OneOS Docs
Genesis 0.1.12 Console

Resources

Changelog

The three packages share one version. Each release is tagged genesis-vX.Y.Z and published to npm; upgrade all three together.

npm install @lifesi/genesis@0.1.12 @lifesi/genesis-cli@0.1.12 @lifesi/genesis-mcp@0.1.12

Genesis 0.1.12

npm had all three packages at 0.1.11, built from 86285025 on Oct 16. The fixes merged since then reach users in this release.

All packages

  • The default gateway is https://os.one.ml/api (SDK DEFAULT_BASE_URL, the CLI's --base-url default, and the MCP server through the SDK). GENESIS_BASE_URL still overrides the default. The merged OpenAPI lists both servers.
  • Each package ships a README (install, credentials, usage, docs links) and homepage: https://os.one.ml/docs, and declares engines.node >=20.19. The packages are ESM only.

CLI (@lifesi/genesis-cli)

  • genesis status reads the gateway's live GET /v1/status instead of printing a table built into the package.
  • genesis login --device prints the server's verification_uri, pinned to the One account issuer host, instead of the retired auth host built into 0.1.11. Terminal control sequences are stripped from server text before it is printed.
  • Sign-in copy reads "Sign in with One" / "One account".
  • --json errors include the gateway's code, required_scope and docs_url for every service, not only Minds.
  • genesis login works with no configuration: it defaults to One account's registered genesis-cli profile (its registered loopback callback and audience). GENESIS_AUTH_PRODUCT, GENESIS_AUTH_REDIRECT_URI and GENESIS_AUTH_AUDIENCE still override it, and an empty value turns browser login off.
  • genesis hives projects delete <project_id>. Projects could be created from the CLI but not deleted.
  • Server text in human-readable error output is sanitised, and table() strips terminal control sequences from cells.
  • safe() also strips bidirectional-override and zero-width characters from server text before printing.
  • Blinds custody commands, and Flocks help text that describes nodes rather than agents.
  • genesis rigs list, genesis panes list, genesis shells list, and command groups genesis gears …, genesis lanes …, genesis flares …: one command per admitted operation, path parameters as arguments, --body-file for JSON bodies and --idempotency-key (required where the service requires it).

MCP (@lifesi/genesis-mcp)

  • The tool and instruction text lists services and the tool count from the generated operations, so it matches the tools actually exposed. It now includes the Blinds custody operations.
  • 43 curated tools for the new services (287 → 331 listed tools with hives_delete_project); every new operation is also reachable through genesis_call. Gears, Lanes and Flares writes take idempotency_key, sent as the Idempotency-Key header. Lanes read POSTs are annotated read-only and lanes_deleteTenant destructive.
  • Taps stays out: its relay admits only the pinned Console workload service accounts, so no SDK, CLI or MCP caller can reach it.
  • Error results include the gateway's code, required_scope and docs_url for every service.
  • hives_delete_project is an MCP tool (destructive), so an agent that creates a project can delete it.
  • GENESIS_MCP_LAZY=1 or --lazy lists only genesis_search_tools and genesis_call instead of every tool (331 tools are about 265 KB on each connect).
  • Tool descriptions and genesis_search_tools results no longer carry [service status: …] from the 9 Oct inventory (every Hives tool said "down"). Live state is GET /v1/status.

SDK (@lifesi/genesis)

  • Error messages come from ERROR_CATALOG.
  • Hives resource refusals (queues, topics, cells, volumes, marketplace and runtimes: 67 operations) keep the gateway's code, request_id and required_scope. Before, they became a generic http_403 with neither. Hives' own lower-case codes (selected_context_required, queue_state_conflict, …) pass through too, and selected_context_required says to select a context (genesis context select) rather than to re-read state. A plain-string error body is the message, and type stays a stable token such as forbidden. The response body is still never retained; only catalog-shaped values are read. New errorCatalog(error) returns { code, required_scope, docs_url }.
  • The exported services registry and each operationTable entry's upstream no longer ship status / statusNote. Those were a 9 Oct inventory snapshot ("Hives down"), not live state. Both fields stay on ServiceMeta as optional and deprecated (always undefined); live state is GET /v1/status (genesis status).
  • http:// endpoints are accepted only on loopback.
  • Blinds custody operations and owner enrollment, with the regenerated operations and schema; Flocks operation titles describe nodes.
  • Operations for every route the gateway already admits but no devtool exposed: Rigs rigs.list() (GET /v1/rigs), Panes panes.list() and Shells shells.list() (the exact instance-list GETs), Gears workflows, runs, history, signals and operational records (9), Lanes context, cache, ledger, policy, promotions and receipts (24, Sandbox) and Flares v2 flares, conversations, commitments, presence, trust and choreography (34, Sandbox). New specs in openapi/specs/{rigs,panes,shells,gears,lanes,flares}; the operation table grows from 393 to 463.
  • Generated operations record whether a spec declares an Idempotency-Key header (idempotencyKey: 'required' | 'optional'); idempotencyHeaders() refuses a missing or malformed required key before anything is sent. Lanes POSTs (including the read POSTs) and Flares mutations require one; Gears writes take one optionally.
  • ServiceMeta.gatewayRoute: 'dedicated' marks services the registry describes for the devtools only; the gateway keeps admitting them solely through their own composition (routesFromRegistry skips them, so routing is unchanged).

Release tooling

  • The publish workflow could only re-publish the sealed 0.1.9–0.1.11 archives: its dispatch guard and releasePins allowed no other version, and adoption refused any changed application input. It now also releases the version on main: run from a genesis-v<version> tag on a main commit (or a dispatch from main), it installs, builds and runs the full test suite, packs that checkout and publishes over npm trusted publishing (OIDC). Retained versions still go through the sealed-archive path.
  • pack expected only @lifesi/genesis to be rewritten from workspace:*. @lifesi/genesis-mcp also depends on @lifesi/genesis-cli, so it now checks every workspace sibling.
  • Bounded readback after an accepted publish PUT. The README and the CI install check use the scoped @lifesi/genesis-mcp install command. Neither changes package contents.
  • New check (CI and the release job): it fails when a package version on main is already on npm with different contents.

One Superintelligence, Inc. · Built from Genesis 0.1.12 and the live gateway on 2026-10-20. Support