🛸 Sync 2026-10-27 02:27:08

kai/Makefile

@@ -10,8 +10,8 @@ include $(TOPDIR)/rules.mk
 PKG_ARCH_kai:=$(ARCH)
 
 PKG_NAME:=kai
-PKG_VERSION:=0.0.27
-PKG_RELEASE:=10
+PKG_VERSION:=0.0.28
+PKG_RELEASE:=11
 PKG_SOURCE:=$(PKG_NAME)-binary-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/istoreos/istoreos-app-hub/releases/download/kai-runtime-v$(PKG_VERSION)/
 PKG_HASH:=skip
@@ -28,7 +28,7 @@ define Package/$(PKG_NAME)
 	SUBMENU:=
 	TITLE:=KAI
 	DEPENDS:=+kai_session +kai-agent +luci-lib-linkeaseauth +linkease-app-entry
-	EXTRA_DEPENDS:=kai-agent (>=0.0.27~0)
+	EXTRA_DEPENDS:=kai-agent (>=0.0.28~0), kai_session (>=0.0.28~0)
 	URL:=https://github.com/linkease/istore-ai-helper
 endef
 

kai/files/kai-session-launch

@@ -7,4 +7,7 @@ if [ "$#" -ne 1 ] || [ -z "$1" ]; then
 fi
 
 cd "$1"
+OPENCODE_PASSWORD="$(cat "${KAI_ENGINE_PASSWORD_FILE:?missing KAI engine credential file}")"
+[ -n "$OPENCODE_PASSWORD" ] || exit 1
+export OPENCODE_PASSWORD
 exec /usr/sbin/kai_session serve --port 8196 --hostname 127.0.0.1

kai/files/kai.init

@@ -12,7 +12,9 @@ get_config() {
 
 start_kai_bin(){
 	procd_open_instance kai_bin
-	procd_set_param env KAI_AUTH_MODE="$auth_mode"
+	procd_set_param env KAI_AUTH_MODE="$auth_mode" \
+		KAI_ENGINE_API=v2 KAI_ENGINE_PASSWORD_FILE=/var/run/kai/engine-password \
+		XDG_CONFIG_HOME="${data_dir}/config" XDG_DATA_HOME="${data_dir}/data"
 	procd_set_param command /usr/sbin/kai_bin -a 0.0.0.0 -p "$port"
 	procd_set_param stderr 1
 	procd_set_param respawn 3600 5 5
@@ -31,6 +33,8 @@ start_kai_session(){
 		return 1
 	fi
 	procd_set_param env \
+		KAI_ENGINE_API=v2 \
+		KAI_ENGINE_PASSWORD_FILE=/var/run/kai/engine-password \
 		OPENCODE_CONFIG="${agent_root}/opencode.json" \
 		KAIPLUS_SKILLS_DIR="${agent_root}/skills" \
 		ISTORE_AI_HELPER_BASE="http://127.0.0.1:${port}" \
@@ -61,6 +65,16 @@ start_service() {
 	mkdir_cwd "${data_dir}/data"
 	mkdir_cwd "${data_dir}/config"
 	mkdir_cwd "${data_dir}/state"
+	# Both processes read a private credential. Never put it in procd's JSON
+	# service definition or send it to the browser.
+	(umask 077
+		mkdir -p /var/run/kai
+		chmod 700 /var/run/kai
+		if [ ! -s /var/run/kai/engine-password ]; then
+			head -c 32 /dev/urandom | hexdump -v -e '1/1 "%02x"' > /var/run/kai/engine-password
+		fi
+		chmod 600 /var/run/kai/engine-password
+	) || return 1
 	start_kai_session || return 1
 	start_kai_bin
 	logger -t kai "Starting KAI Service Completed"