                fs_1.default.rmSync(entryPath, { recursive: true, force: true });
+                console.log(`Removed: ${entryPath}`);
+            }
+            console.log(`Cleared config directory (SQLite preserved): ${configDir}`);
         }
         catch (e) {
-            console.error(`Failed to remove config directory: ${e}`);
+            console.error(`Failed to clear config directory: ${e}`);
         }
     }
     else {

package/dist/setConfig.js

@@ -0,0 +1,19 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setConfig = setConfig;
+const fs_1 = __importDefault(require("fs"));
+const utils_1 = require("./utils");
+function setConfig(key, value) {
+    const configDir = (0, utils_1.getConfigDir)();
+    const configPath = (0, utils_1.getConfigPath)();
+    if (!fs_1.default.existsSync(configDir)) {
+        fs_1.default.mkdirSync(configDir, { recursive: true });
+    }
+    const config = (0, utils_1.readConfig)();
+    config[key] = value;
+    fs_1.default.writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf-8');
+    console.log(`Set ${key} in ${configPath}`);
+}

package/dist/showConfig.js

@@ -0,0 +1,45 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.showConfig = showConfig;
+const fs_1 = __importDefault(require("fs"));
+const utils_1 = require("./utils");
+const API_KEY_FIELDS = [
+    'OPENAI_API_KEY',
+    'ANTHROPIC_API_KEY',
+    'GEMINI_API_KEY',
+    'SERPER_API_KEY',
+    'BRAVE_SEARCH_API_KEY',
+    'TAVILY_API_KEY',
+];
+function maskSecret(value) {
+    if (value.length <= 8)
+        return '****';
+    return value.slice(0, 4) + '****' + value.slice(-4);
+}
+function showConfig() {
+    const configPath = (0, utils_1.getConfigPath)();
+    const configDir = (0, utils_1.getConfigDir)();
+    if (!fs_1.default.existsSync(configPath)) {
+        console.log('No configuration found. Run `omnikey onboard` to get started.');
+        return;
+    }
+    const config = (0, utils_1.readConfig)();
+    const keys = Object.keys(config);
+    if (keys.length === 0) {
+        console.log('Configuration file exists but is empty.');
+        return;
+    }
+    console.log(`Config file: ${configPath}\n`);
+    console.log('Current configuration:');
+    console.log('─'.repeat(50));
+    for (const key of keys) {
+        const raw = String(config[key]);
+        const display = API_KEY_FIELDS.includes(key) ? maskSecret(raw) : raw;
+        console.log(`  ${key}: ${display}`);
+    }
+    console.log('─'.repeat(50));
+    console.log(`\nConfig directory: ${configDir}`);
+}

package/package.json

@@ -4,7 +4,7 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "version": "1.0.16",
+  "version": "1.0.18",
   "description": "CLI for onboarding users to Omnikey AI and configuring OPENAI_API_KEY. Use Yarn for install/build.",
   "engines": {
     "node": ">=14.0.0",

package/src/daemon.ts

@@ -1,7 +1,7 @@
-import { spawn } from 'child_process';
 import path from 'path';
 import fs from 'fs';
-import { execSync } from 'child_process';
+import { execSync, execFileSync } from 'child_process';
+import inquirer from 'inquirer';
 import {
   isWindows,
   getHomeDir,
@@ -14,10 +14,10 @@ import {
 /**
  * Start the Omnikey API backend as a daemon on the specified port.
  * On macOS: creates and registers a launchd agent for persistence.
- * On Windows: creates a wrapper script and registers a Windows Task Scheduler task.
+ * On Windows: installs an NSSM Windows service for boot-time persistence.
  * @param port The port to run the backend on
  */
-export function startDaemon(port: number = 7071) {
+export async function startDaemon(port: number = 7071) {
   const backendPath = path.resolve(__dirname, '../backend-dist/index.js');
 
   const configDir = getConfigDir();
@@ -38,7 +38,7 @@ export function startDaemon(port: number = 7071) {
   const errorLogPath = path.join(configDir, 'daemon-error.log');
 
   if (isWindows) {
-    startDaemonWindows({
+    await startDaemonWindows({
       port,
       configDir,
       configVars,
@@ -62,57 +62,115 @@ interface DaemonOptions {
   errorLogPath: string;
 }
 
-function startDaemonWindows(opts: DaemonOptions) {
+function resolveNssm(): string | null {
+  try {
+    return execSync('where nssm', { stdio: 'pipe' }).toString().trim().split('\n')[0].trim();
+  } catch {
+    return null;
+  }
+}
+
+async function startDaemonWindows(opts: DaemonOptions) {
   const { port, configDir, configVars, nodePath, backendPath, logPath, errorLogPath } = opts;
+  const serviceName = 'OmnikeyDaemon';
 
-  // Write a wrapper .cmd script that sets env vars and launches the backend
-  const wrapperPath = path.join(configDir, 'start-daemon.cmd');
-  const envSetLines = Object.entries({ ...configVars, OMNIKEY_PORT: String(port) })
-    .map(([k, v]) => `set "${k}=${v}"`)
-    .join('\r\n');
-  const wrapperContent = [
-    '@echo off',
-    envSetLines,
-    `"${nodePath}" "${backendPath}" >> "${logPath}" 2>> "${errorLogPath}"`,
-    '',
-  ].join('\r\n');
+  let nssmPath = resolveNssm();
+  if (!nssmPath) {
+    const { install } = await inquirer.prompt<{ install: boolean }>([
+      {
+        type: 'confirm',
+        name: 'install',
+        message: 'NSSM is required but not found. Install it now via winget?',
+        default: true,
+      },
+    ]);
 
-  try {
-    fs.mkdirSync(configDir, { recursive: true });
-    fs.writeFileSync(wrapperPath, wrapperContent, 'utf-8');
-  } catch (e) {
-    console.error('Failed to write start-daemon.cmd:', e);
-    return;
-  }
+    if (!install) {
+      console.log('Aborted. Install NSSM manually and re-run in an elevated (Administrator) terminal.');
+      return;
+    }
 
-  // Register with Windows Task Scheduler so the daemon persists across reboots
-  const taskName = 'OmnikeyDaemon';
-  try {
-    // Delete existing task silently before creating a fresh one
-    execSync(`schtasks /delete /tn "${taskName}" /f`, { stdio: 'pipe' });
-  } catch {
-    // Task may not exist — that's fine
+    console.log('Installing NSSM via winget...');
+    try {
+      execSync('winget install nssm --accept-package-agreements --accept-source-agreements', {
+        stdio: 'inherit',
+      });
+    } catch (e) {
+      console.error('winget install failed:', (e as any)?.message ?? e);
+      console.log('Try manually: scoop install nssm  or  choco install nssm');
+      return;
+    }
+
+    // winget updates the machine PATH in the registry but the current process
+    // won't see it — spawn a fresh cmd to resolve the new location.
+    try {
+      nssmPath = execSync('cmd /c where nssm', { stdio: 'pipe' })
+        .toString().trim().split('\n')[0].trim();
+    } catch {
+      nssmPath = null;
+    }
+
+    if (!nssmPath) {
+      console.log('NSSM installed successfully.');
+      console.log('Please open a new elevated (Administrator) terminal and re-run this command.');
+      return;
+    }
   }
+
+  initLogFiles(logPath, errorLogPath);
+
+  // Remove any existing service (stop first, then remove)
+  try { execFileSync(nssmPath, ['stop', serviceName], { stdio: 'pipe' }); } catch { /* not running */ }
+  try { execFileSync(nssmPath, ['remove', serviceName, 'confirm'], { stdio: 'pipe' }); } catch { /* didn't exist */ }
+
+  // NSSM services run as LocalSystem; pass USERPROFILE so the backend's
+  // getHomeDir() resolves to the correct user config directory.
+  const env: Record<string, string> = {
+    ...configVars,
+    OMNIKEY_PORT: String(port),
+    USERPROFILE: process.env.USERPROFILE || configDir.replace(/[/\\]\.omnikey$/, ''),
+    HOME: process.env.USERPROFILE || configDir.replace(/[/\\]\.omnikey$/, ''),
+  };
+
   try {
-    execSync(
-      `schtasks /create /tn "${taskName}" /tr "cmd /c \\"${wrapperPath}\\"" /sc ONLOGON /f`,
-      { stdio: 'pipe' },
-    );
-    console.log(`Windows Task Scheduler task created: ${taskName}`);
-    console.log('Omnikey daemon will auto-start on next logon.');
-  } catch (e) {
-    console.error('Failed to create Windows Task Scheduler task:', e);
-  }
+    // Install: nssm install <name> <application> [args...]
+    execFileSync(nssmPath, ['install', serviceName, nodePath, backendPath], { stdio: 'pipe' });
+
+    execFileSync(nssmPath, ['set', serviceName, 'AppDirectory', configDir], { stdio: 'pipe' });
+
+    // Pass all env vars in a single call (replaces the entire AppEnvironmentExtra key)
+    const envEntries = Object.entries(env).map(([k, v]) => `${k}=${v}`);
+    execFileSync(nssmPath, ['set', serviceName, 'AppEnvironmentExtra', ...envEntries], { stdio: 'pipe' });
 
-  // Also start the backend immediately for the current session
-  const { out, err } = initLogFiles(logPath, errorLogPath);
-  const child = spawn(nodePath, [backendPath], {
-    env: { ...configVars, OMNIKEY_PORT: String(port) },
-    detached: true,
-    stdio: ['ignore', out, err],
-  });
-  child.unref();
-  console.log(`Omnikey API backend started as a daemon on port ${port}. PID: ${child.pid}`);
+    execFileSync(nssmPath, ['set', serviceName, 'AppStdout', logPath], { stdio: 'pipe' });
+    execFileSync(nssmPath, ['set', serviceName, 'AppStderr', errorLogPath], { stdio: 'pipe' });
+    execFileSync(nssmPath, ['set', serviceName, 'AppRotateFiles', '1'], { stdio: 'pipe' });
+
+    // Restart automatically after a 3-second delay on any exit
+    execFileSync(nssmPath, ['set', serviceName, 'AppExit', 'Default', 'Restart'], { stdio: 'pipe' });
+    execFileSync(nssmPath, ['set', serviceName, 'AppRestartDelay', '3000'], { stdio: 'pipe' });
+
+    // Start automatically at boot (no login required)
+    execFileSync(nssmPath, ['set', serviceName, 'Start', 'SERVICE_AUTO_START'], { stdio: 'pipe' });
+
+    execFileSync(nssmPath, ['set', serviceName, 'DisplayName', 'Omnikey API Backend'], { stdio: 'pipe' });
+    execFileSync(nssmPath, ['set', serviceName, 'Description', 'Omnikey API Backend Daemon'], { stdio: 'pipe' });
+
+    execFileSync(nssmPath, ['start', serviceName], { stdio: 'pipe' });
+
+    console.log(`NSSM service installed and started: ${serviceName}`);
+    console.log('Omnikey daemon runs on boot, without login, and auto-restarts on crash.');
+    console.log(`Logs: ${logPath}`);
+    console.log(`      ${errorLogPath}`);
+  } catch (e: any) {
+    const msg: string = e?.stderr?.toString() || e?.message || String(e);
+    if (msg.toLowerCase().includes('access') || msg.toLowerCase().includes('privilege')) {
+      console.error('Failed to install NSSM service: administrator privileges are required.');
+      console.error('Re-run this command in an elevated (Administrator) terminal.');
+    } else {
+      console.error('Failed to install NSSM service:', msg);
+    }
+  }
 }
 
 function startDaemonMacOS(opts: DaemonOptions) {

package/src/index.ts

@@ -7,6 +7,8 @@ import { killDaemon } from './killDaemon';
 import { removeConfigAndDb } from './removeConfig';
 import { statusCmd } from './status';
 import { showLogs } from './showLogs';
+import { showConfig } from './showConfig';
+import { setConfig } from './setConfig';
 
 const program = new Command();
 
@@ -26,9 +28,9 @@ program
   .command('daemon')
   .description('Start the Omnikey API backend as a daemon on a specified port')
   .option('--port <port>', 'Port to run the backend on', '7071')
-  .action((options) => {
+  .action(async (options) => {
     const port = Number(options.port) || 7071;
-    startDaemon(port);
+    await startDaemon(port);
   });
 
 program
@@ -64,4 +66,28 @@ program
     showLogs(lines, errorsOnly);
   });
 
+program
+  .command('config')
+  .description('Show the current Omnikey configuration (API keys are masked)')
+  .action(() => {
+    showConfig();
+  });
+
+program
+  .command('set <key> <value>')
+  .description('Set a single configuration key (e.g. omnikey set OMNIKEY_PORT 8080)')
+  .action((key: string, value: string) => {
+    setConfig(key, value);
+  });
+
+program
+  .command('restart-daemon')
+  .description('Restart the Omnikey API backend daemon')
+  .option('--port <port>', 'Port to run the backend on', '7071')
+  .action(async (options) => {
+    killDaemon();
+    const port = Number(options.port) || 7071;
+    await startDaemon(port);
+  });
+
 program.parseAsync(process.argv);