OmniBioAI Studio

Browser and desktop workspace for AI-powered bioinformatics computation

OmniBioAI Studio is the browser and Electron desktop workspace for the OmniBioAI platform. It brings together bioinformatics plugins, AI chat and orchestration, projects, workflows, and platform services; the desktop app can also launch and manage the local stack.

System documentation

System architecture — boundaries, flows, deployment topology, and the current 42-service Compose catalog
Security hardening — production Compose security and development overrides
Integration tests — end-to-end test setup
Operations scripts — backup, validation, and deployment utilities

✨ What's New in v0.8.1-beta

Desktop Authentication & Electron Hardening. This beta moves packaged desktop credentials out of renderer storage and into a narrow, main-process session boundary while retaining the existing web/PWA authentication flow.

🔐 Main-process desktop sessions — access, refresh, and MFA challenge tokens are no longer exposed to the packaged renderer
🔒 Protected refresh persistence — Electron safeStorage is required; Linux basic_text and plaintext fallback are rejected
🌐 HTTPS-only packaged Auth — packaged authentication rejects HTTP, redirects, credential-bearing origins, and TLS downgrade
🧱 Narrow IPC and request policy — sender-validated Auth IPC, renderer bearer stripping, and token injection only for trusted destinations
📦 Packaged runtime fix — generated runtime credentials live under Electron user data instead of inside app.asar
✅ Qualified ARM64 artifacts — checksum-verified AppImage and DEB packages are published for Linux ARM64 evaluation

This remains a beta: staging login, real OS-keychain behavior, packaged session lifecycle, RPM, Node.js 20, and automatic-update metadata are not qualified. See Known Issues and the changelog.

v0.7.1 ✅

🔒 Security & integrity hardening — closed an SSRF exposure in toolserver (routed through the authenticated gateway) and an information-disclosure surface in Control Center; hardened Neo4j (credential rotation, network restriction, Access-gated remote entry)
🌐 Nginx proxy fixes — resolved recurring proxy bugs affecting RAG, Jupyter, RStudio, and VS Code
🛡️ New admin views — Compliance Center, Audit Explorer, Audit Logs, API Keys & Service Accounts, Security Posture, Billing (Usage/Overview)
🔧 Plugin execution fixes — found and fixed real correctness bugs in the plugin execution layer
📚 Documentation rewrite — 28+ plugins and core services rewritten to reflect verified, not assumed, behavior

v0.7.0 ✅

🔐 Unified license key system (OMNI-XXXX-XXXX-XXXX-XXXX) — one key works for web + desktop, auto-creates user on first validation, same JWT as OAuth login
🌐 webstudio.omnibioai.org fully working — license key login enforced, all Studio pages loading correctly, service worker fixed, nginx routes fixed (/license/, /roles/), Control Center JWT cookie fallback
👥 Team expansion — Dr. Rajnish Kumar (Scientific Consultant, SR University), Praveen C.V. Raghavulu (Scientific Advisor, KUMC); About page restructured as company team page
🛠 12,110 bioinformatics tools (up from 11,577) — 100+ new HTTP API tools added, all tools validated (100% clean), 0 duplicates, 0 ToolSpec errors
🤖 Tool selection AI improved — GPU enabled for Ollama (57x faster: 120s → 2.1s), accuracy 0% → 60%, Recall@K 60% → 85%
📦 1,000 ARM64 SIF images
🔧 Control Center web service added
💰 Billing service integrated
🛡️ Admin Console live at admin.omnibioai.org — authenticated E2E certified (8/8)

v0.6.0-beta ✅

🌐 Web version at webstudio.omnibioai.org — no installation required
🔐 SSO & OAuth2 — Google, GitHub, and Microsoft sign-in
🛡️ Cloudflare Access — secure invite-only email whitelist
🧬 12,000+ bioinformatics tools across HTTP APIs, ARM64, x86, and Kubernetes
📦 1,120+ container images (320 Docker + 800 ARM64 SIF) hosted on GHCR and Hugging Face
🔌 225+ bioinformatics & AI plugins covering scRNA-seq, WGS, WES, proteomics, spatial, and more
⚙️ 600+ workflow bundles for Nextflow, WDL, CWL, and Snakemake
🤖 36M PubMed abstracts indexed with a 150-domain RAG pipeline (PubMedBERT, FAISS, BM25, RRF, Neo4j)
🤗 One-click Hugging Face Push from the Model Registry
📊 Live platform metrics dashboard with architecture, service health, and coverage

v0.4.0-beta ✅

Version unification — all UI components, sidebar, badge, logs, and settings now consistently report v0.4.0-beta
23 services fully operational — all layers (Data, Security Control Plane, Execution, AI, Developer) green
1,010 registered tools — deployment snapshot recorded for this release (historical count; the live catalog varies by deployment)
7 execution servers — local_real, slurm_local, aws_batch_prod, aws_batch_demo, azure_batch_demo, gcp_batch_demo, enrichment_remote
claude-sonnet-4-20250514 as default orchestrator model in LLM configuration
IDE Services all RUNNING — JupyterLab (:8888), RStudio (:8787), VS Code Server (:8083)
Beta Cloud mode — connects to webstudio.omnibioai.org; MySQL, Workbench, TES, Ollama tunnels all reachable
Report Bug modal — title, description, email, severity (Low / Medium / High / Critical) with Submit Bug Report

v0.3.0-beta ✅

Interactive environments — choose and launch JupyterLab, RStudio, VS Code, or Terminal through Launcher (Studio → Code)
IDE Layer — dedicated section on Services page with per-container lifecycle management
Launcher backend — Express API using Docker socket for IDE container control; ARM64-compatible
Unified Grafana metrics dashboard embedded in Studio
Full observability stack: cAdvisor + redis-exporter + django-prometheus
OmniBioAI dark theme on Grafana and Prometheus
Auto-generated secrets on first launch via crypto.randomBytes
Grafana service account token auth (anonymous access disabled)
Zero npm vulnerabilities (Electron 28→41, vite 5→8, all CVEs resolved)
DMG + AppImage + EXE installers via GitHub Actions
Public beta announcement + Cloudflare-integrated beta signup

v0.2.0-beta ✅

License key system (OMNI-XXXX-XXXX-XXXX-XXXX, 30-day trial)
Sentry error tracking + in-app bug report button
Cython IP protection (.so compiled binaries)
MySQL-backed license server
1010+ bioinformatics tools (510 HTTP API + 500 Slurm)
Windows NSIS .exe installer
Zero-trust JWT authentication, RBAC/ABAC policy engine
HPC quota governance + async audit logging via Redis Streams

v0.1.0-beta ✅

Full local stack launch with containerized services
Live service health monitoring
Docker image dashboard
Dev Hub with knowledge graph + RAG UI
Mode-aware startup: Local / HPC / Cloud / Hybrid
LLM configuration: Ollama + Claude API + OpenAI
Cloud execution: AWS Batch / Azure Batch / GCP Batch / Kubernetes
HPC execution: Slurm / PBS / LSF via TES

🖥 Screenshots

Runtime Mode — Service Health

Beta Cloud selected — MySQL, Redis, TES, Workbench UP; Ollama initializing

Workbench — Module Overview

Studio home with Platform Services, Security Control Plane, and the six curated Core Platform plugins; the sidebar separates Integrations, Plugins, Omics & Analysis, and Agentic discovery.

Ask OmniBioAI — Documentation Chat

Documentation-grounded chat with citations, available from the unified Ask OmniBioAI entry.

OmniBioAI Agent — Tools & Workflows

The Agent tab shares the chat entry while keeping its tool/workflow orchestration session separate from Ask history.

LLM Configuration

Local Ollama (deepseek-coder), Claude API, OpenAI/Codex, and runtime orchestration settings

Cloud Configuration

AWS, Azure, GCP, and Kubernetes execution backends with full credential management

HPC Configuration

Slurm scheduler, SSH connection, GPU jobs, TES remote execution, filesystem & runtime settings

Launch — Execution Console

Connected to Beta Cloud — all tunnels reachable, runtime summary visible

Services — Full Stack

Services grouped across the Data, Security Control Plane, Execution, AI, and Developer layers; the live set varies by release configuration.

Live Logs

Real-time log stream — 7 entries, filterable by service, live streaming

Jobs — TES Execution Engine

Inspect registered tools, execution backends, and job activity available to the current deployment.

Settings

Data directories, service ports, Docker compose file, security, About panel

Bug Report

In-app bug reporting with title, description, email, and severity selector

📦 Downloads

Platform	Published v0.8.1-beta file	Requirements
Linux ARM64 AppImage	`OmniBioAI.Studio-0.8.1-arm64.AppImage`	aarch64, Ubuntu 20.04+
Linux ARM64 DEB	`omnibioai-studio_0.8.1_arm64.deb`	Ubuntu / Debian ARM64

Download and verify checksums from the v0.8.1-beta release. RPM, x64 Linux, macOS, and Windows packages are not part of this qualified beta artifact set.

📊 Live Platform Proof

Real-time architecture, codebase metrics, coverage, and service health are publicly viewable at:

control.omnibioai.org

🔐 Security Control Plane

The Workbench exposes 12 security modules to a fully authorized user. Tiles are permission-gated, and the owning backend remains authoritative for every request.

Module	Purpose
API Gateway	Authenticated entry point and JWT enforcement
Auth Service	Authentication and identity APIs
Policy Engine	RBAC and ABAC authorization decisions
HPC Policy	Compute quota and governance
Security Audit	Backend security-audit service and API
OPA	Open Policy Agent runtime
API Keys & Service Accounts	Organization API key and OAuth client lifecycle
Compliance Center	HIPAA-aligned control history and verification evidence
Security Posture	Evidence-backed control and readiness overview
Tool Executor	Controlled tool registration and execution surface
Audit Explorer	Administrator-facing security event investigation and evidence
Audit Logs	Identity and administrative audit trail

Authentication is JWT-based. Authorization combines global roles, organization roles, explicit permissions, RBAC/ABAC policy decisions, and tenant-aware organization scoping. Cross-tenant administration is reserved for the dedicated platform_admin role and its platform permissions.

Admin Console / Control Center

omnibioai-control-center provides an operations-focused Control Center and a permission-aware Admin Console from one codebase. Current administrative surfaces include organizations, users, teams, roles and permissions; SSO/SAML, MFA policy, sessions, API keys, OAuth clients, and service accounts; billing and entitlements; HIPAA-aligned compliance evidence; security posture; and audit investigation.

The audit surfaces are distinct:

Security Audit is the backend security-event service and API.
Audit Explorer is the read-only administrator investigation and evidence view over Security Audit events.
Audit Logs is the identity and platform administrative audit trail.

See the Control Center Admin Console guide for the maintained feature catalog and authorization boundaries.

🔐 Browser Authentication

Studio web sessions use the shared OmniBioAI Auth flow. The browser keeps the short-lived access token for API calls; refresh-session state is managed by the server-set session cookie. JWT authentication, explicit permissions, RBAC/ABAC decisions, and organization scoping are enforced by the owning services.

The Workbench hides permission-gated tiles when the validated session lacks the required permission. This is a user-interface convenience only; backend authorization remains authoritative.

🖥 Services

Data Layer

Service	Port	Image
MySQL	:3306 (internal only in production/release — see below)	mysql:8.0
Redis	:6379 (internal only in production/release — see below)	redis:7-alpine

Production/release (docker-compose.release.yml, the config packaged into the Electron app): MySQL and Redis are not published to the host — reachable only inside the Compose network, as mysql:3306 / redis:6379. Every other service still addresses them exactly that way.

Development: the local dev stack (docker-compose.yml) still publishes both directly (:3306 / :6380) for convenience, as it always has. To get the same local access against the release stack instead, layer the explicit docker-compose.release.dev-ports.yml overlay:

docker compose -f docker-compose.release.yml -f docker-compose.release.dev-ports.yml up -d

This overlay binds to 127.0.0.1 only, not 0.0.0.0, and is never bundled into the packaged app or referenced by its startup path — it has to be opted into explicitly. See SECURITY-COMPOSE-HARDENING.md for the full rationale.

Security Control Plane

Service	Port	Image
API Gateway	:8080	ghcr.io/omnibioai/omnibioai-api-gateway:latest
Auth Service	:8001	ghcr.io/omnibioai/omnibioai-auth:latest
Policy Engine	:8002	ghcr.io/omnibioai/omnibioai-policy-engine:latest
HPC Policy Engine	:8003	ghcr.io/omnibioai/omnibioai-hpc-policy-engine:latest
Security Audit	:8004	ghcr.io/omnibioai/omnibioai-security-audit:latest

Execution Layer

Service	Port	Image
Workbench	:8000	ghcr.io/omnibioai/omnibioai-app:latest
TES	:8081 (API) / :5177 (frontend dev)	omnibioai-tes-local
ToolServer	:9090	ghcr.io/omnibioai/omnibioai-toolserver:latest
Model Registry	:8095 (API) / :5176 (frontend dev)	ghcr.io/omnibioai/omnibioai-model-registry:latest
LIMS	:7000	ghcr.io/omnibioai/omnibioai-lims:latest
Control Center	:7070 (localhost-only, JWT-gated via nginx `/_svc/control`)	ghcr.io/omnibioai/omnibioai-control-center:latest
Control Center Web	127.0.0.1:5174 (frontend dev target, built from `omnibioai-control-center`'s Dockerfile)	build-only
Billing Service	:8005	build: `../omnibioai-billing` (`Dockerfile`)
Billing Worker	— (background consumer, no exposed port)	build: `../omnibioai-billing` (`Dockerfile.worker`)
Workflow Bundles	:8098 (API) / :5178 (frontend dev)	ghcr.io/omnibioai/omnibioai-workflow-bundles:latest
Tool Images	:8097 (API) / :5179 (frontend dev)	ghcr.io/omnibioai/omnibioai-tool-images:latest

AI Layer

Service	Port	Image
Ollama	:11434	ollama/ollama
RAG	:8090 (external) / :8096 (internal) / :5175 (frontend dev)	ghcr.io/omnibioai/omnibioai-rag:latest
Dev Hub	:8082 (API) / :5173 (frontend dev)	ghcr.io/omnibioai/omnibioai-dev-hub:latest
Neo4j	:7474 / :7687	neo4j:5.15

Developer Layer

Service	Port	Image
Launcher	:5190	ghcr.io/omnibioai/omnibioai-launcher:latest

IDE Services (managed via Launcher :5190)

Service	Port	Stack
JupyterLab	:8888	Full bioinformatics stack (scanpy, DESeq2, scVelo, cellxgene…)
RStudio Server	:8787	R + Bioconductor (Seurat, DESeq2, scran, monocle3, tidyverse)
VS Code Server	:8083	Python + R + Nextflow + WDL extensions

Observability & Platform Infrastructure

Service	Port	Image
Grafana	:3000	grafana/grafana:latest
Prometheus	internal only, via `/_svc/prometheus`	prom/prometheus:latest
cAdvisor	:8585	gcr.io/cadvisor/cadvisor:latest
Redis Exporter	:9121	oliver006/redis_exporter:latest
Node Exporter	host network, no published port	prom/node-exporter:latest
License Server	:8099	internal build
OPA (Open Policy Agent)	:8181	openpolicyagent/opa:latest
Videos	:8086	ghcr.io/omnibioai/omnibioai-videos:latest
Web UI	served as static files behind Nginx Router	build: `Dockerfile.web` (this repo)
Nginx Router	:80	nginx:latest

🧰 Tools, Plugins & Execution

Workbench plugins and registered execution tools are deployment-dependent and continue to evolve, so Studio does not treat a README count as the catalog source of truth. Browse Discover → Plugins, Omics & Analysis, and Agentic for plugin experiences; use Jobs and Workflows for tool execution and orchestration. Available tools and execution backends depend on the services, permissions, and credentials configured for your deployment.

🧬 Studio Navigation & Workbench

Studio's home presents curated Platform Services, Security Control Plane, and Core Platform sections. Permission-gated destinations may be hidden from users who do not have access; the owning service still enforces access on every request.

The Core Platform section is intentionally a short set of six frequently used Workbench tools: Genome Viewer, Dataset Catalog, Data Manager, Dataset Ingest, Activity Explorer, and Workflow Runner. It is a curated launch area, not the full plugin catalog.

Discover

The Discover navigation keeps the major catalogs separate:

Explore — browse scientific domains and platform resources.
Integrations — external bioinformatics and data-provider connections.
Plugins — browse the broader Workbench plugin catalog.
Omics & Analysis — find analysis tools by omics area.
Agentic — discover agentic AI and orchestration tools.

Catalog membership and counts can change as Workbench evolves; use the live Studio catalog for the current list rather than relying on a README count.

Unified AI workspace

The Ask OmniBioAI navigation entry opens one workspace with two tabs:

Ask · Documentation answers from published OmniBioAI documentation and cites its sources.
Agent · Tools & workflows can analyze data, run bioinformatics tools, search literature, and plan workflows.

The two experiences retain separate conversation histories and their own service/model/data policies; the unified entry does not merge their backends.

🖥 Runtime & Execution Configuration

The Runtime Mode selector currently offers Beta Cloud, which connects to webstudio.omnibioai.org without requiring a local Docker stack. Studio also provides configuration pages for local LLMs, cloud providers, and HPC connection settings. Actual execution options depend on the deployment's enabled services, credentials, and backend availability; see Jobs and Workflows for the options available to your account.

🤖 LLM Configuration

Studio's LLM settings expose local Ollama models, Claude API, and OpenAI / Codex. Model names and provider availability are configurable and may be supplied by your organization; the UI also includes GPU acceleration, embedding-model, offline-first, RAG, and default-orchestrator settings. Provider credentials are managed by the organization rather than stored in Studio.

☁️ Cloud Configuration

Provider	Features
Amazon Web Services	AWS Batch, IAM access keys, S3, region selector
Microsoft Azure	Azure Batch, subscription ID, tenant ID, Blob storage
Google Cloud Platform	GCP Batch, project ID, service account JSON, Cloud Storage
Kubernetes	kubeconfig path, context, namespace, SIF base URL, job prefix
Future: Databricks Workflows	—
Future: Slurm Cloud Bridge	—

🏗 HPC Configuration

Setting	Value
Scheduler	Slurm (dropdown: Slurm / PBS / LSF)
GPU Jobs	CUDA cluster support
Remote Execution	via TES protocol
SSH Hostname	hpc.university.edu (configurable)
SSH Port	22
Private Key	~/.ssh/id_rsa
Shared Mount	/shared/projects
Apptainer Path	/usr/bin/apptainer
Default Partition	gpu

📊 Observability

Grafana Dashboards (4)

OmniBioAI Services — health, request rate, latency, container resources
OmniBioAI Platform Overview — full platform architecture metrics
OmniBioAI LIMS — lab information management metrics
OmniBioAI RAG — query latency and throughput

Prometheus Scrape Targets (7)

workbench:8000 · lims:7000 · rag:8096 · auth-service:8001 · control-center:7070 · cadvisor:8080 · redis-exporter:9121

📋 System Requirements

Component	Minimum	Recommended
RAM	16 GB	32 GB (64 GB with local LLM)
Disk	50 GB free	100 GB free
Docker	Engine 24+	Docker Desktop
OS	Ubuntu 20.04+, macOS 12+, Windows 10/11 (WSL2)	Ubuntu 22.04+
GPU	Optional	NVIDIA + nvidia-container-toolkit

Also required: jq (sudo apt install jq), Docker Compose v2 (included with Engine 24+)

🚀 Quick Start

Beta Cloud (no Docker needed)

Download a supported installer from the v0.8.1-beta release
Launch OmniBioAI Studio and enter your license key
Select Beta Cloud on the Mode page
Click through the setup wizard (Steps 1–5)
Click Launch — tunnels connect to webstudio.omnibioai.org automatically

Local Stack (Docker)

git clone https://github.com/OmniBioAI/omnibioai-studio
cd omnibioai-studio
cp .env.example .env
# Edit .env — set DATA_DIR, WORK_DIR, and secrets
docker compose up -d

The command above uses docker-compose.yml — the first of four Compose files in this repo. See Choosing a Compose File below for what the other three are for.

Choosing a Compose File

File	Use it when…
`docker-compose.yml`	You're running the local/dev stack directly. This is the real, actively-used stack — what Quick Start above and the Studio Settings default both use. Not hardened: ports are published for local convenience/debugging.
`docker-compose.release.yml` (dot)	You're packaging or running the production-hardened stack. This is the file `electron-builder.json`, `electron/main.js`, and `scripts/start.sh` actually bundle/load into the packaged desktop app. MySQL/Redis are not published to the host and other hardening applies — see Data Layer above and `docs/SECURITY-COMPOSE-HARDENING.md`.
`docker-compose-release.yml` (dash)	You're running the release config manually, without the Electron build. This is a deliberately maintained parity copy of the dot file — not a stray duplicate to consolidate. It has its own regression test (`tests/test_compose_release_config.py`) specifically guarding against it drifting from the dot file again, since that happened once before (see the JWT-secret fix in git history). CI validates both files on every push.
`docker-compose.release.dev-ports.yml`	You need to debug against an otherwise-hardened release stack. This is a debug overlay, not a standalone file — layer it on top of the release config: `docker compose -f docker-compose.release.yml -f docker-compose.release.dev-ports.yml up -d`. It republishes MySQL/Redis to `127.0.0.1` only, for local access, and is never bundled into the packaged app.

See docs/SECURITY-COMPOSE-HARDENING.md for the full hardening rationale behind the release files.

From Source

npm install
npm run dev          # development mode (Vite + Electron)
npm run build        # AppImage (Linux)
npm run build:mac    # DMG (macOS)
npm run build:win    # EXE (Windows)

⚙️ Settings

Data Directories

Path	Purpose
Data Directory	PubMed abstracts, FAISS indexes, RAG data
Work Directory	Workflow results, runs, outputs

Expected layout:

data/PubMed/Index/<study>/pubmed_index.faiss
work/workflow_runner.runs/, work/uploads/, work/objects/

Service Ports (configurable)

See "Services" section above for the full, current per-service port list — duplicating it here as a second table just gave the two a chance to disagree (this one used to list 3 of the ~30 exposed services, some of it already stale). Ports are set in docker-compose.yml's ports: blocks; changing one requires a full stack restart.

Docker

Compose file: docker-compose.yml at the repository root. This is the canonical local stack used by Quick Start and the Studio Settings default. See Choosing a Compose File for how this relates to the other three Compose files in the repo.
DATA_DIR and WORK_DIR (set in .env) are each bind-mounted into multiple containers, but not to one fixed path — every service mounts them at whatever container path its own code expects (e.g. DATA_DIR lands at /workspace/data/PubMed in rag and workbench but at /sif in tool-images; WORK_DIR lands at /app/work/runs, /app/work/objects, etc., a different subdirectory per service). There is no single /data or /workspace/work path shared by every container — the only literal /data mounts in docker-compose.yml today are the internal redis_data and neo4j_data volumes, unrelated to DATA_DIR.
docker-compose.yml's volumes: block for each service is the ground truth for its exact mount paths (verified against commit 48c858d).

About (v0.8.1)

Field	Value
Studio Version	v0.8.1
Electron	Electron + Vite
Node.js	See `package.json` toolchain
Platform	Runtime-dependent (Linux, macOS, or Windows)
Status	Beta

🔑 Entitlements and billing

The permission-gated Entitlements tile opens the Admin Console billing surface for plans, licenses, and access. Studio also provides an organization-scoped, read-only Billing view for subscription status, usage limits, rated usage, invoices, and costs when the owning services provide that data. The legacy standalone license validator remains a compatibility component and is not the canonical organization entitlement surface.

🔑 Environment Variables

Use .env.example as the current configuration template and keep deployment values outside version control. Do not place credentials, tokens, signing material, or service-account secrets in README examples, logs, screenshots, or frontend configuration. See Security hardening for deployment guidance.

.env.example covers what it's for — secrets and host paths (DATA_DIR, WORK_DIR, MYSQL_ROOT_PASSWORD, API keys, etc.) that you have to actually supply. It is not a map of how services find each other. That wiring — each service's base URL, port, and which other services it talks to — is set directly in docker-compose.yml's environment: block for that service, using Compose's built-in DNS (every service reaches another by its service name, e.g. http://tes:8081, never localhost). You don't set these yourself and won't find them in .env.example; they're fixed by the compose topology.

Concretely: workbench reaching tes is TES_BASE_URL: http://tes:8081 in workbench's own environment: block — tes resolves via Compose's network, 8081 is the port tes's own ports: block publishes. Multiply that pattern across every arrow in the "Services" section tables above to find any other cross-service wiring.

For what a specific service actually reads — not just what it's wired to — check that service's own README first; several (omnibioai-workbench, omnibioai-lims, omnibioai-rag, and others) carry a full env var reference transcribed from their own block in this file. Where one doesn't, docker-compose.yml's environment: block for that service is the ground truth.

🐛 Bug Reporting

Click the 🐛 Report Bug button in the Studio UI at any time.

Fields: Bug title · Description · Email (optional) · Severity (Low / Medium — Affects workflow / High / Critical)

Reports are sent to our dashboard. Response within 24 hours during beta. Disable with SENTRY_DSN= (empty) in .env.

🔗 OmniBioAI Ecosystem

Repository	Role
`omnibioai`	Main Django Workbench and plugin catalog
`omnibioai-api-gateway`	Zero-trust API gateway
`omnibioai-auth`	JWT authentication service
`omnibioai-policy-engine`	RBAC/ABAC authorization
`omnibioai-hpc-policy-engine`	GPU/CPU quota governance
`omnibioai-security-audit`	Async audit logging
`omnibioai-tes`	Task Execution Service
`omnibioai-toolserver`	FastAPI tool API
`omnibioai-lims`	Lab data management
`omnibioai-model-registry`	ML model versioning
`omnibioai-control-center`	Operations reporting, platform health, and administrative surfaces
`omnibioai-rag`	PubMed RAG pipeline
`omnibioai-dev-hub`	Knowledge graph + embeddings
`omnibioai-workflow-bundles`	WDL/Nextflow/Snakemake bundles
`omnibioai-launcher`	SDK UI + IDE container lifecycle API
`omnibioai_sdk`	Python SDK client
`omnibioai-security-sdk`	Security SDK for service auth
`omnibioai-design-tokens`	Shared design tokens and theme
`omnibioai-ui`	Shared UI component library
`omnibioai-landing`	Public-facing landing page

🗺 Roadmap

v0.9.0 onward are gated on the stated exit criteria below, not dates. Each ships only once its required capabilities are independently verifiable, not merely built. v0.8.1-beta is the current desktop-authentication and Electron-hardening beta; remaining Trusted Tool Catalog, multi-tenancy, and technical-readiness closure work is carried forward to v0.9.0. Earlier roadmap language promising specific feature counts or unverified compliance/SSO claims has been superseded by this table.

Version	Status	Highlights
v0.1.0-beta	✅ Released	Local stack, health monitoring, Dev Hub, LLM configuration
v0.2.0-beta	✅ Released	License system, zero-trust security, 1,010 tools, Windows installer
v0.3.0-beta	✅ Released	IDE Services, Grafana observability, auto-secrets, npm security
v0.4.0-beta	✅ Released	Version unification, 23 services, 7 execution servers, Claude Sonnet 4
v0.5.0-beta	✅ Released	225+ plugins, 36M-abstract RAG index, 1,120+ container images, full beta launch
v0.6.0-beta	✅ Released	Web version (`webstudio.omnibioai.org`), SSO/OAuth2 (Google/GitHub/Microsoft), Cloudflare Access, 800 ARM64 SIF images, 12,000+ tools, Hugging Face integration, Model Registry HF push button
v0.7.0	✅ Released	Unified License Key (one `OMNI-XXXX` key for web + desktop, auto-creates user, same JWT as OAuth login), `webstudio.omnibioai.org` fully working end-to-end, 12,110 tools (100+ new HTTP API tools), Tool Selection AI 57x faster with GPU-enabled Ollama (accuracy 0%→60%, Recall@K 60%→85%), 1,000 ARM64 SIF images, Control Center web service, Billing service integrated, Admin Console at `admin.omnibioai.org`, team expansion (Dr. Rajnish Kumar, Praveen C.V. Raghavulu)
v0.7.1	✅ Released	Security & Integrity Hardening — closed SSRF exposure in toolserver (routed through authenticated gateway); closed info-disclosure surface in Control Center; hardened Neo4j (credential rotation, network restriction, Access-gated remote entry); fixed recurring nginx proxy bugs affecting RAG/Jupyter/RStudio/VS Code; shipped Compliance Center, Audit Explorer, Audit Logs, API Keys & Service Accounts, Security Posture, and Billing (Usage/Overview) admin views; found and fixed real correctness bugs in the plugin execution layer; rewrote documentation for 28+ plugins and core services to reflect verified, not assumed, behavior
v0.8.0-beta	✅ Released	Platform Consolidation & Security Hardening — ecosystem consolidation, authentication/authorization controls, delegated-execution security, Redis and audit hardening, per-user isolation, and release stabilization
v0.8.1-beta	✅ Current	Desktop Authentication & Electron Hardening — main-process-owned desktop sessions, protected refresh persistence without plaintext fallback, HTTPS-only packaged Auth, narrow sender-validated IPC, trusted-destination bearer policy, packaged runtime-path repair, and checksum-verified Linux ARM64 AppImage/DEB artifacts. Staging login, real OS-keychain behavior, packaged lifecycle, RPM, Node.js 20, and updater metadata remain unqualified beta limitations
v0.9.0	🔜 Planned — gated on exit criteria	Trusted Catalog, Multi-Tenancy & Technical-Readiness Closure. Trusted Tool Catalog — requires an audited, verified usable subset of the catalog with confirmed I/O contracts and accurate documentation; explicit disclosure for illustrative/placeholder methods; public counts that distinguish verified tools/models from the full registry. Multi-tenancy — requires genuine multi-org testing, verified multi-user workspaces and team/role management, G1/G2/G4 production isolation evidence, synthetic cross-tenant/per-user testing, and realistic load testing. HIPAA-aligned technical-readiness closure — requires all default/placeholder secrets rotated with a documented rotation process, plus the remaining technical-readiness evidence tracked in #100
v1.0.0	🔜 Planned — gated on exit criteria	Enterprise Verification. Goal: make enterprise/security claims only when independently supportable. Requires real SAML IdP validation, mature multi-tenancy, completion of the verified catalog foundation, current verified model/tool portfolio reporting, and appropriately supported HIPAA-related control/evidence claims

🐛 Known Issues (Beta)

System MySQL/Redis must be stopped before starting: sudo systemctl stop mysql redis-server
GITHUB_TOKEN must be set manually for private image pull
macOS DMG not yet code-signed (GateKeeper warning expected)
Windows installer not yet code-signed
First launch requires internet for license validation; 7-day offline grace period after
cAdvisor requires privileged mode and /dev/kmsg device access
Prometheus not exposed directly — access only via /_svc/prometheus
Control Center (/_svc/control) requires valid JWT; port 7070 bound to localhost only
Billing service backend (billing-service, :8005) is deployed and DB-backed, but has no served production frontend — control-center-web (the billing/subscriptions/entitlements UI) is not wired into any docker-compose file or nginx route in this deployment yet
Two license-validation backends currently coexist: the legacy standalone license_server.py (license-server, :8099, its own MySQL DB) and the unified /license/validate endpoint on omnibioai-auth (:8001), which is what web and desktop actually call for the OMNI-XXXX login flow. The legacy server is still built and deployed but appears superseded — pending a decision on formal decommission

🛠 Maintenance Scripts

Script	Description	Schedule
`scripts/backup-mysql.sh`	Dumps all DBs to compressed `.sql.gz`, 7-day rotation	Daily at 4am
`scripts/check-env.sh`	Validates `.env` secrets before stack start	Before `docker compose up`
`omnibioai-control-center/scripts/run_coverage_host.py`	Rebuilds ecosystem coverage report	Daily at 2am
`omnibioai-dev-hub/scripts/check_and_reindex.sh`	Rebuilds RAG FAISS index on new Studio release	Hourly (checks for new release tag)

0 4 * * * /home/manish/Desktop/omnibioai-ecosystem/omnibioai-studio/scripts/backup-mysql.sh >> /home/manish/Desktop/omnibioai-ecosystem/work/backups/omnibioai-backup.log 2>&1
0 2 * * * python3 /home/manish/Desktop/omnibioai-ecosystem/omnibioai-control-center/scripts/run_coverage_host.py --root /home/manish/Desktop/omnibioai-ecosystem >> /home/manish/Desktop/omnibioai-ecosystem/work/backups/omnibioai-coverage.log 2>&1
0 * * * * /home/manish/Desktop/omnibioai-ecosystem/omnibioai-dev-hub/scripts/check_and_reindex.sh >> /home/manish/Desktop/omnibioai-ecosystem/work/backups/omnibioai-reindex.log 2>&1

📄 License

Apache 2.0 — see LICENSE

👤 Author

Manish Kumar — GitHub · omnibioai.org

OmniBioAI Studio is not a bioinformatics tool — it is a desktop orchestration system for distributed, secure, AI-native scientific computation.

Name		Name	Last commit message	Last commit date
.github/workflows		.github/workflows
backend		backend
build		build
config/redis		config/redis
db-init		db-init
deploy		deploy
docker-socket-proxy		docker-socket-proxy
docker		docker
docs		docs
electron		electron
monitoring		monitoring
packages		packages
public		public
reports		reports
scripts		scripts
security-artifacts		security-artifacts
security		security
src		src
tests		tests
workspace-manager		workspace-manager
.dockerignore		.dockerignore
.env.example		.env.example
.env.web		.env.web
.gitignore		.gitignore
.gitleaks.toml		.gitleaks.toml
.gitleaksignore		.gitleaksignore
.nvmrc		.nvmrc
Dockerfile.web		Dockerfile.web
LICENSE		LICENSE
README.md		README.md
docker-compose-release.yml		docker-compose-release.yml
docker-compose.arm64.yml		docker-compose.arm64.yml
docker-compose.devhub-activation.yml		docker-compose.devhub-activation.yml
docker-compose.dgx-production.yml		docker-compose.dgx-production.yml
docker-compose.managed-storage.yml		docker-compose.managed-storage.yml
docker-compose.override.yml		docker-compose.override.yml
docker-compose.release.dev-ports.yml		docker-compose.release.dev-ports.yml
docker-compose.release.yml		docker-compose.release.yml
docker-compose.yml		docker-compose.yml
electron-builder.json		electron-builder.json
index.html		index.html
package-lock.json		package-lock.json
package.json		package.json
postcss.config.js		postcss.config.js
storage-inventory.json		storage-inventory.json
tailwind.config.js		tailwind.config.js
test_integration.sh		test_integration.sh
vite.config.js		vite.config.js
vitest.app.config.js		vitest.app.config.js

Latest commit

History

Folders and files

Repository files navigation