@alexberardi/jarvis-admin 0.1.65 → 0.1.66

package/server/dist/services/upgrade/compose-upgrader.js

@@ -10,7 +10,20 @@ import { VERSION } from '../../version.js';
 import { getComposePath } from '../compose-path.js';
 import { getHostComposePath } from '../host-paths.js';
 import registryData from '../../data/service-registry.json' with { type: 'json' };
-function loadEnvFile(composePath) {
+/**
+ * Set ``key=value`` in a .env string: replace the line in place if the key
+ * exists, otherwise append it. Used for operational flags (e.g. the broker lock)
+ * that must win over the merge preservation rule.
+ */
+function upsertEnvVar(env, key, value) {
+    const line = `${key}=${value}`;
+    const pattern = new RegExp(`^${key}=.*$`, 'm');
+    if (pattern.test(env))
+        return env.replace(pattern, line);
+    const base = env.endsWith('\n') ? env : env + '\n';
+    return base + line + '\n';
+}
+export function loadEnvFile(composePath) {
     const envFile = join(composePath, '.env');
     if (!existsSync(envFile))
         return {};
@@ -26,23 +39,19 @@ function loadEnvFile(composePath) {
     }
     return vars;
 }
-export async function upgradeCompose(_app, overrides) {
-    const composePath = getComposePath();
-    const registry = parseRegistry(registryData);
-    // Step 1: Backup
-    const backupDir = join(composePath, `backup-${VERSION}`);
-    if (!existsSync(backupDir)) {
-        mkdirSync(backupDir, { recursive: true });
-        for (const file of ['docker-compose.yml', '.env', 'init-db.sh']) {
-            const src = join(composePath, file);
-            if (existsSync(src)) {
-                cpSync(src, join(backupDir, file));
-            }
-        }
-    }
-    // Step 2: Load existing env
-    const existingEnv = loadEnvFile(composePath);
-    // Step 3: Reconstruct state, apply overrides from reconcile options
+/**
+ * PURE regeneration core: reconstruct the wizard state from an existing install's
+ * env and produce the upgraded compose / .env / init-db.sh as STRINGS. Writes
+ * nothing. Both the in-place upgrader and the download/CLI path build on this so
+ * they can never diverge.
+ *
+ * Secrets and user config are preserved because they're recovered from
+ * ``existingEnv`` (via reconstructWizardState + mergeEnv); named data volumes are
+ * matched by Docker on ``up`` since the generator emits stable names, and
+ * bind-mount host paths come from env too. A regenerated file is CANONICAL — any
+ * hand-edits to the original compose are intentionally not carried over.
+ */
+export function buildUpgradedComposeFiles(existingEnv, registry, overrides, hostComposePath) {
     const state = reconstructWizardState(existingEnv, registry);
     if (overrides?.enabledModules) {
         state.enabledModules = overrides.enabledModules;
@@ -56,30 +65,78 @@ export async function upgradeCompose(_app, overrides) {
     if (overrides?.whisperModelPath) {
         state.whisperModelPath = overrides.whisperModelPath;
     }
+    if (overrides?.whisperBackend) {
+        state.whisperBackend = overrides.whisperBackend;
+    }
     if (overrides?.releaseTrack) {
         state.releaseTrack = overrides.releaseTrack;
     }
-    // When admin runs in docker, fetch the absolute host path of the compose
-    // dir we were mounted at. env-generator uses it to write MODELS_DIR so
-    // bind mounts in the regenerated compose resolve on the host (otherwise
-    // they resolve to /host/compose/.models — a path that exists in the admin
-    // container but not on the host, so the daemon binds an empty directory).
-    const hostPath = await getHostComposePath();
-    if (hostPath) {
-        state.hostComposePath = hostPath;
+    if (hostComposePath) {
+        state.hostComposePath = hostComposePath;
     }
-    // Step 4: Generate new compose
-    const newCompose = generateCompose(state, registry);
-    writeFileSync(join(composePath, 'docker-compose.yml'), newCompose);
-    // Step 5: Generate new env template, merge
+    const compose = generateCompose(state, registry);
     const newEnvTemplate = generateEnv(state, registry);
-    const mergedEnv = mergeEnv(existingEnv, newEnvTemplate);
-    writeFileSync(join(composePath, '.env'), mergedEnv);
-    // Step 6: Regenerate init-db.sh
+    let env = mergeEnv(existingEnv, newEnvTemplate);
+    // Broker lock flag is operational, not user config.
+    //  - An explicit override always wins over mergeEnv's "existing value wins".
+    //  - A previously-written MQTT_ALLOW_ANON is preserved by mergeEnv, so a lock
+    //    stays locked (and an open transition stays open) across routine regens.
+    //  - The fresh-install template now sets MQTT_ALLOW_ANON=false, but an UPGRADE
+    //    of an install that predates that change (no MQTT_ALLOW_ANON in its .env)
+    //    must NOT inherit the locked default — its nodes may not have fetched
+    //    broker creds yet, and locking would drop the whole fleet. Force the
+    //    transition window (true) in that case; the operator locks explicitly from
+    //    the admin UI once nodes have migrated.
+    if (overrides?.mqttAllowAnon !== undefined) {
+        env = upsertEnvVar(env, 'MQTT_ALLOW_ANON', String(overrides.mqttAllowAnon));
+    }
+    else if (existingEnv['MQTT_ALLOW_ANON'] === undefined) {
+        env = upsertEnvVar(env, 'MQTT_ALLOW_ANON', 'true');
+    }
     const enabledServices = getAllEnabledServices(state, registry);
     const primaryDb = registry.infrastructure.find((i) => i.id === 'postgres')
         ?.envVars.find((e) => e.name === 'POSTGRES_DB')?.default ?? 'jarvis_config';
     const initDb = generateInitDbScript(enabledServices, primaryDb);
+    return { compose, env, initDb };
+}
+/**
+ * Non-destructive regeneration for the "download / hand it to the user" flow:
+ * read the existing install's env from ``composePath`` and return the upgraded
+ * files as strings WITHOUT touching anything on disk. Used by the compose-mode
+ * migrator (installer CLI) and the admin download endpoint.
+ */
+export function regenerateComposeFiles(composePath, overrides, hostComposePath) {
+    const registry = parseRegistry(registryData);
+    const existingEnv = loadEnvFile(composePath);
+    return buildUpgradedComposeFiles(existingEnv, registry, overrides, hostComposePath);
+}
+export async function upgradeCompose(_app, overrides) {
+    const composePath = getComposePath();
+    const registry = parseRegistry(registryData);
+    // Step 1: Backup
+    const backupDir = join(composePath, `backup-${VERSION}`);
+    if (!existsSync(backupDir)) {
+        mkdirSync(backupDir, { recursive: true });
+        for (const file of ['docker-compose.yml', '.env', 'init-db.sh']) {
+            const src = join(composePath, file);
+            if (existsSync(src)) {
+                cpSync(src, join(backupDir, file));
+            }
+        }
+    }
+    // Step 2: Load existing env
+    const existingEnv = loadEnvFile(composePath);
+    // Step 3-6: Reconstruct + regenerate via the shared pure core.
+    //
+    // When admin runs in docker, fetch the absolute host path of the compose
+    // dir we were mounted at. env-generator uses it to write MODELS_DIR so
+    // bind mounts in the regenerated compose resolve on the host (otherwise
+    // they resolve to /host/compose/.models — a path that exists in the admin
+    // container but not on the host, so the daemon binds an empty directory).
+    const hostPath = await getHostComposePath();
+    const { compose, env, initDb } = buildUpgradedComposeFiles(existingEnv, registry, overrides, hostPath || undefined);
+    writeFileSync(join(composePath, 'docker-compose.yml'), compose);
+    writeFileSync(join(composePath, '.env'), env);
     writeFileSync(join(composePath, 'init-db.sh'), initDb, { mode: 0o755 });
 }
 //# sourceMappingURL=compose-upgrader.js.map

package/server/dist/services/upgrade/compose-upgrader.js.map

@@ -1 +1 @@
-{"version":3,"file":"compose-upgrader.js","sourceRoot":"","sources":["../../../src/services/upgrade/compose-upgrader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAGhC,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAA;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,YAAY,MAAM,kCAAkC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAEjF,SAAS,WAAW,CAAC,WAAmB;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,IAAI,GAA2B,EAAE,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAqBD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAqB,EACrB,SAA4B;IAE5B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAoB,aAAa,CAAC,YAAY,CAAC,CAAA;IAE7D,iBAAiB;IACjB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,OAAO,EAAE,CAAC,CAAA;IACxD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACzC,KAAK,MAAM,IAAI,IAAI,CAAC,oBAAoB,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;YAChE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;YACnC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IAE5C,oEAAoE;IACpE,MAAM,KAAK,GAAG,sBAAsB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC3D,IAAI,SAAS,EAAE,cAAc,EAAE,CAAC;QAC9B,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,cAAc,CAAA;IACjD,CAAC;IACD,IAAI,SAAS,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QAC1C,KAAK,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAA;IAC7C,CAAC;IACD,IAAI,SAAS,EAAE,QAAQ,EAAE,CAAC;QACxB,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAA;IACrC,CAAC;IACD,IAAI,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAChC,KAAK,CAAC,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAA;IACrD,CAAC;IACD,IAAI,SAAS,EAAE,YAAY,EAAE,CAAC;QAC5B,KAAK,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAA;IAC7C,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAA;IAC3C,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,eAAe,GAAG,QAAQ,CAAA;IAClC,CAAC;IAED,+BAA+B;IAC/B,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACnD,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,UAAU,CAAC,CAAA;IAElE,2CAA2C;IAC3C,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IACvD,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;IAEnD,gCAAgC;IAChC,MAAM,eAAe,GAAG,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC;QACxE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,EAAE,OAAO,IAAI,eAAe,CAAA;IAC7E,MAAM,MAAM,GAAG,oBAAoB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IAC/D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AACzE,CAAC"}
+{"version":3,"file":"compose-upgrader.js","sourceRoot":"","sources":["../../../src/services/upgrade/compose-upgrader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIhC,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAA;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,YAAY,MAAM,kCAAkC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAEjF;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,GAAW,EAAE,KAAa;IAC3D,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,KAAK,EAAE,CAAA;IAC9B,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAA;IAClD,OAAO,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,IAAI,GAA2B,EAAE,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAmC,EACnC,QAAyB,EACzB,SAA4B,EAC5B,eAAwB;IAExB,MAAM,KAAK,GAAG,sBAAsB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC3D,IAAI,SAAS,EAAE,cAAc,EAAE,CAAC;QAC9B,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,cAAc,CAAA;IACjD,CAAC;IACD,IAAI,SAAS,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QAC1C,KAAK,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAA;IAC7C,CAAC;IACD,IAAI,SAAS,EAAE,QAAQ,EAAE,CAAC;QACxB,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAA;IACrC,CAAC;IACD,IAAI,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAChC,KAAK,CAAC,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAA;IACrD,CAAC;IACD,IAAI,SAAS,EAAE,cAAc,EAAE,CAAC;QAC9B,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,cAAc,CAAA;IACjD,CAAC;IACD,IAAI,SAAS,EAAE,YAAY,EAAE,CAAC;QAC5B,KAAK,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAA;IAC7C,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,CAAC,eAAe,GAAG,eAAe,CAAA;IACzC,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAChD,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACnD,IAAI,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IAE/C,oDAAoD;IACpD,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,yEAAyE;IACzE,+EAA+E;IAC/E,4CAA4C;IAC5C,IAAI,SAAS,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;QAC3C,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAA;IAC7E,CAAC;SAAM,IAAI,WAAW,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;QACxD,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAA;IACpD,CAAC;IAED,MAAM,eAAe,GAAG,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC;QACxE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,EAAE,OAAO,IAAI,eAAe,CAAA;IAC7E,MAAM,MAAM,GAAG,oBAAoB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IAE/D,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,SAA4B,EAC5B,eAAwB;IAExB,MAAM,QAAQ,GAAoB,aAAa,CAAC,YAAY,CAAC,CAAA;IAC7D,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IAC5C,OAAO,yBAAyB,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;AACrF,CAAC;AA6BD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAqB,EACrB,SAA4B;IAE5B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAoB,aAAa,CAAC,YAAY,CAAC,CAAA;IAE7D,iBAAiB;IACjB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,OAAO,EAAE,CAAC,CAAA;IACxD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACzC,KAAK,MAAM,IAAI,IAAI,CAAC,oBAAoB,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;YAChE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;YACnC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IAE5C,+DAA+D;IAC/D,EAAE;IACF,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAA;IAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,yBAAyB,CACxD,WAAW,EACX,QAAQ,EACR,SAAS,EACT,QAAQ,IAAI,SAAS,CACtB,CAAA;IAED,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC,CAAA;IAC/D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7C,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AACzE,CAAC"}

package/server/dist/services/upgrade/minisign.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Verify a minisign signature over `artifact` against `publicKeyB64` (the base64
+ * line of a minisign public key). Returns true ONLY for a valid signature by
+ * that key. Supports minisign's prehashed (BLAKE2b-512) and legacy modes.
+ * In-language (Node crypto) — no `minisign` binary dependency.
+ */
+export declare function verifyMinisign(publicKeyB64: string, minisigContent: string, artifact: Buffer): boolean;
+/**
+ * Parse a `sha256sum`-format checksums file into filename → lowercase-hex-digest.
+ * Handles both text (`hash␠␠name`) and binary (`hash␠*name`) lines; ignores any
+ * malformed line. Only 64-hex digests are accepted, so a truncated/garbage line
+ * can never masquerade as a valid checksum.
+ */
+export declare function parseChecksums(content: string): Map<string, string>;
+export type UpdateVerificationInput = {
+    /** The trusted minisign public key (base64 line) baked into the client. */
+    publicKeyB64: string;
+    /** Raw bytes of the release's `checksums.txt`, or null if it couldn't be fetched. */
+    checksums: Buffer | null;
+    /** Contents of the release's `checksums.txt.minisig`, or null if absent. */
+    minisigContent: string | null;
+    /** Each downloaded artifact + its bytes, keyed by the filename in checksums.txt. */
+    artifacts: {
+        filename: string;
+        data: Buffer;
+    }[];
+    /** Operator opt-in (JARVIS_ALLOW_UNSIGNED_UPDATE) to accept an UNSIGNED release. */
+    allowUnsigned: boolean;
+};
+export type UpdateVerificationResult = {
+    allow: true;
+    signed: boolean;
+    note?: string;
+} | {
+    allow: false;
+    reason: string;
+};
+/**
+ * The self-update trust policy — pure, so it can be exhaustively tested without
+ * touching the network or the filesystem.
+ *
+ *   - No signature material  → UNSIGNED. Allowed only if the operator opted in
+ *     via `allowUnsigned`; we never fabricate trust.
+ *   - Signature present but invalid for our key → refuse. This is a tampering /
+ *     wrong-signer signal and is **not** overridable by `allowUnsigned` (the
+ *     escape hatch covers "no signature", never "bad signature").
+ *   - Signature valid → every artifact must be listed in checksums.txt AND match
+ *     its SHA-256. Any missing/mismatched artifact → refuse (also not
+ *     overridable — a validly-signed manifest that doesn't match the bytes we
+ *     downloaded means the download was tampered).
+ */
+export declare function decideUpdateVerification(input: UpdateVerificationInput): UpdateVerificationResult;
+//# sourceMappingURL=minisign.d.ts.map

package/server/dist/services/upgrade/minisign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"minisign.d.ts","sourceRoot":"","sources":["../../../src/services/upgrade/minisign.ts"],"names":[],"mappings":"AA6CA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAmBtG;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAOnE;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAA;IACpB,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oFAAoF;IACpF,SAAS,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC/C,oFAAoF;IACpF,aAAa,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,wBAAwB,CA0BjG"}

package/server/dist/services/upgrade/minisign.js

@@ -0,0 +1,126 @@
+import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
+// DER SubjectPublicKeyInfo prefix for an Ed25519 key — prepended to the raw
+// 32-byte public key so Node's crypto can build a KeyObject from it.
+const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+/**
+ * Raw 32-byte Ed25519 key from a minisign public key (the base64 second line of
+ * a `.pub`, or the bare base64). `null` if malformed.
+ *
+ * Layout: `[2-byte algo 'Ed'][8-byte key id][32-byte ed25519 pubkey]` = 42 bytes.
+ */
+function parsePublicKey(publicKeyB64) {
+    let raw;
+    try {
+        raw = Buffer.from(publicKeyB64.trim(), 'base64');
+    }
+    catch {
+        return null;
+    }
+    if (raw.length !== 42 || raw[0] !== 0x45 || raw[1] !== 0x64)
+        return null; // 'Ed'
+    return raw.subarray(10, 42);
+}
+/**
+ * Parse a `.minisig` file's signature line → `{ prehashed, sig }`, or `null`.
+ *
+ * Layout of the (base64) 2nd line: `[2-byte algo][8-byte key id][64-byte sig]`.
+ * algo `ED` (0x45,0x44) = prehashed (Ed25519 over BLAKE2b-512 of the file);
+ * `Ed` (0x45,0x64) = legacy (Ed25519 over the file bytes).
+ */
+function parseSignature(minisigContent) {
+    const lines = minisigContent.split('\n').map((l) => l.trim()).filter(Boolean);
+    if (lines.length < 2)
+        return null;
+    let raw;
+    try {
+        raw = Buffer.from(lines[1], 'base64');
+    }
+    catch {
+        return null;
+    }
+    if (raw.length !== 74 || raw[0] !== 0x45)
+        return null;
+    const mode = raw[1];
+    if (mode !== 0x44 && mode !== 0x64)
+        return null;
+    return { prehashed: mode === 0x44, sig: raw.subarray(10, 74) };
+}
+/**
+ * Verify a minisign signature over `artifact` against `publicKeyB64` (the base64
+ * line of a minisign public key). Returns true ONLY for a valid signature by
+ * that key. Supports minisign's prehashed (BLAKE2b-512) and legacy modes.
+ * In-language (Node crypto) — no `minisign` binary dependency.
+ */
+export function verifyMinisign(publicKeyB64, minisigContent, artifact) {
+    const pub = parsePublicKey(publicKeyB64);
+    const parsed = parseSignature(minisigContent);
+    if (!pub || !parsed)
+        return false;
+    const message = parsed.prehashed
+        ? createHash('blake2b512').update(artifact).digest()
+        : artifact;
+    try {
+        const key = createPublicKey({
+            key: Buffer.concat([ED25519_SPKI_PREFIX, pub]),
+            format: 'der',
+            type: 'spki',
+        });
+        return cryptoVerify(null, message, key, parsed.sig);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Parse a `sha256sum`-format checksums file into filename → lowercase-hex-digest.
+ * Handles both text (`hash␠␠name`) and binary (`hash␠*name`) lines; ignores any
+ * malformed line. Only 64-hex digests are accepted, so a truncated/garbage line
+ * can never masquerade as a valid checksum.
+ */
+export function parseChecksums(content) {
+    const map = new Map();
+    for (const line of content.split('\n')) {
+        const m = line.trim().match(/^([0-9a-fA-F]{64})\s+\*?(.+)$/);
+        if (m)
+            map.set(m[2].trim(), m[1].toLowerCase());
+    }
+    return map;
+}
+/**
+ * The self-update trust policy — pure, so it can be exhaustively tested without
+ * touching the network or the filesystem.
+ *
+ *   - No signature material  → UNSIGNED. Allowed only if the operator opted in
+ *     via `allowUnsigned`; we never fabricate trust.
+ *   - Signature present but invalid for our key → refuse. This is a tampering /
+ *     wrong-signer signal and is **not** overridable by `allowUnsigned` (the
+ *     escape hatch covers "no signature", never "bad signature").
+ *   - Signature valid → every artifact must be listed in checksums.txt AND match
+ *     its SHA-256. Any missing/mismatched artifact → refuse (also not
+ *     overridable — a validly-signed manifest that doesn't match the bytes we
+ *     downloaded means the download was tampered).
+ */
+export function decideUpdateVerification(input) {
+    const { publicKeyB64, checksums, minisigContent, artifacts, allowUnsigned } = input;
+    if (!checksums || !minisigContent) {
+        return allowUnsigned
+            ? { allow: true, signed: false, note: 'release is unsigned; proceeding under JARVIS_ALLOW_UNSIGNED_UPDATE' }
+            : { allow: false, reason: 'release is not signed (checksums.txt.minisig missing)' };
+    }
+    if (!verifyMinisign(publicKeyB64, minisigContent, checksums)) {
+        return { allow: false, reason: 'checksums.txt signature is invalid for the trusted key' };
+    }
+    const hashes = parseChecksums(checksums.toString('utf-8'));
+    for (const { filename, data } of artifacts) {
+        const want = hashes.get(filename);
+        if (!want) {
+            return { allow: false, reason: `${filename} is not listed in the signed checksums.txt` };
+        }
+        const got = createHash('sha256').update(data).digest('hex');
+        if (got !== want) {
+            return { allow: false, reason: `${filename} does not match the signed checksums.txt (sha256 mismatch)` };
+        }
+    }
+    return { allow: true, signed: true };
+}
+//# sourceMappingURL=minisign.js.map

package/server/dist/services/upgrade/minisign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minisign.js","sourceRoot":"","sources":["../../../src/services/upgrade/minisign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAA;AAEjF,4EAA4E;AAC5E,qEAAqE;AACrE,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAE1E;;;;;GAKG;AACH,SAAS,cAAc,CAAC,YAAoB;IAC1C,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA,CAAC,OAAO;IAChF,OAAO,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,cAAsB;IAC5C,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC7E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACnB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/C,OAAO,EAAE,SAAS,EAAE,IAAI,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAA;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,cAAsB,EAAE,QAAgB;IAC3F,MAAM,GAAG,GAAG,cAAc,CAAC,YAAY,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,CAAC,CAAA;IAC7C,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS;QAC9B,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE;QACpD,CAAC,CAAC,QAAQ,CAAA;IAEZ,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAA;QACF,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAA;IACrC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;QAC5D,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAmBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA8B;IACrE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,KAAK,CAAA;IAEnF,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;QAClC,OAAO,aAAa;YAClB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oEAAoE,EAAE;YAC5G,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAA;IACvF,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAA;IAC3F,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;IAC1D,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,4CAA4C,EAAE,CAAA;QAC1F,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC3D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,4DAA4D,EAAE,CAAA;QAC1G,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AACtC,CAAC"}

package/server/dist/services/upgrade/self-updater.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"self-updater.d.ts","sourceRoot":"","sources":["../../../src/services/upgrade/self-updater.ts"],"names":[],"mappings":"AASA,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;AAmBnD;;GAEG;AACH,wBAAsB,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDjF;AAoDD,+DAA+D;AAC/D,wBAAgB,gBAAgB,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ/F;AAED,6DAA6D;AAC7D,wBAAgB,kBAAkB,IAAI,IAAI,CAKzC"}
+{"version":3,"file":"self-updater.d.ts","sourceRoot":"","sources":["../../../src/services/upgrade/self-updater.ts"],"names":[],"mappings":"AAgBA,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;AAyBnD;;GAEG;AACH,wBAAsB,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAkEjF;AAoGD,+DAA+D;AAC/D,wBAAgB,gBAAgB,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ/F;AAED,6DAA6D;AAC7D,wBAAgB,kBAAkB,IAAI,IAAI,CAKzC"}

package/server/dist/services/upgrade/self-updater.js

@@ -4,7 +4,18 @@ import { homedir, platform, arch } from 'node:os';
 import { execSync, spawn } from 'node:child_process';
 import { pipeline } from 'node:stream/promises';
 import { Readable } from 'node:stream';
+import { decideUpdateVerification } from './minisign.js';
 const REPO = 'alexberardi/jarvis-admin';
+// Trusted minisign public key for release artifacts (key id 725ba202b54fa2c9).
+// Releases sign checksums.txt -> checksums.txt.minisig in CI; the self-updater
+// verifies that signature and the artifacts' SHA-256 against it before applying
+// an update. Rotating the signing key means updating this constant.
+const RELEASE_SIGNING_PUBKEY = 'RWRyW6ICtU+iyX4p4RnS24ju0gRsWpxvv6B8pI9G+ZS01q8t8oupAQ8L';
+/** Operator opt-in to accept an UNSIGNED release (never overrides a bad signature). */
+function allowUnsignedUpdate() {
+    const v = (process.env.JARVIS_ALLOW_UNSIGNED_UPDATE ?? '').trim().toLowerCase();
+    return v === '1' || v === 'true' || v === 'yes';
+}
 function detectBinaryName() {
     const os = platform();
     const a = arch();
@@ -34,12 +45,21 @@ export async function selfUpdate(targetVersion, emit) {
     const binaryUrl = `https://github.com/${REPO}/releases/download/${tag}/${binaryName}`;
     const newBinaryPath = join(binDir, 'jarvis-admin.new');
     await downloadFile(binaryUrl, newBinaryPath);
-    chmodSync(newBinaryPath, 0o755);
     // Download new frontend assets
     emit({ phase: 'download', message: 'Downloading frontend assets...' });
     const publicUrl = `https://github.com/${REPO}/releases/download/${tag}/public.tar.gz`;
     const tarPath = join(binDir, 'public.tar.gz');
     await downloadFile(publicUrl, tarPath);
+    // Verify the release signature BEFORE we make the binary executable, extract
+    // the (untrusted) tarball, or swap anything in. A tampered or unsigned update
+    // is refused here (unless the operator opted into JARVIS_ALLOW_UNSIGNED_UPDATE
+    // for an unsigned release — which never overrides a bad signature).
+    emit({ phase: 'verify', message: 'Verifying release signature...' });
+    await verifyReleaseArtifacts(tag, [
+        { path: newBinaryPath, filename: binaryName },
+        { path: tarPath, filename: 'public.tar.gz' },
+    ], emit);
+    chmodSync(newBinaryPath, 0o755);
     // Extract to public.new/
     const publicNewDir = join(binDir, 'public.new');
     mkdirSync(publicNewDir, { recursive: true });
@@ -121,6 +141,46 @@ async function downloadFile(url, destPath) {
     const fileStream = createWriteStream(destPath);
     await pipeline(Readable.fromWeb(res.body), fileStream);
 }
+/** Fetch a small release asset into memory; null on any 404/error (asset absent). */
+async function downloadOptional(url) {
+    try {
+        const res = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(60_000) });
+        if (!res.ok)
+            return null;
+        return Buffer.from(await res.arrayBuffer());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Fetch checksums.txt + its minisign signature for `tag` and enforce the update
+ * trust policy against the already-downloaded artifacts. Throws (aborting the
+ * update, before any swap) if the release is unsigned without opt-in, the
+ * signature is invalid, or an artifact's hash doesn't match the signed manifest.
+ */
+async function verifyReleaseArtifacts(tag, artifacts, emit) {
+    const base = `https://github.com/${REPO}/releases/download/${tag}`;
+    const checksums = await downloadOptional(`${base}/checksums.txt`);
+    const minisig = await downloadOptional(`${base}/checksums.txt.minisig`);
+    const result = decideUpdateVerification({
+        publicKeyB64: RELEASE_SIGNING_PUBKEY,
+        checksums,
+        minisigContent: minisig ? minisig.toString('utf-8') : null,
+        artifacts: artifacts.map((a) => ({ filename: a.filename, data: readFileSync(a.path) })),
+        allowUnsigned: allowUnsignedUpdate(),
+    });
+    if (!result.allow) {
+        throw new Error(`Update refused: ${result.reason}. Set JARVIS_ALLOW_UNSIGNED_UPDATE=1 to accept an ` +
+            `unsigned release at your own risk (this does not bypass a failed signature check).`);
+    }
+    if (result.signed) {
+        emit({ phase: 'verify', message: 'Release signature verified.' });
+    }
+    else {
+        emit({ phase: 'verify', level: 'warn', message: result.note ?? 'Proceeding with an UNSIGNED release.' });
+    }
+}
 /** Check if an upgrade was interrupted and needs to resume. */
 export function getUpgradeMarker() {
     const path = getMarkerPath();

package/server/dist/services/upgrade/self-updater.js.map

@@ -1 +1 @@
-{"version":3,"file":"self-updater.js","sourceRoot":"","sources":["../../../src/services/upgrade/self-updater.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAClI,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,MAAM,IAAI,GAAG,0BAA0B,CAAA;AAIvC,SAAS,gBAAgB;IACvB,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;IACrB,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;IAChB,IAAI,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,2BAA2B,CAAA;IACxE,IAAI,EAAE,KAAK,OAAO,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,wBAAwB,CAAA;IAClE,IAAI,EAAE,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,0BAA0B,CAAA;IACtE,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,CAAA;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,aAAqB,EAAE,IAAU;IAChE,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;IAC1B,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAA;IACrC,MAAM,GAAG,GAAG,IAAI,aAAa,EAAE,CAAA;IAE/B,sBAAsB;IACtB,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,UAAU,KAAK,EAAE,CAAC,CAAA;IACpE,MAAM,SAAS,GAAG,sBAAsB,IAAI,sBAAsB,GAAG,IAAI,UAAU,EAAE,CAAA;IACrF,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;IACtD,MAAM,YAAY,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IAC5C,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IAE/B,+BAA+B;IAC/B,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAA;IACtE,MAAM,SAAS,GAAG,sBAAsB,IAAI,sBAAsB,GAAG,gBAAgB,CAAA;IACrF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC7C,MAAM,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAEtC,yBAAyB;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAC/C,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5C,QAAQ,CAAC,WAAW,OAAO,OAAO,YAAY,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAEzF,cAAc;IACd,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACxD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAE5C,cAAc;IACd,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAA;IACnF,IAAI,UAAU,CAAC,aAAa,CAAC;QAAE,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IACnE,UAAU,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;IAExC,qBAAqB;IACrB,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,QAAQ,CAAC,UAAU,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7E,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAC3D,UAAU,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;IAEnC,mBAAmB;IACnB,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,QAAQ,CAAC,SAAS,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAExE,6EAA6E;IAC7E,aAAa,CAAC,aAAa,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC;QAC5C,OAAO,EAAE,aAAa;QACtB,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC,CAAA;IAEH,yCAAyC;IACzC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAElF,sCAAsC;IACtC,cAAc,EAAE,CAAA;AAClB,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;IAErB,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE;gBACtE,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAA;YACF,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,OAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,UAAU;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,GAAG,mBAAmB,CAAC,EAAE;gBACnF,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAA;YACF,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,OAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,QAAgB;IACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,gBAAgB;KACvD,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAgD,CAAC,EAAE,UAAU,CAAC,CAAA;AACpG,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gBAAgB;IAC9B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAA;IAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,GAAG,aAAa,EAAE,CAAA;IAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,CAAA;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"self-updater.js","sourceRoot":"","sources":["../../../src/services/upgrade/self-updater.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAClI,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AAExD,MAAM,IAAI,GAAG,0BAA0B,CAAA;AAEvC,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,sBAAsB,GAAG,0DAA0D,CAAA;AAIzF,uFAAuF;AACvF,SAAS,mBAAmB;IAC1B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC/E,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,CAAA;AACjD,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;IACrB,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;IAChB,IAAI,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,2BAA2B,CAAA;IACxE,IAAI,EAAE,KAAK,OAAO,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,wBAAwB,CAAA;IAClE,IAAI,EAAE,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,0BAA0B,CAAA;IACtE,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,CAAA;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,aAAqB,EAAE,IAAU;IAChE,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;IAC1B,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAA;IACrC,MAAM,GAAG,GAAG,IAAI,aAAa,EAAE,CAAA;IAE/B,sBAAsB;IACtB,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,UAAU,KAAK,EAAE,CAAC,CAAA;IACpE,MAAM,SAAS,GAAG,sBAAsB,IAAI,sBAAsB,GAAG,IAAI,UAAU,EAAE,CAAA;IACrF,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;IACtD,MAAM,YAAY,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IAE5C,+BAA+B;IAC/B,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAA;IACtE,MAAM,SAAS,GAAG,sBAAsB,IAAI,sBAAsB,GAAG,gBAAgB,CAAA;IACrF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC7C,MAAM,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAEtC,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,oEAAoE;IACpE,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAA;IACpE,MAAM,sBAAsB,CAAC,GAAG,EAAE;QAChC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE;QAC7C,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE;KAC7C,EAAE,IAAI,CAAC,CAAA;IAER,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IAE/B,yBAAyB;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAC/C,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5C,QAAQ,CAAC,WAAW,OAAO,OAAO,YAAY,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAEzF,cAAc;IACd,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACxD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAE5C,cAAc;IACd,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAA;IACnF,IAAI,UAAU,CAAC,aAAa,CAAC;QAAE,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IACnE,UAAU,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;IAExC,qBAAqB;IACrB,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,QAAQ,CAAC,UAAU,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7E,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAC3D,UAAU,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;IAEnC,mBAAmB;IACnB,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,QAAQ,CAAC,SAAS,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAExE,6EAA6E;IAC7E,aAAa,CAAC,aAAa,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC;QAC5C,OAAO,EAAE,aAAa;QACtB,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC,CAAA;IAEH,yCAAyC;IACzC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAElF,sCAAsC;IACtC,cAAc,EAAE,CAAA;AAClB,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;IAErB,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE;gBACtE,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAA;YACF,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,OAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,UAAU;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,GAAG,mBAAmB,CAAC,EAAE;gBACnF,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAA;YACF,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,OAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,QAAgB;IACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,gBAAgB;KACvD,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAgD,CAAC,EAAE,UAAU,CAAC,CAAA;AACpG,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,gBAAgB,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACzF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CACnC,GAAW,EACX,SAA+C,EAC/C,IAAU;IAEV,MAAM,IAAI,GAAG,sBAAsB,IAAI,sBAAsB,GAAG,EAAE,CAAA;IAClE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAA;IACjE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAA;IAEvE,MAAM,MAAM,GAAG,wBAAwB,CAAC;QACtC,YAAY,EAAE,sBAAsB;QACpC,SAAS;QACT,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvF,aAAa,EAAE,mBAAmB,EAAE;KACrC,CAAC,CAAA;IAEF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,CAAC,MAAM,oDAAoD;YACpF,oFAAoF,CACrF,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAA;IACnE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,IAAI,sCAAsC,EAAE,CAAC,CAAA;IAC1G,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gBAAgB;IAC9B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAA;IAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,GAAG,aAAa,EAAE,CAAA;IAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,CAAA;IAClB,CAAC;AACH,CAAC"}

package/server/dist/types/wizard.d.ts

@@ -1,4 +1,10 @@
 export type GpuType = 'nvidia' | 'amd' | 'amd-rocm' | 'apple' | 'none';
+/**
+ * Whisper GPU backend, chosen explicitly and independently of the LLM gpuType.
+ * Default "cpu" — Whisper's base.en is fast on CPU and leaves the GPU for the LLM.
+ * Maps to the whisper image suffix: cpu "" / cuda "-cuda" / vulkan "-vulkan" / rocm "-rocm".
+ */
+export type WhisperBackend = 'cpu' | 'cuda' | 'vulkan' | 'rocm';
 export interface HardwareInfo {
     platform: 'darwin' | 'linux';
     arch: string;
@@ -19,6 +25,8 @@ export interface WizardState {
     dbUser: string;
     whisperModel: string;
     whisperModelPath: string;
+    /** Explicit Whisper GPU backend (default "cpu" when unset). Independent of hardware.gpuType. */
+    whisperBackend?: WhisperBackend;
     llmInterface: string;
     deploymentMode: 'local' | 'remote-llm';
     deploymentTarget: 'standard' | 'compose-export';

package/server/dist/types/wizard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wizard.d.ts","sourceRoot":"","sources":["../../src/types/wizard.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,KAAK,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,CAAA;AAEtE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAA;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAGlB,cAAc,EAAE,MAAM,EAAE,CAAA;IAGxB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IAGpB,cAAc,EAAE,OAAO,GAAG,YAAY,CAAA;IACtC,gBAAgB,EAAE,UAAU,GAAG,gBAAgB,CAAA;IAC/C,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAA;IAC5B,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAA;IAC7B,4FAA4F;IAC5F,YAAY,EAAE,OAAO,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,kEAAkE;IAClE,YAAY,EAAE,QAAQ,GAAG,KAAK,CAAA;IAC9B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,CAAC,SAAS,EAAE,MAAM,GAAG;QACnB,OAAO,EAAE,OAAO,CAAA;QAChB,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnD,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC5D;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,UAAU,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,wBAAwB,CAAA;IAC7F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAA;CAC3C"}
+{"version":3,"file":"wizard.d.ts","sourceRoot":"","sources":["../../src/types/wizard.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,KAAK,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,CAAA;AAEtE;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;AAE/D,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAA;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAGlB,cAAc,EAAE,MAAM,EAAE,CAAA;IAGxB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,gGAAgG;IAChG,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,YAAY,EAAE,MAAM,CAAA;IAGpB,cAAc,EAAE,OAAO,GAAG,YAAY,CAAA;IACtC,gBAAgB,EAAE,UAAU,GAAG,gBAAgB,CAAA;IAC/C,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAA;IAC5B,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAA;IAC7B,4FAA4F;IAC5F,YAAY,EAAE,OAAO,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,kEAAkE;IAClE,YAAY,EAAE,QAAQ,GAAG,KAAK,CAAA;IAC9B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,CAAC,SAAS,EAAE,MAAM,GAAG;QACnB,OAAO,EAAE,OAAO,CAAA;QAChB,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnD,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC5D;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,UAAU,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,wBAAwB,CAAA;IAC7F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAA;CAC3C"}

package/server/src/data/service-registry.json

@@ -1,6 +1,6 @@
 {
   "version": "3.0.0",
-  "platformVersion": "0.1.0",
+  "platformVersion": "0.1.66",
   "services": [
     {
       "id": "jarvis-config-service",
@@ -81,7 +81,9 @@
         { "name": "ADMIN_API_KEY", "description": "Admin endpoint protection", "required": true, "secret": true, "secretRef": "ADMIN_API_KEY" },
         { "name": "JARVIS_AUTH_SECRET_KEY", "description": "JWT signing key (shared with jarvis-auth)", "required": true, "secret": true, "secretRef": "AUTH_SECRET_KEY" },
         { "name": "JARVIS_CONFIG_URL", "description": "Config service URL", "required": false, "default": "http://jarvis-config-service:7700" },
-        { "name": "JARVIS_MQTT_BROKER_URL", "description": "MQTT broker URL for node communication", "required": false, "default": "mqtt://mosquitto:1884" }
+        { "name": "JARVIS_MQTT_BROKER_URL", "description": "MQTT broker URL for node communication", "required": false, "default": "mqtt://mosquitto:1884" },
+        { "name": "MQTT_USERNAME", "description": "Shared broker username", "required": false, "default": "jarvis" },
+        { "name": "MQTT_PASSWORD", "description": "Shared broker password (authenticates CC to mosquitto)", "required": true, "secret": true, "secretRef": "MQTT_PASSWORD" }
       ]
     },
     {
@@ -282,9 +284,13 @@
       "id": "mosquitto",
       "name": "Mosquitto",
       "description": "MQTT message broker — node-to-service communication for TTS, commands, and settings",
-      "image": "eclipse-mosquitto:2",
+      "image": "eclipse-mosquitto:2.0",
       "port": 1884,
-      "envVars": [],
+      "envVars": [
+        { "name": "MQTT_USERNAME", "description": "Shared broker username", "required": false, "default": "jarvis" },
+        { "name": "MQTT_PASSWORD", "description": "Shared broker password (hashed into the password_file at startup)", "required": true, "secret": true, "secretRef": "MQTT_PASSWORD" },
+        { "name": "MQTT_ALLOW_ANON", "description": "Accept anonymous clients (transition window). Set false to lock the broker.", "required": false, "default": "true" }
+      ],
       "volumes": ["jarvis-mosquitto-data:/mosquitto/data"]
     },
     {
@@ -294,7 +300,7 @@
       "image": "grafana/grafana:latest",
       "port": 3000,
       "envVars": [
-        { "name": "GF_SECURITY_ADMIN_PASSWORD", "description": "Grafana admin password", "required": true, "default": "jarvis" }
+        { "name": "GF_SECURITY_ADMIN_PASSWORD", "description": "Grafana admin password", "required": true, "secret": true, "secretRef": "GRAFANA_ADMIN_PASSWORD" }
       ],
       "volumes": ["jarvis-grafana-data:/var/lib/grafana"]
     }