Where the CLI Stores Data
Everything omni-cli keeps on a machine lives in two directories under your home — nothing anywhere else. Knowing the layout tells you what to back up, what to audit, and what deleting a file actually does.
The layout
| Path | Contents | Permissions |
|---|---|---|
~/.config/omni/ |
Non-secret configuration (directory) | 0700 |
~/.config/omni/config.json |
The backend URL, written by the installer — the CLI's only source of it | inherits |
~/.config/omni/bindings.json |
Directory → context bindings plus the optional default context (see Contexts) | inherits |
~/.local/share/omni/ |
Data (directory) | 0700 |
~/.local/share/omni/credentials |
Platform tokens (one slot per platform and context), the device private key, and the account token | 0600 |
~/.local/share/omni/cache/ |
Signed definition bundles, the build manifest and install snapshot, the clock tamper guard, and the self-update lock | inherits |
The paths are fixed
These locations are hard-coded under $HOME. Setting XDG_CONFIG_HOME, XDG_DATA_HOME, or any OMNI_* variable does not move them — the overrides are deliberately ignored, so there is exactly one place per user where credentials can ever be, no matter what the environment claims.
The permission guard
The CLI refuses to read the credentials file if it has any group/other permission bits set, and refuses if the containing directory does — a group-writable parent would let another local user swap the file underneath. The error names the offending path and the exact chmod 600 / chmod 700 to run. On Windows the guard is a no-op: the files rely on %USERPROFILE% ACL inheritance.
Cleaning up
Use the commands, not rm:
omni-cli <platform> logout # remove one platform credential (use --context to target)
omni-cli account logout # deregister this device server-side and clear the session
Deleting the files by hand signs nothing out: the device stays registered on your account and keeps counting against your device limit. If a machine is gone, remove its device from Account & devices at https://omnicli.io/account — that revokes its tokens too.
Why it's built this way
Platform tokens are written to the local credentials file at login and read from it at action time — actions call the platform directly from your machine. This file layout is the reason OmniCLI's servers never see your platform tokens: there is simply no path that sends them anywhere.