omnius 1.0.318 → 1.0.320

package/dist/index.js

@@ -687143,23 +687143,23 @@ async function scanProjects() {
       alert('No Omnius instances found under ' + data.base);
       return;
     }
-    const unregistered = data.projects.filter((p: any) => !p.registered);
-    const registered = data.projects.filter((p: any) => p.registered);
+    const unregistered = data.projects.filter((p) => !p.registered);
+    const registered = data.projects.filter((p) => p.registered);
     let html = '<div style="margin-bottom:8px;font-size:0.65rem;color:var(--color-fg-subtle)">Found ' + data.count + ' Omnius instance(s) under <code>' + data.base + '</code></div>';
     if (registered.length > 0) {
       html += '<div style="font-size:0.65rem;color:var(--color-fg-subtle);margin-bottom:4px">Already registered:</div>';
-      registered.forEach((p: any) => {
+      registered.forEach((p) => {
         html += '<div style="padding:4px 8px;margin:2px 0;font-size:0.65rem;color:var(--color-fg-subtle)">✓ ' + p.name + ' — ' + p.root + '</div>';
       });
     }
     if (unregistered.length > 0) {
       html += '<div style="font-size:0.65rem;color:var(--color-fg-subtle);margin:8px 0 4px">Not registered — click to add:</div>';
-      unregistered.forEach((p: any) => {
+      unregistered.forEach((p) => {
         html += '<div class="scan-row" data-root="' + encodeURIComponent(p.root) + '" data-name="' + encodeURIComponent(p.name) + '" style="padding:4px 8px;margin:2px 0;font-size:0.65rem;color:var(--color-brand);cursor:pointer;border:1px dashed var(--color-border);border-radius:3px">' +
           p.name + ' <span style="color:var(--color-fg-faint)">(' + p.root + ')</span>' +
           ' <span style="color:var(--color-success);font-size:0.6rem">[click to register]</span></div>';
       });
-      document.querySelectorAll('.scan-row').forEach((el: any) => {
+      document.querySelectorAll('.scan-row').forEach((el) => {
         el.addEventListener('click', async () => {
           const root = decodeURIComponent(el.getAttribute('data-root') || '');
           const name = decodeURIComponent(el.getAttribute('data-name') || '');
@@ -687238,8 +687238,9 @@ window.addProject = addProject;
 
 // ─── Filter projects by search text ───
 function filterProjects() {
-  const query = (document.getElementById('project-search') as HTMLInputElement)?.value.toLowerCase() || '';
-  document.querySelectorAll('.proj-row').forEach((el: any) => {
+  const search = document.getElementById('project-search');
+  const query = String((search && search.value) || '').toLowerCase();
+  document.querySelectorAll('.proj-row').forEach((el) => {
     const root = (el.getAttribute('data-root') || '').toLowerCase();
     const name = (el.textContent || '').toLowerCase();
     el.style.display = (!query || root.includes(query) || name.includes(query)) ? '' : 'none';
@@ -694342,6 +694343,29 @@ function tokensMatch(a2, b) {
     return false;
   }
 }
+function cookieValue(req3, name10) {
+  const raw = req3.headers["cookie"];
+  if (typeof raw !== "string" || !raw) return null;
+  for (const part of raw.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx <= 0) continue;
+    const k = part.slice(0, idx).trim();
+    if (k !== name10) continue;
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return part.slice(idx + 1).trim();
+    }
+  }
+  return null;
+}
+function isLoopbackRequest(req3) {
+  const remoteIp = (req3.socket?.remoteAddress || "").replace(/^::ffff:/, "");
+  return isLoopbackIP(remoteIp);
+}
+function hasLocalUiSession(req3) {
+  return isLoopbackRequest(req3) && tokensMatch(cookieValue(req3, LOCAL_UI_SESSION_COOKIE), LOCAL_UI_SESSION_TOKEN);
+}
 function scopedEnvKeySources() {
   const pick = (...names) => {
     for (const n2 of names) {
@@ -694441,6 +694465,9 @@ function resolveAuth(req3) {
     } catch {
     }
   }
+  if (hasLocalUiSession(req3)) {
+    return { authenticated: true, scope: "admin", user: "local-ui" };
+  }
   if (!anyEnvAuthKeyConfigured()) {
     const insecureLoopbackAdmin = process.env["OMNIUS_INSECURE_LOOPBACK_ADMIN"] === "1";
     const remoteIp = (req3.socket?.remoteAddress || "").replace(/^::ffff:/, "");
@@ -697893,12 +697920,16 @@ async function handleRequest(req3, res, ollamaUrl, verbose, runtimeDefaults = {}
       "/config"
     ]);
     if (guiRoutes.has(pathname) && method === "GET" && req3.headers.accept?.includes("text/html")) {
-      res.writeHead(200, {
+      const htmlHeaders = {
         "Content-Type": "text/html; charset=utf-8",
         "Cache-Control": "no-cache, no-store, must-revalidate, max-age=0",
         Pragma: "no-cache",
         Expires: "0"
-      });
+      };
+      if (isLoopbackRequest(req3)) {
+        htmlHeaders["Set-Cookie"] = LOCAL_UI_SESSION_COOKIE + "=" + encodeURIComponent(LOCAL_UI_SESSION_TOKEN) + "; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400" + (req3.socket.encrypted ? "; Secure" : "");
+      }
+      res.writeHead(200, htmlHeaders);
       res.end(getWebUI());
       return;
     }
@@ -702818,7 +702849,7 @@ function setTimerEnabled(name10, enabled2) {
     return false;
   }
 }
-var require4, NEXUS_DIRECTORY_ORIGIN2, NEXUS_SPONSORS_URL2, endpointRegistry, modelRouteMap, endpointUsage, _lastEndpointDiagnostics, BACKEND_TIMEOUT_DEFAULT_MS, BACKEND_TIMEOUT_MAX_MS, MODEL_LIST_TIMEOUT_DEFAULT_MS, metrics, startedAt, realtimeOllamaFallbackCache, runningProcesses, perKeyUsage, CRON_MARKER2;
+var require4, NEXUS_DIRECTORY_ORIGIN2, NEXUS_SPONSORS_URL2, endpointRegistry, modelRouteMap, endpointUsage, _lastEndpointDiagnostics, BACKEND_TIMEOUT_DEFAULT_MS, BACKEND_TIMEOUT_MAX_MS, MODEL_LIST_TIMEOUT_DEFAULT_MS, metrics, startedAt, realtimeOllamaFallbackCache, runningProcesses, LOCAL_UI_SESSION_COOKIE, LOCAL_UI_SESSION_TOKEN, perKeyUsage, CRON_MARKER2;
 var init_serve = __esm({
   "packages/cli/src/api/serve.ts"() {
     "use strict";
@@ -702869,6 +702900,8 @@ var init_serve = __esm({
     startedAt = Date.now();
     realtimeOllamaFallbackCache = /* @__PURE__ */ new Map();
     runningProcesses = /* @__PURE__ */ new Map();
+    LOCAL_UI_SESSION_COOKIE = "omnius_ui_session";
+    LOCAL_UI_SESSION_TOKEN = randomBytes28(32).toString("base64url");
     perKeyUsage = /* @__PURE__ */ new Map();
     CRON_MARKER2 = "# OMNIUS-SCHEDULED:";
   }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.318",
+  "version": "1.0.320",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.318",
+      "version": "1.0.320",
       "bundleDependencies": [
         "image-to-ascii"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnius",
-  "version": "1.0.318",
+  "version": "1.0.320",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",