omnius 1.0.319 → 1.0.320

package/dist/index.js

@@ -694343,6 +694343,29 @@ function tokensMatch(a2, b) {
     return false;
   }
 }
+function cookieValue(req3, name10) {
+  const raw = req3.headers["cookie"];
+  if (typeof raw !== "string" || !raw) return null;
+  for (const part of raw.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx <= 0) continue;
+    const k = part.slice(0, idx).trim();
+    if (k !== name10) continue;
+    try {
+      return decodeURIComponent(part.slice(idx + 1).trim());
+    } catch {
+      return part.slice(idx + 1).trim();
+    }
+  }
+  return null;
+}
+function isLoopbackRequest(req3) {
+  const remoteIp = (req3.socket?.remoteAddress || "").replace(/^::ffff:/, "");
+  return isLoopbackIP(remoteIp);
+}
+function hasLocalUiSession(req3) {
+  return isLoopbackRequest(req3) && tokensMatch(cookieValue(req3, LOCAL_UI_SESSION_COOKIE), LOCAL_UI_SESSION_TOKEN);
+}
 function scopedEnvKeySources() {
   const pick = (...names) => {
     for (const n2 of names) {
@@ -694442,6 +694465,9 @@ function resolveAuth(req3) {
     } catch {
     }
   }
+  if (hasLocalUiSession(req3)) {
+    return { authenticated: true, scope: "admin", user: "local-ui" };
+  }
   if (!anyEnvAuthKeyConfigured()) {
     const insecureLoopbackAdmin = process.env["OMNIUS_INSECURE_LOOPBACK_ADMIN"] === "1";
     const remoteIp = (req3.socket?.remoteAddress || "").replace(/^::ffff:/, "");
@@ -697894,12 +697920,16 @@ async function handleRequest(req3, res, ollamaUrl, verbose, runtimeDefaults = {}
       "/config"
     ]);
     if (guiRoutes.has(pathname) && method === "GET" && req3.headers.accept?.includes("text/html")) {
-      res.writeHead(200, {
+      const htmlHeaders = {
         "Content-Type": "text/html; charset=utf-8",
         "Cache-Control": "no-cache, no-store, must-revalidate, max-age=0",
         Pragma: "no-cache",
         Expires: "0"
-      });
+      };
+      if (isLoopbackRequest(req3)) {
+        htmlHeaders["Set-Cookie"] = LOCAL_UI_SESSION_COOKIE + "=" + encodeURIComponent(LOCAL_UI_SESSION_TOKEN) + "; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400" + (req3.socket.encrypted ? "; Secure" : "");
+      }
+      res.writeHead(200, htmlHeaders);
       res.end(getWebUI());
       return;
     }
@@ -702819,7 +702849,7 @@ function setTimerEnabled(name10, enabled2) {
     return false;
   }
 }
-var require4, NEXUS_DIRECTORY_ORIGIN2, NEXUS_SPONSORS_URL2, endpointRegistry, modelRouteMap, endpointUsage, _lastEndpointDiagnostics, BACKEND_TIMEOUT_DEFAULT_MS, BACKEND_TIMEOUT_MAX_MS, MODEL_LIST_TIMEOUT_DEFAULT_MS, metrics, startedAt, realtimeOllamaFallbackCache, runningProcesses, perKeyUsage, CRON_MARKER2;
+var require4, NEXUS_DIRECTORY_ORIGIN2, NEXUS_SPONSORS_URL2, endpointRegistry, modelRouteMap, endpointUsage, _lastEndpointDiagnostics, BACKEND_TIMEOUT_DEFAULT_MS, BACKEND_TIMEOUT_MAX_MS, MODEL_LIST_TIMEOUT_DEFAULT_MS, metrics, startedAt, realtimeOllamaFallbackCache, runningProcesses, LOCAL_UI_SESSION_COOKIE, LOCAL_UI_SESSION_TOKEN, perKeyUsage, CRON_MARKER2;
 var init_serve = __esm({
   "packages/cli/src/api/serve.ts"() {
     "use strict";
@@ -702870,6 +702900,8 @@ var init_serve = __esm({
     startedAt = Date.now();
     realtimeOllamaFallbackCache = /* @__PURE__ */ new Map();
     runningProcesses = /* @__PURE__ */ new Map();
+    LOCAL_UI_SESSION_COOKIE = "omnius_ui_session";
+    LOCAL_UI_SESSION_TOKEN = randomBytes28(32).toString("base64url");
     perKeyUsage = /* @__PURE__ */ new Map();
     CRON_MARKER2 = "# OMNIUS-SCHEDULED:";
   }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.319",
+  "version": "1.0.320",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.319",
+      "version": "1.0.320",
       "bundleDependencies": [
         "image-to-ascii"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnius",
-  "version": "1.0.319",
+  "version": "1.0.320",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",