@goodfish/jarvy 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -2,6 +2,59 @@
 
 All notable changes to Jarvy. Versions follow [semantic versioning](https://semver.org/) as used before 1.0: a patch release only fixes bugs; a minor release adds features or upgrades the database.
 
+## 0.8.0 — 2026-10-22
+
+Upgrading moves the database from schema v21 to v23 on first start: the environments table is rebuilt to hold SSH machines, with their sealed keys and host keys (v22), and scheduled tasks get a table of their own while the inbox table is rebuilt with all its rows (v23). A v23 database cannot be opened by 0.7.0; keep a copy if you may need to go back.
+
+### Added
+
+- **SSH machines.** Settings › Environments adds a machine reached over SSH: its address, user and an optional start directory. Jarvy first shows the machine's host key fingerprints to check, then you type its password once. Jarvy makes a key for that machine, installs it in `~/.ssh/authorized_keys` and keeps it sealed under the master key; the password is not kept. In Bot info you turn on which Bots may use a machine. A Bot switches there like `cd` when a task needs it, and each batch says where it is. When a Bot needs a machine it doesn't have, it asks on a card in the chat; you check the fingerprints and type the password there. Deleting a machine takes its key back off the machine first. Jarvy checks host keys against its own list and does not read your `~/.ssh/config`. Linux and macOS machines are supported. (A57)
+- **Scheduled tasks.** A Bot can be given work to do later: once at a time, every N minutes (counted from when the task is made), daily or weekly at a time, in this machine's local time. A task has a name, what to do and when. You make, pause, change and delete them in Bot info › Scheduled tasks, and a Bot manages its own with the tasks tools. When a task is due, the Bot gets its instruction in a batch; it never interrupts a turn, and reports to you unless the task says where. Runs missed while Jarvy was not running are skipped, not made up. (A58)
+- **An All range in Bot usage**, beside the shorter ranges.
+- **SHA-1 fingerprint in Settings › Network**, under SHA-256: it is the Thumbprint that Windows' certificate window shows. The install steps end with a reminder to quit the browser completely and open it again.
+
+### Changed
+
+- **A changed system prompt is told, not swapped in.** When you change a Bot's persona, name, description, skills or workspace, its running session keeps the prompt the model already has, so the provider's cache of the conversation survives. The change comes with the next batch, once, as a short diff of what changed; the new prompt is taken up when a session starts, after a model switch and after a compaction. (A56)
+- **Chat gateway errors say how to fix the call.** Invalid arguments list what is wrong and include the tool's parameters; an unknown tool name lists the tools there are. A Bot gets a call right on the next try instead of looking the tool up first.
+- **Bot-facing text calls the platform "this chat platform"**, so a Bot doesn't confuse it with the agent Bot, which is named Jarvy by default. The agent Bot is still told the platform's name.
+- **Secrets cover tokens, API keys and passwords**; logging in to a machine goes through the SSH machine card instead.
+- **Composer**: a sent message leaves the input at once, and comes back if sending fails.
+- **Thinking bubble**: keeps following the newest words unless you scroll it up.
+
+### Fixed
+
+- A model connection can be deleted once the Bots that used it are deleted. This also clears links that Bots deleted before the upgrade kept. While a Bot still uses a connection, the refusal names it.
+
+### Known limits
+
+- On an SSH machine, `write` and `edit` fail for a path that exists on the machine running Jarvy but that Jarvy's user can't read there, such as a protected directory on the same computer. `bash` still works there. This is a limit in Pi, the agent library Jarvy uses, and is waiting on an upstream fix.
+- SSH machines run Bots' commands as the user you gave; there is no sandbox on them.
+
+## 0.7.0 — 2026-10-21
+
+Upgrading moves the database from schema v20 to v21 on first start: secrets, their grants and their uses are added, and the credentials you have already saved are encrypted under a new master key. Keep the master key file if you may need to go back, and keep a copy of the database too: a v21 database cannot be opened by 0.6.0.
+
+### Added
+
+- **HTTPS beyond this machine.** Jarvy can now be reached at `https://` from other devices on your network, with a certificate it makes for itself. One port serves both HTTPS and plain HTTP, and plain HTTP from another machine is redirected to HTTPS. Settings › Network has a switch for LAN access, the addresses to use, and, while it is off, says that Jarvy is open to this computer only. A browser shows a warning once, until you trust Jarvy's certificate; Settings has the steps for each system. From this machine nothing changes, and `localhost` keeps working as a secure context. (A51)
+- **Secrets.** A Bot can use a token, password or key without the value passing through the chat. Settings › Secrets holds them, encrypted under a master key that lives outside your data directory, and you choose which Bots may use each one, always or for one run. In a command a Bot writes a placeholder such as `{{secret:GITHUB_TOKEN}}`, filled in for that command only; values are masked in everything the model sees. When a Bot needs one it does not have, it asks on a card: it names the secret and its purpose, you paste the value or decline, and the card asks how long the grant lasts. A use log shows what was used, by which Bot, where and when. The credentials you saved for model connections are sealed under the same key. (A52)
+- **Skills for the agent Bot.** Jarvy now ships skills: guides for a kind of work, which the agent Bot follows when the work calls for it. The first is `dev-team`, on running software development with a team of Bots: forming the team, splitting roles, organizing channels, using threads, keeping channel notices, and a development flow from a request to a release. The agent Bot's prompt lists each skill; the text is read only when it is needed, and plans built from it go to you to confirm. (A55)
+- **Provider logos.** In Settings › Models the provider picker shows each brand's logo instead of its initial. The icons come from LobeHub's lobe-icons (MIT), with the notice in `THIRD_PARTY_NOTICE.md`.
+
+### Changed
+
+- **Bot info's context usage is what the model reported**, not an estimate. Until a Bot's first reply it is unknown, and after a compaction it is unknown again until the model reports; when a request fails and Pi drops it from the context, the figure from the last successful reply stays, with a warning that says why. (A54)
+- **Bots are told about unread messages.** When a Bot sends a message or asks a question, the result tells it how many messages in that chat it had not read, and how to read them, so it can catch up before it acts. (A53)
+- **Question cards are one panel.** A question and a secret request are drawn the same way: a framed panel under the Bot's message, with the options, the custom answer and the buttons; a settled card folds to one line. A card that is no longer waiting for an answer reads as ignored rather than expired.
+- **Interface text**, in both languages: errors say what happened and what to do, settings describe what each option does, and wording is consistent across screens.
+
+### Known limits
+
+- The master key sits in a file in Jarvy's configuration directory, readable by your user; anything that can read your files can read it.
+- A secret is granted to a Bot, not to a particular run of work.
+- Skills belong to the agent Bot alone, cannot be added by you yet, and are written again each time it starts, so changes to those files do not last.
+
 ## 0.6.0 — 2026-10-19
 
 Upgrading moves the database from schema v19 to v20 on first start: environments and their grants are added, and each Bot gains its default and current environment. Existing Bots keep working on your computer. A v20 database cannot be opened by 0.5.0; keep a copy if you may need to go back.

package/README.md

@@ -84,7 +84,7 @@ To install your own build instead: `npm run build && npm pack --pack-destination
 | `jarvy on` | Run in the background (output goes to `<data-dir>/jarvy.log`). Sets up the account first if needed. |
 | `jarvy off` | Stop the background server, waiting up to 30 seconds. |
 
-Options: `--host` (default `127.0.0.1`), `--port` (default `8080`), `--data-dir` (default `~/.jarvy`, or `JARVY_DATA_DIR`). Use the same `--data-dir` for `on` and `off`.
+Options: `--host` (default `127.0.0.1`; any other host also serves HTTPS on the same port), `--port` (default `8080`), `--data-dir` (default `~/.jarvy`, or `JARVY_DATA_DIR`). Use the same `--data-dir` for `on` and `off`.
 
 ## Development
 
@@ -101,8 +101,8 @@ npm run dev:web                   # Vite on 127.0.0.1:5173, proxies /api to 8080
 
 Jarvy is not an internet service.
 
-- It listens on `127.0.0.1` by default. With `--host 0.0.0.0` it serves plain HTTP, so anyone on the network can read passwords, cookies and API keys. Use a trusted network, a VPN or an HTTPS reverse proxy.
-- Credentials are stored in the database without application-level encryption. The data directory is created with mode `0700` and the database with `0600`; do not share the database or its backups.
+- It listens on `127.0.0.1` by default. With `--host 0.0.0.0` (or any address other devices can reach) it serves HTTPS with a certificate it makes itself, and sends plain HTTP from other machines to HTTPS. Install that certificate once on each device (Settings → Network), or accept the browser's warning once. Plain HTTP from other machines can be allowed there; the page then warns that passwords, API keys and conversations cross the network unencrypted.
+- Model API keys, secrets (Settings → Secrets) and the certificate keys are encrypted with a master key kept outside the data directory, in `~/.config/jarvy/` (mode `0600`). Back that file up together with the data directory: without it they can't be decrypted. Bots that work on your computer run as your user and could read it; sandboxed Bots can't. The data directory is created with mode `0700` and the database with `0600`.
 - A Bot works either in its own sandbox, a Docker container that sees only its workspace and runs with your user and group ids, or on your computer, where it runs `bash` with your user's permissions and reaches everything you can. Being able to use Docker is equivalent to root on this machine.
 
 ## License

package/README.zh-CN.md

@@ -84,7 +84,7 @@ jarvy off                         # 停止
 | `jarvy on` | 后台运行，输出写到 `<data-dir>/jarvy.log`；还没设置账号时会先引导设置。 |
 | `jarvy off` | 停止后台服务，最多等待 30 秒。 |
 
-选项：`--host`（默认 `127.0.0.1`）、`--port`（默认 `8080`）、`--data-dir`（默认 `~/.jarvy`，也可以用 `JARVY_DATA_DIR`）。`on` 和 `off` 要用同一个 `--data-dir`。
+选项：`--host`（默认 `127.0.0.1`；用其他地址时同一个端口也提供 HTTPS）、`--port`（默认 `8080`）、`--data-dir`（默认 `~/.jarvy`，也可以用 `JARVY_DATA_DIR`）。`on` 和 `off` 要用同一个 `--data-dir`。
 
 ## 开发
 
@@ -101,8 +101,8 @@ npm run dev:web                   # Vite，127.0.0.1:5173，/api 代理到 8080
 
 Jarvy 不是面向互联网的服务。
 
-- 默认只监听 `127.0.0.1`。用 `--host 0.0.0.0` 时走明文 HTTP，同一网络里的人能看到密码、Cookie 和 API Key。请只在可信网络里使用，或通过 VPN、HTTPS 反向代理访问。
-- 凭据存在数据库里，没有在应用层加密。数据目录权限是 `0700`，数据库文件是 `0600`；不要分享数据库或它的备份。
+- 默认只监听 `127.0.0.1`。用 `--host 0.0.0.0`（或其他设备能访问到的地址）时，Jarvy 用自己生成的证书提供 HTTPS，其他机器的明文 HTTP 请求会跳转到 HTTPS。在每台设备上装一次这个证书（设置 → 网络），或者在浏览器的警告页上继续访问一次。那里也可以允许其他机器用明文 HTTP 访问，这时页面会提示密码、API Key 和对话内容以明文经过网络。
+- 模型 API Key、密钥（设置 → 密钥）和证书私钥都用主密钥加密，主密钥保存在数据目录之外的 `~/.config/jarvy/`（权限 `0600`）。备份时请把它和数据目录一起保留，否则这些内容无法解密。在你的电脑上工作的 Bot 以你的用户运行，能读到它；沙箱里的 Bot 读不到。数据目录权限是 `0700`，数据库文件是 `0600`。
 - Bot 要么在自己的沙箱里干活（一个只看得到它工作区的 Docker 容器，用你的用户和组 ID 运行），要么在你的电脑上，以你的用户权限运行 `bash`，你能碰到的它都能碰到。能使用 Docker 就等于拥有这台机器的 root 权限。
 
 ## 许可证

package/THIRD_PARTY_NOTICE.md

@@ -4,6 +4,7 @@
 
 - **shadcn/ui** — `src/web/components/ui/` holds local copies of `badge`, `button`, `card`, `dialog`, `input`, `input-group`, `label`, `scroll-area`, `select` and `textarea` from shadcn/ui (`apps/v4/registry/new-york-v4/ui/`, commit `98a1fe67b439324ddc857f47fbdce056600a4329`), adapted to local imports. © shadcn, MIT; license at `licenses/SHADCN-UI-MIT.txt`.
 - **Bossmode** — `src/web/styles/login.css` adapts the login page layout of Bossmode 0.29.0 (commit `84e742f`, `web/src/styles/login.css`), now on Jarvy's own colours. The attachment preview in `src/web/files/` was reimplemented after Bossmode 0.29.1's file viewer behaviour (static HTML rendering, kinds, navigation). Apache-2.0; license at `licenses/BOSSMODE-APACHE-2.0.txt`.
+- **lobe-icons** — `src/web/provider-logos/` holds provider logos copied from `@lobehub/icons-static-svg` 1.95.1 (the colour version where a brand has one), with their size, inline style and title removed. © 2023 LobeHub, MIT; license at `licenses/LOBE-ICONS-MIT.txt`. The logos are the trademarks of their owners and only name the provider.
 
 Jarvy's design tokens (`src/web/styles/tokens.css`) and the remaining styles are its own. Icons are [Lucide](https://lucide.dev) (ISC, via `lucide-react`).