omnius 1.0.530 → 1.0.532

package/dist/postinstall-daemon.cjs

@@ -38,6 +38,7 @@ var SERVICE_LABEL = "omnius-daemon";
 var LAUNCHD_LABEL = "ai.omnius.daemon";
 var WIN_TASK_NAME = "OmniusDaemon";
 var REQUIRED_AIWG_VERSION = "2026.5.11";
+var INSTALL_STEPS = 7;
 
 // ─── Helpers ────────────────────────────────────────────────────────────────
 
@@ -86,6 +87,108 @@ function shellQuote(value) {
   return "'" + String(value).replace(/'/g, "'\\''") + "'";
 }
 
+function userHomeFor(user) {
+  if (!user) return HOME;
+  try {
+    var current = os.userInfo().username;
+    if (user === current || user === process.env.USER || user === process.env.LOGNAME) return HOME;
+  } catch (e) {}
+  if (IS_WIN) return HOME;
+  if (IS_MAC) {
+    try {
+      var macHome = runCapture("dscl . -read /Users/" + shellQuote(user) + " NFSHomeDirectory").split(/\s+/).pop();
+      if (macHome) return macHome;
+    } catch (e) {}
+  }
+  try {
+    var pwdEntry = runCapture("getent passwd " + shellQuote(user));
+    if (pwdEntry) {
+      var parts = pwdEntry.split(":");
+      if (parts[5]) return parts[5];
+    }
+  } catch (e) {}
+  return path.join("/home", user);
+}
+
+function chownToUser(file, user) {
+  if (IS_WIN || !user || !process.getuid || process.getuid() !== 0) return;
+  try {
+    var uid = parseInt(runCapture("id -u " + shellQuote(user)), 10);
+    var gid = parseInt(runCapture("id -g " + shellQuote(user)), 10);
+    if (Number.isFinite(uid) && Number.isFinite(gid)) fs.chownSync(file, uid, gid);
+  } catch (e) {}
+}
+
+function envAuthConfigured() {
+  var names = [
+    "OMNIUS_REST_API_KEYS",
+    "OMNIUS_API_KEYS",
+    "OMNIUS_REST_API_KEY",
+    "OMNIUS_API_KEY",
+    "OMNIUS_REST_READ_API_KEY",
+    "OMNIUS_READ_API_KEY",
+    "OMNIUS_REST_RUN_API_KEY",
+    "OMNIUS_RUN_API_KEY",
+    "OMNIUS_REST_ADMIN_API_KEY",
+    "OMNIUS_ADMIN_API_KEY",
+  ];
+  for (var i = 0; i < names.length; i++) {
+    if (process.env[names[i]] && String(process.env[names[i]]).trim()) return true;
+  }
+  return false;
+}
+
+function runtimeKeysExistForUser(user) {
+  try {
+    var file = process.env.OMNIUS_RUNTIME_KEYS_FILE || path.join(userHomeFor(user), ".omnius", "keys.json");
+    if (!fs.existsSync(file)) return false;
+    var parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+    return Array.isArray(parsed) && parsed.some(function (rec) { return rec && rec.key && !rec.revoked; });
+  } catch (e) {
+    return false;
+  }
+}
+
+function ensureBootstrapApiKeyForUser(user) {
+  if (process.env.OMNIUS_SKIP_BOOTSTRAP_KEY === "1") {
+    log("OMNIUS_SKIP_BOOTSTRAP_KEY=1 - skipping local REST bootstrap key.");
+    return;
+  }
+  try {
+    var home = userHomeFor(user);
+    var dir = path.join(home, ".omnius");
+    var file = path.join(dir, "api.key");
+    fs.mkdirSync(dir, { recursive: true });
+    chownToUser(dir, user);
+    if (fs.existsSync(file) && String(fs.readFileSync(file, "utf8")).trim()) {
+      try { fs.chmodSync(file, 0o600); } catch (e) {}
+      chownToUser(file, user);
+      log("Local REST bootstrap key already exists: " + file);
+      return;
+    }
+    if (envAuthConfigured()) {
+      log("REST auth env key detected - local bootstrap key not created.");
+      return;
+    }
+    if (runtimeKeysExistForUser(user)) {
+      log("Runtime REST keys already exist - local bootstrap key not created.");
+      return;
+    }
+    var key = "omnius_bootstrap_" + require("crypto").randomBytes(32).toString("hex");
+    var tmp = file + ".tmp." + process.pid + "." + Date.now();
+    fs.writeFileSync(tmp, key + "\n", "utf8");
+    try { fs.chmodSync(tmp, 0o600); } catch (e) {}
+    chownToUser(tmp, user);
+    fs.renameSync(tmp, file);
+    try { fs.chmodSync(file, 0o600); } catch (e) {}
+    chownToUser(file, user);
+    log("Created local REST bootstrap key: " + file);
+    log("Use /apikey show inside Omnius, then send REST calls with Authorization: Bearer <key>.");
+  } catch (e) {
+    warn("Could not create local REST bootstrap key (non-fatal): " + (e && e.message ? e.message : String(e)));
+  }
+}
+
 function installedGlobalAiwgVersion() {
   try {
     var globalRoot = runCapture("npm root -g");
@@ -732,19 +835,22 @@ function repairBrokenWrappers() {
 
 function main() {
   // Always do the nexus cleanup first, regardless of opt-out.
-  progress(1, 6, "Cleaning stale Nexus runtime state");
+  progress(1, INSTALL_STEPS, "Cleaning stale Nexus runtime state");
   cleanNexus();
 
   // Auto-repair stale Omnius model wrappers BEFORE restarting the daemon, so the
   // freshly-restarted daemon picks up the rebuilt models on first inference.
-  progress(2, 6, "Checking local model wrappers");
+  progress(2, INSTALL_STEPS, "Checking local model wrappers");
   try { repairBrokenWrappers(); } catch (e) {
     warn("wrapper auto-repair crashed (non-fatal): " + (e && e.message));
   }
 
-  progress(3, 6, "Ensuring AIWG CLI");
+  progress(3, INSTALL_STEPS, "Ensuring AIWG CLI");
   ensureGlobalAiwgInstall();
 
+  progress(4, INSTALL_STEPS, "Ensuring local REST key");
+  ensureBootstrapApiKeyForUser(effectiveUser());
+
   if (process.env.OMNIUS_SKIP_DAEMON_INSTALL === "1") {
     log("OMNIUS_SKIP_DAEMON_INSTALL=1 — skipping daemon service install.");
     return safeExit(0);
@@ -756,7 +862,7 @@ function main() {
   // restart can't reach it, so we have to clean up explicitly. Without this,
   // the new service-managed daemon fails to bind port 11435 and the user
   // ends up running stale in-memory code from the previous version.
-  progress(4, 6, "Clearing daemon port");
+  progress(5, INSTALL_STEPS, "Clearing daemon port");
   forceKillPortHolder(PORT, function (killedCount) {
     if (killedCount > 0) {
       log("Killed " + killedCount + " stale daemon process(es) holding port " + PORT + ".");
@@ -787,7 +893,7 @@ function runMainAfterKill() {
       // idempotent and ensures the unit file matches the current bundle.
     }
 
-    progress(5, 6, "Installing daemon service");
+    progress(6, INSTALL_STEPS, "Installing daemon service");
     log("Installing Omnius API daemon service for port " + PORT + " ...");
     log("  node:       " + nodeBin);
     log("  omnius script:  " + omniusScript);
@@ -818,7 +924,7 @@ function runMainAfterKill() {
     }
 
     // Wait up to 15s for /health to come up, but don't fail npm install.
-    progress(6, 6, "Verifying daemon health");
+    progress(7, INSTALL_STEPS, "Verifying daemon health");
     waitForHealth(15000, function (healthy) {
       if (healthy) {
         log("Omnius API daemon is live: http://127.0.0.1:" + PORT + "/health");

package/docs/rest/QUICKREF.md

@@ -28,6 +28,11 @@ Auth header:
 Authorization: Bearer <key>
 ```
 
+Local global installs create a daemon bootstrap key at `~/.omnius/api.key`.
+Inside Omnius, run `/apikey show` to display it, `/apikey copy` to copy it, and
+`/apikey mint run` to create a project runtime key for agents or MCP-style
+REST clients.
+
 ## Health
 
 ```bash
@@ -131,5 +136,5 @@ Requires admin scope:
 curl -s -X POST http://127.0.0.1:11435/v1/keys \
   -H 'authorization: Bearer admin-secret' \
   -H 'content-type: application/json' \
-  -d '{"scope":"run","owner":"ci","rpm":60,"tpd":100000,"max_jobs":3}'
+  -d '{"scope":"run","project":"myactuator","rpm":60,"tpd":100000,"max_jobs":3}'
 ```

package/docs/rest/auth-and-scopes.md

@@ -37,7 +37,9 @@ Fields:
 
 ## Runtime Keys
 
-Runtime keys are stored under `~/.omnius/keys.json` and are checked after environment keys.
+Runtime keys are stored under `~/.omnius/keys.json` by default and are checked after environment keys and the local bootstrap key. Override the store with `OMNIUS_RUNTIME_KEYS_FILE` or put all Omnius state under another directory with `OMNIUS_CONFIG_HOME`.
+
+Global installs create a local daemon bootstrap key at `~/.omnius/api.key` if one does not exist. The daemon accepts it as an admin token, so a local operator can start Omnius and run `/apikey show` to reveal it, or `/apikey mint run` to create a project runtime key.
 
 | Method | Path | Scope | Purpose |
 | --- | --- | --- | --- |
@@ -50,7 +52,8 @@ Mint body:
 ```json
 {
   "scope": "run",
-  "owner": "ci",
+  "project": "myactuator",
+  "owner": "project:myactuator",
   "profile": "readonly",
   "rpm": 60,
   "tpd": 100000,
@@ -58,6 +61,16 @@ Mint body:
 }
 ```
 
+If `owner` is omitted and `project` is provided, Omnius uses `project:<project>` as the audit owner.
+
+Agent and MCP-style clients should persist the returned secret in their own secret store and send it as:
+
+```text
+Authorization: Bearer <key>
+```
+
+Do not put API keys in query strings. Omnius rejects query-string keys to keep them out of logs and browser history.
+
 ## Scope Semantics
 
 `read` is for inspection:

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "omnius",
-  "version": "1.0.530",
+  "version": "1.0.532",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omnius",
-      "version": "1.0.530",
+      "version": "1.0.532",
       "bundleDependencies": [
         "image-to-ascii"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnius",
-  "version": "1.0.530",
+  "version": "1.0.532",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",