Rotating the CLI control key from a conversation

What the key is

Omniscio runs a small control server on 127.0.0.1:19519. One key — the full-access CLI control key — lets anything holding it drive that server: every skill, every ops script, every scheduled job, and every agent running on this machine.

The key lives in the app's own configuration, and the app also writes a copy to ~/.amc/cli-token for the skills and scripts that read it. A separate copy may exist in the OS keyring under the name amc-cli; that one is optional and only some tools read it.

Why asking for it matters

Because the key is what everything uses, rotating it is a real change with a real consequence: it signs everything out at once, deliberately. That is exactly what you want after a key has been pasted somewhere it should not have been.

Until now the only way to rotate it was a button in Settings → CLI Control, and the app refuses that button to anything but its own main window. On a machine run by agents, that meant a rotation nobody could perform.

How it works now

Ask in a conversation: "rotate the CLI key". The agent replies asking you to confirm, and you answer yes.

Two things make that safe, and both are the app's doing rather than the agent's:

• The app reads your message itself. It does not take the agent's word for what you said. It looks your reply up in the stored conversation and checks that you typed it in the app, that it is a clear yes, that it is recent, and that it answers an agent message which actually asked about rotating the key.
• One yes rotates once. A message that has already rotated the key cannot rotate it again.

If you would rather click than type, nothing changes: the request also becomes a card in your inbox with an Approve button, and clicking it does the same thing.

An agent can always ask. An agent can never approve — not by quoting you, not through a standing "always allow" permission, and not by any automatic path. That permission cannot be granted for this action at all.

What you will and will not see

• You will not see the new key, and neither will the agent you asked. The road can only regenerate. If you want to see or copy the key, that stays where it always was: Settings → CLI Control, on the screen, for you.
• Everything holding the old key stops working immediately. That is the point of rotating. The app updates ~/.amc/cli-token as part of the same step, so scripts that read that file pick up the new key with nothing for you to do.
• If the OS-keyring copy (amc-cli) exists, the app updates it too, so tools reading that copy keep working. If it does not exist, nothing is created — a machine that never mirrored a key stays that way.
• If that copy cannot be updated, the rotation still succeeds and you get one inbox notice saying the mirror is out of date. That notice self-clears; the fix is a keyring problem, not anything you can click.

What it does not do

It does not lengthen or shorten the key's life, and it does not change what the key can do. A session running on a cloud box cannot ask for this at all: the rotation is something you do from your own computer.