@alexberardi/jarvis-admin 0.1.49 → 0.1.53

package/server/dist/routes/native-services.js

@@ -0,0 +1,318 @@
+// macOS-only routes that manage services running as user LaunchAgents instead
+// of Docker containers. The corresponding docker-compose services are excluded
+// by compose-generator when the user opts in via WizardState.nativeServices.
+//
+// Each managed service ships its own `deploy-launchd.sh` + plist template in
+// its own repo; this module orchestrates them. Source is taken from
+// `JARVIS_ROOT/<service-id>` if present (dev), otherwise cloned to
+// `~/.jarvis/native/<service-id>` from GitHub.
+import { existsSync, mkdirSync, readFileSync, unlinkSync, statSync } from 'node:fs';
+import { spawn, execSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { requireSuperuser } from '../middleware/auth.js';
+import { parseRegistry } from '../services/generators/service-registry.js';
+import registryData from '../data/service-registry.json' with { type: 'json' };
+import { getComposePath } from '../services/compose-path.js';
+import { getHostPlatform } from '../services/host-platform.js';
+const GITHUB_ORG = 'alexberardi';
+const NATIVE_ROOT = join(homedir(), '.jarvis', 'native');
+/**
+ * Map a service ID → the launchd label its deploy-launchd.sh installs.
+ * llm-proxy uses the legacy label (com.jarvis.llm-proxy, not -api) so
+ * existing installs aren't orphaned.
+ */
+function launchdLabel(serviceId) {
+    if (serviceId === 'jarvis-llm-proxy-api')
+        return 'com.jarvis.llm-proxy';
+    return `com.jarvis.${serviceId.replace(/^jarvis-/, '')}`;
+}
+/** Returns the directory with a checkout of the service repo, cloning if missing. */
+function resolveSourceDir(serviceId) {
+    const dev = process.env.JARVIS_ROOT
+        ? join(process.env.JARVIS_ROOT, serviceId)
+        : null;
+    if (dev && existsSync(join(dev, 'deploy-launchd.sh')))
+        return dev;
+    const target = join(NATIVE_ROOT, serviceId);
+    if (existsSync(join(target, 'deploy-launchd.sh')))
+        return target;
+    return target; // doesn't exist yet — caller will clone
+}
+function logDir(serviceId) {
+    // The plists in each service write to ~/Library/Logs/<dirname>; mirror their
+    // naming so the log endpoint can find them. llm-proxy uses a shortened dir.
+    if (serviceId === 'jarvis-llm-proxy-api') {
+        return join(homedir(), 'Library', 'Logs', 'jarvis-llm-proxy');
+    }
+    return join(homedir(), 'Library', 'Logs', serviceId);
+}
+function plistPath(label) {
+    return join(homedir(), 'Library', 'LaunchAgents', `${label}.plist`);
+}
+/** Returns true when launchctl reports `state = running` for the label. */
+function isRunning(label) {
+    try {
+        const uid = execSync('id -u', { encoding: 'utf-8' }).trim();
+        const output = execSync(`launchctl print gui/${uid}/${label} 2>/dev/null`, {
+            encoding: 'utf-8',
+            timeout: 3000,
+        });
+        const stateMatch = output.match(/state\s*=\s*(\w+)/);
+        const pidMatch = output.match(/pid\s*=\s*(\d+)/);
+        const running = stateMatch?.[1] === 'running';
+        return { running, pid: pidMatch ? parseInt(pidMatch[1], 10) : undefined };
+    }
+    catch {
+        return { running: false };
+    }
+}
+function loadEnvFile(composePath) {
+    const envPath = join(composePath, '.env');
+    if (!existsSync(envPath))
+        return {};
+    const content = readFileSync(envPath, 'utf-8');
+    const vars = {};
+    for (const line of content.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const eq = trimmed.indexOf('=');
+        if (eq === -1)
+            continue;
+        vars[trimmed.slice(0, eq)] = trimmed.slice(eq + 1);
+    }
+    return vars;
+}
+function resolvePort(serviceId, svc, composePath) {
+    const env = loadEnvFile(composePath);
+    const portVarMap = {
+        'jarvis-llm-proxy-api': 'LLM_PROXY_API_PORT',
+        'jarvis-whisper-api': 'WHISPER_API_PORT',
+        'jarvis-tts': 'TTS_PORT',
+    };
+    const portVar = portVarMap[serviceId];
+    if (portVar && env[portVar]) {
+        const p = parseInt(env[portVar], 10);
+        if (!Number.isNaN(p))
+            return p;
+    }
+    return svc.port;
+}
+function nativeCapableServices(registry) {
+    return registry.services.filter((s) => s.nativeCapable);
+}
+export async function nativeServicesRoutes(app) {
+    const registry = parseRegistry(registryData);
+    // Auth policy here mirrors /api/install/*: the wizard runs install BEFORE
+    // there is a superuser account, so install + status are open (same trust
+    // model as the rest of the bootstrap). Post-install lifecycle ops
+    // (start/stop/uninstall) require superuser since they can disable services
+    // running on a live install.
+    /** Catalog + status for every native-capable service. */
+    app.get('/', async (_request, reply) => {
+        if (getHostPlatform() !== 'darwin') {
+            return reply.send({ supported: false, services: [] });
+        }
+        const services = nativeCapableServices(registry).map((svc) => {
+            const label = launchdLabel(svc.id);
+            const installed = existsSync(plistPath(label));
+            const { running, pid } = installed ? isRunning(label) : { running: false };
+            const sourceDir = resolveSourceDir(svc.id);
+            const sourceExists = existsSync(join(sourceDir, 'deploy-launchd.sh'));
+            const logs = logDir(svc.id);
+            const status = {
+                serviceId: svc.id,
+                label,
+                installed,
+                running,
+                pid,
+                sourceDir: sourceExists ? sourceDir : undefined,
+                port: resolvePort(svc.id, svc, getComposePath()),
+                logs: {
+                    stdout: join(logs, 'out.log'),
+                    stderr: join(logs, 'err.log'),
+                },
+            };
+            return { ...svc, status };
+        });
+        return reply.send({ supported: true, services });
+    });
+    /**
+     * SSE: install (clone if needed) + run deploy-launchd.sh for one service.
+     * Streams stdout/stderr of the deploy script so the wizard can show progress.
+     *
+     * GET (not POST) because EventSource is GET-only, matching /api/install/start.
+     */
+    app.get('/:id/install', async (request, reply) => {
+        if (getHostPlatform() !== 'darwin') {
+            return reply.code(400).send({ error: 'Native services are macOS-only' });
+        }
+        const { id } = request.params;
+        const svc = registry.services.find((s) => s.id === id);
+        if (!svc)
+            return reply.code(404).send({ error: `Unknown service: ${id}` });
+        if (!svc.nativeCapable) {
+            return reply.code(400).send({ error: `${id} does not support native install` });
+        }
+        reply.raw.writeHead(200, {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache',
+            Connection: 'keep-alive',
+            'X-Accel-Buffering': 'no',
+        });
+        const emit = (data) => {
+            try {
+                reply.raw.write(`data: ${JSON.stringify(data)}\n\n`);
+            }
+            catch {
+                // Client disconnected mid-stream — let the child finish anyway.
+            }
+        };
+        const composePath = getComposePath();
+        const envFilePath = join(composePath, '.env');
+        const port = resolvePort(id, svc, composePath);
+        const sourceDir = resolveSourceDir(id);
+        try {
+            // Phase 1: ensure source is on disk
+            if (!existsSync(join(sourceDir, 'deploy-launchd.sh'))) {
+                mkdirSync(NATIVE_ROOT, { recursive: true });
+                emit({ phase: 'clone', message: `Cloning ${id} into ${sourceDir}` });
+                await runStreaming('git', ['clone', '--depth', '1', `https://github.com/${GITHUB_ORG}/${id}.git`, sourceDir], { cwd: NATIVE_ROOT }, emit);
+            }
+            else {
+                emit({ phase: 'source', message: `Using existing checkout at ${sourceDir}` });
+            }
+            if (!existsSync(join(sourceDir, 'deploy-launchd.sh'))) {
+                throw new Error(`deploy-launchd.sh missing in ${sourceDir} after clone — repo layout may be wrong`);
+            }
+            // Phase 2: deploy launchagent. The script handles plist materialization +
+            // launchctl bootstrap; first run also kicks off venv creation + pip
+            // install via run-prod-native.sh, which can take minutes.
+            emit({ phase: 'launchd', message: `Deploying launchd agent on port ${port}` });
+            await runStreaming('bash', [join(sourceDir, 'deploy-launchd.sh')], {
+                cwd: sourceDir,
+                env: {
+                    ...process.env,
+                    ENV_FILE_PATH: envFilePath,
+                    [portEnvVarFor(id)]: String(port),
+                },
+            }, emit);
+            const label = launchdLabel(id);
+            emit({ phase: 'done', label, sourceDir, port, message: 'LaunchAgent ready', done: true, code: 0 });
+        }
+        catch (err) {
+            emit({ phase: 'error', message: err instanceof Error ? err.message : String(err), done: true, code: 1 });
+        }
+        reply.raw.end();
+    });
+    /** Restart (kickstart -k) — also used for "start". */
+    app.post('/:id/restart', { preHandler: requireSuperuser }, async (request, reply) => {
+        if (getHostPlatform() !== 'darwin')
+            return reply.code(400).send({ error: 'macOS only' });
+        const label = launchdLabel(request.params.id);
+        if (!existsSync(plistPath(label))) {
+            return reply.code(404).send({ error: `${label} not installed` });
+        }
+        try {
+            const uid = execSync('id -u', { encoding: 'utf-8' }).trim();
+            execSync(`launchctl kickstart -k gui/${uid}/${label}`, { timeout: 5000 });
+            return reply.send({ ok: true, label });
+        }
+        catch (err) {
+            return reply.code(500).send({
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    });
+    /** Stop (bootout) — leaves the plist in place so the user can re-enable later. */
+    app.post('/:id/stop', { preHandler: requireSuperuser }, async (request, reply) => {
+        if (getHostPlatform() !== 'darwin')
+            return reply.code(400).send({ error: 'macOS only' });
+        const label = launchdLabel(request.params.id);
+        try {
+            const uid = execSync('id -u', { encoding: 'utf-8' }).trim();
+            execSync(`launchctl bootout gui/${uid}/${label} 2>/dev/null || true`, { timeout: 5000 });
+            return reply.send({ ok: true, label });
+        }
+        catch (err) {
+            return reply.code(500).send({
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    });
+    /** Uninstall: stop AND remove the plist file. */
+    app.post('/:id/uninstall', { preHandler: requireSuperuser }, async (request, reply) => {
+        if (getHostPlatform() !== 'darwin')
+            return reply.code(400).send({ error: 'macOS only' });
+        const label = launchdLabel(request.params.id);
+        const plist = plistPath(label);
+        try {
+            const uid = execSync('id -u', { encoding: 'utf-8' }).trim();
+            execSync(`launchctl bootout gui/${uid}/${label} 2>/dev/null || true`, { timeout: 5000 });
+            if (existsSync(plist)) {
+                unlinkSync(plist);
+            }
+            return reply.send({ ok: true, label, removedPlist: plist });
+        }
+        catch (err) {
+            return reply.code(500).send({
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    });
+    /**
+     * Tail the last N lines of stdout or stderr. Reads from disk rather than
+     * proxying launchctl — the plist's StandardOutPath / StandardErrorPath
+     * point at predictable files.
+     */
+    app.get('/:id/logs', { preHandler: requireSuperuser }, async (request, reply) => {
+        if (getHostPlatform() !== 'darwin')
+            return reply.code(400).send({ error: 'macOS only' });
+        const { id } = request.params;
+        const { stream = 'stderr', lines = '200' } = request.query;
+        const dir = logDir(id);
+        const file = join(dir, stream === 'stdout' ? 'out.log' : 'err.log');
+        if (!existsSync(file)) {
+            return reply.send({ file, content: '', size: 0 });
+        }
+        try {
+            const size = statSync(file).size;
+            const wanted = Math.min(parseInt(lines, 10) || 200, 5000);
+            // tail -n via shell — avoids loading huge log files into memory.
+            const content = execSync(`tail -n ${wanted} "${file}"`, { encoding: 'utf-8', timeout: 5000 });
+            return reply.send({ file, content, size });
+        }
+        catch (err) {
+            return reply.code(500).send({
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    });
+}
+/** Env var name the deploy-launchd scripts read for the listener port. */
+function portEnvVarFor(serviceId) {
+    if (serviceId === 'jarvis-llm-proxy-api')
+        return 'LLM_PROXY_PORT';
+    if (serviceId === 'jarvis-whisper-api')
+        return 'WHISPER_PORT';
+    if (serviceId === 'jarvis-tts')
+        return 'TTS_PORT';
+    return 'PORT';
+}
+/** Run a child process and emit its stdout/stderr through the SSE emitter. */
+async function runStreaming(cmd, args, opts, emit) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, { cwd: opts.cwd, env: opts.env });
+        child.stdout.on('data', (buf) => emit({ stream: 'stdout', text: buf.toString() }));
+        child.stderr.on('data', (buf) => emit({ stream: 'stderr', text: buf.toString() }));
+        child.on('error', reject);
+        child.on('close', (code) => {
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`${cmd} exited with code ${code}`));
+        });
+    });
+}
+//# sourceMappingURL=native-services.js.map

package/server/dist/routes/native-services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-services.js","sourceRoot":"","sources":["../../src/routes/native-services.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,+EAA+E;AAC/E,6EAA6E;AAC7E,EAAE;AACF,6EAA6E;AAC7E,oEAAoE;AACpE,mEAAmE;AACnE,+CAA+C;AAC/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACnF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAA;AAE1E,OAAO,YAAY,MAAM,+BAA+B,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAE9D,MAAM,UAAU,GAAG,aAAa,CAAA;AAChC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;AAaxD;;;;GAIG;AACH,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,SAAS,KAAK,sBAAsB;QAAE,OAAO,sBAAsB,CAAA;IACvE,OAAO,cAAc,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAA;AAC1D,CAAC;AAED,qFAAqF;AACrF,SAAS,gBAAgB,CAAC,SAAiB;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW;QACjC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC;QAC1C,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAAE,OAAO,GAAG,CAAA;IAEjE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IAC3C,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAA;IAChE,OAAO,MAAM,CAAA,CAAE,wCAAwC;AACzD,CAAC;AAED,SAAS,MAAM,CAAC,SAAiB;IAC/B,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,SAAS,KAAK,sBAAsB,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAA;AACrE,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,uBAAuB,GAAG,IAAI,KAAK,cAAc,EAAE;YACzE,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAChD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAA;QAC7C,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC9C,MAAM,IAAI,GAA2B,EAAE,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QACjD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAQ;QACvB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,GAAsB,EAAE,WAAmB;IACjF,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,UAAU,GAA2B;QACzC,sBAAsB,EAAE,oBAAoB;QAC5C,oBAAoB,EAAE,kBAAkB;QACxC,YAAY,EAAE,UAAU;KACzB,CAAA;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IACrC,IAAI,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAyB;IACtD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAoB;IAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;IAE5C,0EAA0E;IAC1E,yEAAyE;IACzE,kEAAkE;IAClE,2EAA2E;IAC3E,6BAA6B;IAE7B,yDAAyD;IACzD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QACrC,IAAI,eAAe,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAClC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;YAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;YAC1E,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC1C,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAA;YACrE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC3B,MAAM,MAAM,GAAwB;gBAClC,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,KAAK;gBACL,SAAS;gBACT,OAAO;gBACP,GAAG;gBACH,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBAC/C,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;gBAChD,IAAI,EAAE;oBACJ,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;oBAC7B,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;iBAC9B;aACF,CAAA;YACD,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAA;QAC3B,CAAC,CAAC,CAAA;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF;;;;;OAKG;IACH,GAAG,CAAC,GAAG,CAA6B,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3E,IAAI,eAAe,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAA;QAC1E,CAAC;QACD,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAA;QAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,CAAA;QAC1E,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,kCAAkC,EAAE,CAAC,CAAA;QACjF,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACvB,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,IAAI;SAC1B,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,CAAC,IAA6B,EAAE,EAAE;YAC7C,IAAI,CAAC;gBACH,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;QACH,CAAC,CAAA;QAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QAEtC,IAAI,CAAC;YACH,oCAAoC;YACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;gBACtD,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC3C,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,SAAS,EAAE,EAAE,CAAC,CAAA;gBACpE,MAAM,YAAY,CAChB,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,sBAAsB,UAAU,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EACzF,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,IAAI,CAC3B,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,8BAA8B,SAAS,EAAE,EAAE,CAAC,CAAA;YAC/E,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,yCAAyC,CAAC,CAAA;YACrG,CAAC;YAED,0EAA0E;YAC1E,oEAAoE;YACpE,0DAA0D;YAC1D,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,mCAAmC,IAAI,EAAE,EAAE,CAAC,CAAA;YAC9E,MAAM,YAAY,CAChB,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAC9C;gBACE,GAAG,EAAE,SAAS;gBACd,GAAG,EAAE;oBACH,GAAG,OAAO,CAAC,GAAG;oBACd,aAAa,EAAE,WAAW;oBAC1B,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC;iBAClC;aACF,EACD,IAAI,CACL,CAAA;YAED,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;YAC9B,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACpG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QAC1G,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,sDAAsD;IACtD,GAAG,CAAC,IAAI,CAA6B,cAAc,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9G,IAAI,eAAe,EAAE,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;QACxF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC7C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,gBAAgB,EAAE,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YAC3D,QAAQ,CAAC,8BAA8B,GAAG,IAAI,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YACzE,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,kFAAkF;IAClF,GAAG,CAAC,IAAI,CAA6B,WAAW,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3G,IAAI,eAAe,EAAE,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;QACxF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YAC3D,QAAQ,CAAC,yBAAyB,GAAG,IAAI,KAAK,sBAAsB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YACxF,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,iDAAiD;IACjD,GAAG,CAAC,IAAI,CAA6B,gBAAgB,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAChH,IAAI,eAAe,EAAE,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;QACxF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YAC3D,QAAQ,CAAC,yBAAyB,GAAG,IAAI,KAAK,sBAAsB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YACxF,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,UAAU,CAAC,KAAK,CAAC,CAAA;YACnB,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;OAIG;IACH,GAAG,CAAC,GAAG,CACL,WAAW,EACX,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAChC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,IAAI,eAAe,EAAE,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;QACxF,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAA;QAC/C,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,KAAK,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,KAA4C,CAAA;QACjG,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACnE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACnD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAA;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,EAAE,IAAI,CAAC,CAAA;YACzD,iEAAiE;YACjE,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,MAAM,KAAK,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,aAAa,CAAC,SAAiB;IACtC,IAAI,SAAS,KAAK,sBAAsB;QAAE,OAAO,gBAAgB,CAAA;IACjE,IAAI,SAAS,KAAK,oBAAoB;QAAE,OAAO,cAAc,CAAA;IAC7D,IAAI,SAAS,KAAK,YAAY;QAAE,OAAO,UAAU,CAAA;IACjD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,YAAY,CACzB,GAAW,EACX,IAAc,EACd,IAA+C,EAC/C,IAA6C;IAE7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAChE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAA;QAC1F,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAA;QAC1F,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAA;;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAA;QAC3D,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/server/dist/routes/services.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../src/routes/services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAI9C,wBAAsB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA0FxE"}
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../src/routes/services.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AA2C9C,wBAAsB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAmHxE"}

package/server/dist/routes/services.js

@@ -1,5 +1,44 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { requireSuperuser } from '../middleware/auth.js';
 import { proxyRequest } from '../services/proxy.js';
+import { injectAppKeys } from '../services/orchestrator.js';
+import { getComposePath } from '../services/compose-path.js';
+/**
+ * Persist a newly-rotated app key to the central composePath/.env so the
+ * service container picks it up after restart. Mirrors the .env write
+ * that ``registerServices`` already does at the end of the register
+ * flow, just scoped to a single service.
+ *
+ * Returns true if the .env file existed and was successfully written.
+ * Returns false (and logs at warn level) on any failure — callers
+ * surface this via ``env_written`` in the response so the UI can tell
+ * the user whether they still have manual work to do.
+ *
+ * Note: this targets the central ``composePath/.env`` convention with
+ * prefixed key names (``JARVIS_APP_KEY_LOGS``) used by production
+ * installs. Dev environments using per-service .env files with simple
+ * ``JARVIS_APP_KEY`` names need a separate update (out of scope for
+ * this fix — see May-2026 beta debugging notes).
+ */
+function persistRotatedKey(serviceName, appKey) {
+    const composePath = getComposePath();
+    const envFile = join(composePath, '.env');
+    if (!existsSync(envFile))
+        return false;
+    try {
+        const envContent = readFileSync(envFile, 'utf-8');
+        const { content: updatedContent } = injectAppKeys(envContent, {
+            [serviceName]: { appId: serviceName, appKey },
+        });
+        writeFileSync(envFile, updatedContent);
+        return true;
+    }
+    catch (err) {
+        console.warn(`[services] Failed to write rotated key for ${serviceName} to ${envFile}:`, err instanceof Error ? err.message : String(err));
+        return false;
+    }
+}
 export async function servicesRoutes(app) {
     app.addHook('preHandler', requireSuperuser);
     app.get('/registry', async (request, reply) => {
@@ -32,6 +71,30 @@ export async function servicesRoutes(app) {
             body: request.body,
             timeout: 10_000,
         });
+        // If rotation succeeded, write the new plaintext to the central
+        // composePath/.env. Without this step, the UI used to return the
+        // new key in the modal but nothing wrote it anywhere — operators
+        // had to copy it by hand from the modal, and one missed copy left
+        // the .env stuck on its placeholder indefinitely. (May-2026 beta
+        // debugging: dev jarvis-logs never got off ``your-jarvis-logs-app-key``
+        // because every rotate flow was relying on manual transcription.)
+        //
+        // We augment the response with ``env_written`` so the UI can tell
+        // the user whether they still need to update .env manually.
+        if (result.status === 200 && result.data && typeof result.data === 'object') {
+            const payload = result.data;
+            if (payload.service_name && payload.app_key) {
+                const wrote = persistRotatedKey(payload.service_name, payload.app_key);
+                // Preserve any env_written the upstream config-service may have
+                // already set (it has its own --base-path branch); otherwise
+                // surface ours.
+                if (payload.env_written !== true) {
+                    payload.env_written = wrote;
+                }
+                reply.code(result.status).send(payload);
+                return;
+            }
+        }
         reply.code(result.status).send(result.data);
     });
     app.post('/probe', async (request, reply) => {

package/server/dist/routes/services.js.map

@@ -1 +1 @@
-{"version":3,"file":"services.js","sourceRoot":"","sources":["../../src/routes/services.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB;IACvD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAA;IAE3C,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAA;QAE7C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,SAAS,uBAAuB;YACxC,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAc,EAAE;YAC1D,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;QAEF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAA;QAE7C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,SAAS,uBAAuB;YACxC,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAc,EAAE;YAC1D,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;QAEF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAA;QAE7C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,SAAS,yBAAyB;YAC1C,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAc,EAAE;YAC1D,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;QAEF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAA;QAE7C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,SAAS,oBAAoB;YACrC,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAc,EAAE;YAC1D,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;QAEF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;YAC/B,OAAM;QACR,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAA;QACnD,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAA;QAEH,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,MAAM,CAA+B,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1E,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAA;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAE/B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,GAAG,SAAS,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE;YAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAc,EAAE;YAC1D,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;QAEF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"services.js","sourceRoot":"","sources":["../../src/routes/services.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAE5D;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,iBAAiB,CAAC,WAAmB,EAAE,MAAc;IAC5D,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACtC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACjD,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,aAAa,CAAC,UAAU,EAAE;YAC5D,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE;SAC9C,CAAC,CAAA;QACF,aAAa,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,8CAA8C,WAAW,OAAO,OAAO,GAAG,EAC1E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAA;QACD,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB;IACvD,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAA;IAE3C,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAA;QAE7C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,SAAS,uBAAuB;YACxC,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAc,EAAE;YAC1D,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;QAEF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAA;QAE7C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,SAAS,uBAAuB;YACxC,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAc,EAAE;YAC1D,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;QAEF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAA;QAE7C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,SAAS,yBAAyB;YAC1C,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAc,EAAE;YAC1D,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;QAEF,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,wEAAwE;QACxE,kEAAkE;QAClE,EAAE;QACF,kEAAkE;QAClE,4DAA4D;QAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAiF,CAAA;YACxG,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;gBACtE,gEAAgE;gBAChE,6DAA6D;gBAC7D,gBAAgB;gBAChB,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;oBACjC,OAAO,CAAC,WAAW,GAAG,KAAK,CAAA;gBAC7B,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACvC,OAAM;YACR,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAA;QAE7C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,SAAS,oBAAoB;YACrC,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAc,EAAE;YAC1D,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;QAEF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;YAC/B,OAAM;QACR,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAA;QACnD,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAA;QAEH,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,MAAM,CAA+B,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1E,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAA;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;QAE/B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,GAAG,SAAS,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE;YAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAc,EAAE;YAC1D,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;QAEF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/server/dist/services/generators/compose-generator.d.ts

@@ -7,7 +7,14 @@ import type { ServiceRegistry, ServiceDefinition } from '../../types/service-reg
 export declare function getAllEnabledServices(state: WizardState, registry: ServiceRegistry): ServiceDefinition[];
 /**
  * Returns services to include in docker-compose.
- * Excludes GPU services on macOS (they run natively via Metal/MLX).
+ *
+ * On macOS the filter has two layers:
+ *   1. GPU-required services without a `cpuFallback` image (e.g. legacy
+ *      llm-proxy) are always excluded — Docker on Mac can't reach the GPU,
+ *      so the container would be useless.
+ *   2. Any service the user explicitly opted into native mode (via the
+ *      wizard's native-services step → WizardState.nativeServices) is also
+ *      excluded; it'll be installed as a LaunchAgent instead.
  */
 export declare function getComposeServices(state: WizardState, registry: ServiceRegistry): ServiceDefinition[];
 /** Worker container IDs emitted alongside the given services in the compose file. */

package/server/dist/services/generators/compose-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose-generator.d.ts","sourceRoot":"","sources":["../../../src/services/generators/compose-generator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EAGlB,MAAM,iCAAiC,CAAA;AASxC;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,eAAe,GACxB,iBAAiB,EAAE,CASrB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,eAAe,GACxB,iBAAiB,EAAE,CAQrB;AAeD,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,MAAM,EAAE,CAE3E;AA0BD,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,GAAG,MAAM,CA+DrF"}
+{"version":3,"file":"compose-generator.d.ts","sourceRoot":"","sources":["../../../src/services/generators/compose-generator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EAGlB,MAAM,iCAAiC,CAAA;AASxC;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,eAAe,GACxB,iBAAiB,EAAE,CASrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,eAAe,GACxB,iBAAiB,EAAE,CAWrB;AAiBD,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,MAAM,EAAE,CAE3E;AA0BD,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,GAAG,MAAM,CA+DrF"}

package/server/dist/services/generators/compose-generator.js

@@ -12,14 +12,26 @@ export function getAllEnabledServices(state, registry) {
 }
 /**
  * Returns services to include in docker-compose.
- * Excludes GPU services on macOS (they run natively via Metal/MLX).
+ *
+ * On macOS the filter has two layers:
+ *   1. GPU-required services without a `cpuFallback` image (e.g. legacy
+ *      llm-proxy) are always excluded — Docker on Mac can't reach the GPU,
+ *      so the container would be useless.
+ *   2. Any service the user explicitly opted into native mode (via the
+ *      wizard's native-services step → WizardState.nativeServices) is also
+ *      excluded; it'll be installed as a LaunchAgent instead.
  */
 export function getComposeServices(state, registry) {
     const all = getAllEnabledServices(state, registry);
+    const nativeIds = new Set(state.nativeServices ?? []);
     if (state.platform === 'darwin') {
-        // GPU-required services run natively via Metal/MLX. GPU-optional services
-        // (cpuFallback) ship a CPU image and are still useful inside Docker on macOS.
-        return all.filter((s) => !s.gpu || s.cpuFallback);
+        return all.filter((s) => {
+            if (nativeIds.has(s.id))
+                return false;
+            if (s.gpu && !s.cpuFallback)
+                return false;
+            return true;
+        });
     }
     return all;
 }
@@ -28,6 +40,7 @@ export function getComposeServices(state, registry) {
  * Other GPU types (amd Vulkan, none) fall back to the plain CPU image.
  */
 const CPU_FALLBACK_GPU_VARIANTS = new Set(['nvidia', 'amd-rocm']);
+const FIRST_PARTY_PREFIX = 'ghcr.io/alexberardi/';
 /** Whether a service should use a GPU image variant + GPU runtime config for the host. */
 function shouldUseGpuVariant(service, gpuType) {
     if (!service.gpu || !gpuType)
@@ -179,7 +192,14 @@ function generateInfraBlock(infra, state) {
     return lines;
 }
 function getServiceImage(service, state) {
-    let image = service.ghcrImage ?? service.image;
+    const raw = service.ghcrImage ?? service.image;
+    const isFirstParty = raw.startsWith(FIRST_PARTY_PREFIX);
+    const baseImage = raw.includes(':') ? raw.slice(0, raw.lastIndexOf(':')) : raw;
+    // Third-party images (e.g. go2rtc) keep their original tag
+    if (!isFirstParty)
+        return raw;
+    // Build tag with optional GPU suffix
+    let gpuSuffix = '';
     if (shouldUseGpuVariant(service, state.hardware?.gpuType)) {
         const variantSuffix = {
             nvidia: '-cuda',
@@ -187,12 +207,9 @@ function getServiceImage(service, state) {
             'amd-rocm': '-rocm',
             none: '-cpu',
         };
-        const suffix = variantSuffix[state.hardware.gpuType];
-        if (suffix) {
-            image = image.includes(':') ? image + suffix : image + ':latest' + suffix;
-        }
+        gpuSuffix = variantSuffix[state.hardware.gpuType] ?? '';
     }
-    return image;
+    return `${baseImage}:\${JARVIS_IMAGE_TAG:-latest}${gpuSuffix}`;
 }
 function pushGpuConfig(lines, service, state) {
     if (!service.gpu)
@@ -308,6 +325,12 @@ function generateServiceBlock(service, state, registry) {
     if (service.id === 'jarvis-command-center' && state.relayEnabled) {
         lines.push('      JARVIS_RELAY_URL: ${JARVIS_RELAY_URL:-}');
     }
+    // Admin → host platform: env-generator writes HOST_OS to .env at install
+    // time; admin reads it via getHostPlatform() to know whether to expose the
+    // native-services UI (Docker masks the real platform from process.platform).
+    if (service.id === 'jarvis-admin') {
+        lines.push('      HOST_OS: ${HOST_OS:-linux}');
+    }
     // go2rtc: standalone streaming gateway, no Jarvis auth/config needed
     if (service.id === 'go2rtc') {
         // No app-to-app auth, no extra environment — skip to volumes/network