@goodfish/jarvy 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -2,6 +2,56 @@
 
 All notable changes to Jarvy. Versions follow [semantic versioning](https://semver.org/) as used before 1.0: a patch release only fixes bugs; a minor release adds features or upgrades the database.
 
+## 0.7.0 — 2026-10-21
+
+Upgrading moves the database from schema v20 to v21 on first start: secrets, their grants and their uses are added, and the credentials you have already saved are encrypted under a new master key. Keep the master key file if you may need to go back, and keep a copy of the database too: a v21 database cannot be opened by 0.6.0.
+
+### Added
+
+- **HTTPS beyond this machine.** Jarvy can now be reached at `https://` from other devices on your network, with a certificate it makes for itself. One port serves both HTTPS and plain HTTP, and plain HTTP from another machine is redirected to HTTPS. Settings › Network has a switch for LAN access, the addresses to use, and, while it is off, says that Jarvy is open to this computer only. A browser shows a warning once, until you trust Jarvy's certificate; Settings has the steps for each system. From this machine nothing changes, and `localhost` keeps working as a secure context. (A51)
+- **Secrets.** A Bot can use a token, password or key without the value passing through the chat. Settings › Secrets holds them, encrypted under a master key that lives outside your data directory, and you choose which Bots may use each one, always or for one run. In a command a Bot writes a placeholder such as `{{secret:GITHUB_TOKEN}}`, filled in for that command only; values are masked in everything the model sees. When a Bot needs one it does not have, it asks on a card: it names the secret and its purpose, you paste the value or decline, and the card asks how long the grant lasts. A use log shows what was used, by which Bot, where and when. The credentials you saved for model connections are sealed under the same key. (A52)
+- **Skills for the agent Bot.** Jarvy now ships skills: guides for a kind of work, which the agent Bot follows when the work calls for it. The first is `dev-team`, on running software development with a team of Bots: forming the team, splitting roles, organizing channels, using threads, keeping channel notices, and a development flow from a request to a release. The agent Bot's prompt lists each skill; the text is read only when it is needed, and plans built from it go to you to confirm. (A55)
+- **Provider logos.** In Settings › Models the provider picker shows each brand's logo instead of its initial. The icons come from LobeHub's lobe-icons (MIT), with the notice in `THIRD_PARTY_NOTICE.md`.
+
+### Changed
+
+- **Bot info's context usage is what the model reported**, not an estimate. Until a Bot's first reply it is unknown, and after a compaction it is unknown again until the model reports; when a request fails and Pi drops it from the context, the figure from the last successful reply stays, with a warning that says why. (A54)
+- **Bots are told about unread messages.** When a Bot sends a message or asks a question, the result tells it how many messages in that chat it had not read, and how to read them, so it can catch up before it acts. (A53)
+- **Question cards are one panel.** A question and a secret request are drawn the same way: a framed panel under the Bot's message, with the options, the custom answer and the buttons; a settled card folds to one line. A card that is no longer waiting for an answer reads as ignored rather than expired.
+- **Interface text**, in both languages: errors say what happened and what to do, settings describe what each option does, and wording is consistent across screens.
+
+### Known limits
+
+- The master key sits in a file in Jarvy's configuration directory, readable by your user; anything that can read your files can read it.
+- A secret is granted to a Bot, not to a particular run of work.
+- Skills belong to the agent Bot alone, cannot be added by you yet, and are written again each time it starts, so changes to those files do not last.
+
+## 0.6.0 — 2026-10-19
+
+Upgrading moves the database from schema v19 to v20 on first start: environments and their grants are added, and each Bot gains its default and current environment. Existing Bots keep working on your computer. A v20 database cannot be opened by 0.5.0; keep a copy if you may need to go back.
+
+### Added
+
+- **Sandboxes.** A Bot can work in its own sandbox: a Linux container only it uses, which Jarvy makes with Docker. It comes with Node, Python, git, build tools, CJK fonts and Playwright with its browsers, and the Bot can install more with sudo. Its workspace is mounted as `/workspace` and is its home directory there, so settings such as `~/.ssh` and `~/.gitconfig` stay with it. Choose a sandbox or your computer when you create a Bot (the agent Bot can too), or change it later in Bot info under 工作环境 / Work environment. A sandbox keeps running until you stop it, and it survives a Jarvy restart. Stop closes what the Bot left running there, and Reset removes what it installed but never the workspace; both ask first. Without Docker, Bots work on your computer as before. (A50)
+- **Letting a sandboxed Bot use your computer.** In Bot info, a switch under the external environments it may use lets a sandboxed Bot use your computer. It moves there and back by itself when a task needs it, like `cd`, and each batch tells it where it is now. Turning the switch off sends a Bot that is there back to its sandbox. A command that is already running finishes where it started.
+- **Files go through Jarvy.** Attachments no longer point at a path on your computer. A Bot fetches one into wherever it is working, and sends files from there, so files work the same in a sandbox.
+
+### Changed
+
+- Pi 1.2.0, and the model catalogue takes pi.dev's newer entries. (A49)
+- The live cat's thinking and murmurs show all of a step's text and scroll, up to 12 lines (6 on a phone).
+
+### Fixed
+
+- Files sent together in one message keep the order they were given in. This applies to messages sent before the upgrade too.
+- The transcript stays at the bottom when rows grow after opening, instead of stopping a little above the newest message.
+
+### Known limits
+
+- The sandbox image is built on your machine the first time one is needed: a few minutes, about 3 GB. There is no GPU in it.
+- A sandbox keeps the image it was made from until you reset it. Older images are removed after a new one is built.
+- Being able to use Docker is equivalent to root on the machine running Jarvy.
+
 ## 0.5.0 — 2026-10-14
 
 Upgrading moves the database from schema v18 to v19 on first start: a settings table is added and the inbox table is rebuilt with all its rows. A v19 database cannot be opened by 0.4.0; keep a copy if you may need to go back. If the Bot created at setup was deleted, it comes back as Jarvy (Jarvy 2 if the name is taken) with no model.

package/README.md

@@ -34,6 +34,8 @@ The interface comes in English and Chinese, following your browser's language; s
 
 **Watch it work.** In a DM, the Bot's block cat acts out its turn as it happens: it thinks, reads, types and turns to you, and a dialogue beside it shows what it is thinking, muttering and sending, and each tool it runs. Click the dialogue to see every step.
 
+**Each Bot in its own sandbox.** With Docker installed, a Bot can work in a Linux container only it uses, with Node, Python, git, build tools and Playwright with its browsers, and it can install whatever else it needs. Its workspace is its home there and outlives a reset. Choose a sandbox or your computer when you create a Bot, change it later in Bot info, and let a sandboxed Bot use your computer when a task needs it.
+
 **An agent Bot that runs Jarvy for you.** Jarvy, the first Bot, wears a crown. Tell it what you want to get done and it builds the team: it creates Bots, writes their personas and picks their models. Later it starts and stops them, checks their usage and clears things away. Anything it deletes waits for your confirmation on a card.
 
 **Unread that respects your attention.** A red count appears only when someone @mentions you or replies to you. Everything else gets a quiet one-line preview, and you can mute any chat.
@@ -54,7 +56,7 @@ The interface comes in English and Chinese, following your browser's language; s
 
 ## Quick start
 
-Requires Node.js 24 (22.19 or later works).
+Requires Node.js 24 (22.19 or later works). Docker is optional: with it, Bots can work in their own sandboxes. Their image is built on this machine the first time one is needed, which takes a few minutes and about 3 GB.
 
 ```sh
 npm install
@@ -82,7 +84,7 @@ To install your own build instead: `npm run build && npm pack --pack-destination
 | `jarvy on` | Run in the background (output goes to `<data-dir>/jarvy.log`). Sets up the account first if needed. |
 | `jarvy off` | Stop the background server, waiting up to 30 seconds. |
 
-Options: `--host` (default `127.0.0.1`), `--port` (default `8080`), `--data-dir` (default `~/.jarvy`, or `JARVY_DATA_DIR`). Use the same `--data-dir` for `on` and `off`.
+Options: `--host` (default `127.0.0.1`; any other host also serves HTTPS on the same port), `--port` (default `8080`), `--data-dir` (default `~/.jarvy`, or `JARVY_DATA_DIR`). Use the same `--data-dir` for `on` and `off`.
 
 ## Development
 
@@ -99,9 +101,9 @@ npm run dev:web                   # Vite on 127.0.0.1:5173, proxies /api to 8080
 
 Jarvy is not an internet service.
 
-- It listens on `127.0.0.1` by default. With `--host 0.0.0.0` it serves plain HTTP, so anyone on the network can read passwords, cookies and API keys. Use a trusted network, a VPN or an HTTPS reverse proxy.
-- Credentials are stored in the database without application-level encryption. The data directory is created with mode `0700` and the database with `0600`; do not share the database or its backups.
-- A Bot's workspace is an ordinary folder, not a sandbox. Bots run `bash` with your user's permissions.
+- It listens on `127.0.0.1` by default. With `--host 0.0.0.0` (or any address other devices can reach) it serves HTTPS with a certificate it makes itself, and sends plain HTTP from other machines to HTTPS. Install that certificate once on each device (Settings → Network), or accept the browser's warning once. Plain HTTP from other machines can be allowed there; the page then warns that passwords, API keys and conversations cross the network unencrypted.
+- Model API keys, secrets (Settings → Secrets) and the certificate keys are encrypted with a master key kept outside the data directory, in `~/.config/jarvy/` (mode `0600`). Back that file up together with the data directory: without it they can't be decrypted. Bots that work on your computer run as your user and could read it; sandboxed Bots can't. The data directory is created with mode `0700` and the database with `0600`.
+- A Bot works either in its own sandbox, a Docker container that sees only its workspace and runs with your user and group ids, or on your computer, where it runs `bash` with your user's permissions and reaches everything you can. Being able to use Docker is equivalent to root on this machine.
 
 ## License
 

package/README.zh-CN.md

@@ -34,6 +34,8 @@ Jarvy 在本地运行，只有一个用户。账号、Bot、聊天、文件和
 
 **看着它干活。** 在私信里，Bot 的方块猫会实时演出它正在做的事：思考、读文件、敲键盘、转过来跟你说话。旁边的对话框显示它在想什么、在自言自语什么、发了什么消息，以及调用的每个工具。点开对话框能看到这一轮的每一步。
 
+**每个 Bot 有自己的沙箱。** 装了 Docker，Bot 就可以在只属于它的 Linux 容器里干活，里面有 Node、Python、git、编译工具和带浏览器的 Playwright，缺什么它可以自己装。它的工作区就是它在里面的主目录，重置也不会丢。创建 Bot 时选沙箱还是你的电脑，之后可以在 Bot 信息里改；任务需要时，也可以让沙箱里的 Bot 用你的电脑。
+
 **主 Bot 替你打理 Jarvy。** 第一个 Bot Jarvy 戴着皇冠。告诉它你想做什么，它就帮你组好团队：创建 Bot、写好 Persona、选好模型。之后启停 Bot、查用量、清理不用的东西也找它。它要删除任何东西，都会先弹卡片等你确认。
 
 **未读提醒不打扰。** 只有有人 @ 你或回复你时才显示红色数字；其他消息只在侧栏显示一行预览。任何聊天都能设免打扰。
@@ -54,7 +56,7 @@ Jarvy 在本地运行，只有一个用户。账号、Bot、聊天、文件和
 
 ## 快速开始
 
-需要 Node.js 24（22.19 及以上也可以）。
+需要 Node.js 24（22.19 及以上也可以）。Docker 可选：装了它，Bot 就能在自己的沙箱里干活。沙箱镜像第一次用到时在本机构建，需要几分钟，约 3 GB。
 
 ```sh
 npm install
@@ -82,7 +84,7 @@ jarvy off                         # 停止
 | `jarvy on` | 后台运行，输出写到 `<data-dir>/jarvy.log`；还没设置账号时会先引导设置。 |
 | `jarvy off` | 停止后台服务，最多等待 30 秒。 |
 
-选项：`--host`（默认 `127.0.0.1`）、`--port`（默认 `8080`）、`--data-dir`（默认 `~/.jarvy`，也可以用 `JARVY_DATA_DIR`）。`on` 和 `off` 要用同一个 `--data-dir`。
+选项：`--host`（默认 `127.0.0.1`；用其他地址时同一个端口也提供 HTTPS）、`--port`（默认 `8080`）、`--data-dir`（默认 `~/.jarvy`，也可以用 `JARVY_DATA_DIR`）。`on` 和 `off` 要用同一个 `--data-dir`。
 
 ## 开发
 
@@ -99,9 +101,9 @@ npm run dev:web                   # Vite，127.0.0.1:5173，/api 代理到 8080
 
 Jarvy 不是面向互联网的服务。
 
-- 默认只监听 `127.0.0.1`。用 `--host 0.0.0.0` 时走明文 HTTP，同一网络里的人能看到密码、Cookie 和 API Key。请只在可信网络里使用，或通过 VPN、HTTPS 反向代理访问。
-- 凭据存在数据库里，没有在应用层加密。数据目录权限是 `0700`，数据库文件是 `0600`；不要分享数据库或它的备份。
-- Bot 的工作区就是一个普通文件夹，不是沙箱。Bot 以你的用户权限运行 `bash`。
+- 默认只监听 `127.0.0.1`。用 `--host 0.0.0.0`（或其他设备能访问到的地址）时，Jarvy 用自己生成的证书提供 HTTPS，其他机器的明文 HTTP 请求会跳转到 HTTPS。在每台设备上装一次这个证书（设置 → 网络），或者在浏览器的警告页上继续访问一次。那里也可以允许其他机器用明文 HTTP 访问，这时页面会提示密码、API Key 和对话内容以明文经过网络。
+- 模型 API Key、密钥（设置 → 密钥）和证书私钥都用主密钥加密，主密钥保存在数据目录之外的 `~/.config/jarvy/`（权限 `0600`）。备份时请把它和数据目录一起保留，否则这些内容无法解密。在你的电脑上工作的 Bot 以你的用户运行，能读到它；沙箱里的 Bot 读不到。数据目录权限是 `0700`，数据库文件是 `0600`。
+- Bot 要么在自己的沙箱里干活（一个只看得到它工作区的 Docker 容器，用你的用户和组 ID 运行），要么在你的电脑上，以你的用户权限运行 `bash`，你能碰到的它都能碰到。能使用 Docker 就等于拥有这台机器的 root 权限。
 
 ## 许可证
 

package/THIRD_PARTY_NOTICE.md

@@ -4,6 +4,7 @@
 
 - **shadcn/ui** — `src/web/components/ui/` holds local copies of `badge`, `button`, `card`, `dialog`, `input`, `input-group`, `label`, `scroll-area`, `select` and `textarea` from shadcn/ui (`apps/v4/registry/new-york-v4/ui/`, commit `98a1fe67b439324ddc857f47fbdce056600a4329`), adapted to local imports. © shadcn, MIT; license at `licenses/SHADCN-UI-MIT.txt`.
 - **Bossmode** — `src/web/styles/login.css` adapts the login page layout of Bossmode 0.29.0 (commit `84e742f`, `web/src/styles/login.css`), now on Jarvy's own colours. The attachment preview in `src/web/files/` was reimplemented after Bossmode 0.29.1's file viewer behaviour (static HTML rendering, kinds, navigation). Apache-2.0; license at `licenses/BOSSMODE-APACHE-2.0.txt`.
+- **lobe-icons** — `src/web/provider-logos/` holds provider logos copied from `@lobehub/icons-static-svg` 1.95.1 (the colour version where a brand has one), with their size, inline style and title removed. © 2023 LobeHub, MIT; license at `licenses/LOBE-ICONS-MIT.txt`. The logos are the trademarks of their owners and only name the provider.
 
 Jarvy's design tokens (`src/web/styles/tokens.css`) and the remaining styles are its own. Icons are [Lucide](https://lucide.dev) (ISC, via `lucide-react`).
 
@@ -14,7 +15,7 @@ Jarvy's design tokens (`src/web/styles/tokens.css`) and the remaining styles are
 
 ## Dependencies
 
-- Runtime: `@earendil-works/pi-coding-agent` and `@earendil-works/pi-ai` 0.99.1, `hono` 4.13.11, `@hono/node-server` 2.1.3, `typebox` 1.3.27, `proper-lockfile` 4.1.2, `undici` 8.10.2 — MIT. Jarvy calls Pi's native model, tool, OAuth and refresh APIs rather than copying provider login code.
+- Runtime: `@earendil-works/pi-coding-agent`, `@earendil-works/pi-ai` and `@earendil-works/pi-env` 1.2.0, `hono` 4.13.11, `@hono/node-server` 2.1.3, `typebox` 1.3.27, `proper-lockfile` 4.1.2, `undici` 8.10.2 — MIT. Jarvy calls Pi's native model, tool, OAuth and refresh APIs rather than copying provider login code.
 - Frontend: React, Tailwind CSS, Radix UI, Lucide React, `cn`, class-variance-authority, react-markdown, remark-gfm, remark-breaks, three.js — under their own licenses, shipped with the installed packages.
 - Development only: **Agentation** (`agentation` 3.1.2, © Benji Taylor, PolyForm Shield 1.0.0) is loaded only in Vite development builds and is not part of the production build.