@knowzai/cli 0.1.0 → 0.3.0

package/assets/portable/.env.example

@@ -63,6 +63,9 @@ ADMIN_USERNAME=admin@knowz.local
 ADMIN_PASSWORD=<CHANGE_ME_at_least_12_chars_mixed>
 # SuperAdmin console passphrase. Generate with `openssl rand -base64 32` (or equivalent).
 # SUPERADMIN_PASSPHRASE=
+# Optional override for privileged diagnostics (X-Super-User-Key). When unset, compose
+# reuses SUPERADMIN_PASSPHRASE. Empty/whitespace values are rejected by the API (503).
+# SUPERUSER_KEY=
 # Manual Compose bootstrap (run once after the API is healthy):
 # curl -X POST http://localhost:${API_PORT:-5000}/api/v1/bootstrap/admin \
 #   -H "X-Super-User-Key: $SUPERADMIN_PASSPHRASE" -H "Content-Type: application/json" \

package/assets/portable/docker-compose.yml

@@ -104,6 +104,10 @@ services:
   api:
     # Prebuilt portable image. ""=azure/stub/BYO-OpenAI-compat build; KNOWZ_FLAVOR=-gcp => Vertex build.
     image: "${KNOWZ_REGISTRY:-ghcr.io/knowz-io}/knowz-api:${KNOWZ_VERSION:?KNOWZ_VERSION must be set in .env (the platform release, e.g. 0.2.0)}-portable${KNOWZ_FLAVOR:-}"
+    # Knowz portable images publish linux/amd64 ONLY — pin so arm64 hosts (Apple Silicon)
+    # pull and run under emulation instead of failing with "no matching manifest".
+    # No-op on amd64 hosts. Remove when OPS_PortableMultiArchImages ships arm64 manifests.
+    platform: linux/amd64
     ports:
       - "${BIND_ADDRESS:-127.0.0.1}:${API_PORT:-5000}:8080"
     depends_on:
@@ -122,6 +126,7 @@ services:
     environment:
       ASPNETCORE_ENVIRONMENT: Staging
       ASPNETCORE_URLS: http://+:8080
+      FeatureFlags__registration__requireEmailVerification: "false"
 
       # ── Portable substrate provider switches (the three subsystem axes) ──────────────────────────
       Knowz__Database__Provider: Postgres
@@ -168,6 +173,11 @@ services:
       JwtSettings__Secret: "${JWT_SECRET}"
       Authentication__Jwt__Secret: "${JWT_SECRET}"
       SuperAdmin__Passphrase: "${SUPERADMIN_PASSPHRASE:?SUPERADMIN_PASSPHRASE must be set in .env}"
+      # SEC-2026-08-16-3 / #509: privileged diagnostics use Security:SuperUserKey.
+      # Application code fail-closes empty/whitespace keys (503). Compose still injects a
+      # non-empty value so portable kits that already mint SUPERADMIN_PASSPHRASE keep a
+      # working gate; SUPERUSER_KEY overrides when set.
+      Security__SuperUserKey: "${SUPERUSER_KEY:-${SUPERADMIN_PASSPHRASE}}"
 
       # ── MCP service-to-service key (must match the mcp container) ────────────────────────────────
       MCP__ServiceKey: "${MCP_SERVICE_KEY:?MCP_SERVICE_KEY must be set in .env}"
@@ -260,6 +270,8 @@ services:
   # ── Worker: Knowz.Worker BackgroundService — drains PortableQueueJobs + enrichment auto-driver ─────
   worker:
     image: "${KNOWZ_REGISTRY:-ghcr.io/knowz-io}/knowz-worker:${KNOWZ_VERSION:?KNOWZ_VERSION must be set in .env (the platform release, e.g. 0.2.0)}-portable${KNOWZ_FLAVOR:-}"
+    # amd64-only image — see the `api` service note (OPS_PortableMultiArchImages).
+    platform: linux/amd64
     depends_on:
       postgres:
         condition: service_healthy
@@ -371,6 +383,8 @@ services:
   web:
     # Cloud-neutral SPA — plain versioned image (no portable/gcp flavor).
     image: "${KNOWZ_REGISTRY:-ghcr.io/knowz-io}/knowz-web:${KNOWZ_VERSION:?KNOWZ_VERSION must be set in .env (the platform release, e.g. 0.2.0)}"
+    # amd64-only image — see the `api` service note (OPS_PortableMultiArchImages).
+    platform: linux/amd64
     ports:
       - "${BIND_ADDRESS:-127.0.0.1}:${WEB_PORT:-3000}:8080"
     depends_on:
@@ -393,6 +407,8 @@ services:
     profiles: ["mcp"]
     # Cloud-neutral MCP server — plain versioned image (no portable/gcp flavor).
     image: "${KNOWZ_REGISTRY:-ghcr.io/knowz-io}/knowz-mcp:${KNOWZ_VERSION:?KNOWZ_VERSION must be set in .env (the platform release, e.g. 0.2.0)}"
+    # amd64-only image — see the `api` service note (OPS_PortableMultiArchImages).
+    platform: linux/amd64
     ports:
       - "${BIND_ADDRESS:-127.0.0.1}:${MCP_PORT:-3001}:8080"
     depends_on:
@@ -418,6 +434,8 @@ services:
 
   public-site:
     image: "${KNOWZ_REGISTRY:-ghcr.io/knowz-io}/knowz-public-site:${KNOWZ_VERSION:?KNOWZ_VERSION must be set in .env}"
+    # amd64-only image — see the `api` service note (OPS_PortableMultiArchImages).
+    platform: linux/amd64
     profiles: ["public-site"]
     ports:
       - "${BIND_ADDRESS:-127.0.0.1}:${PUBLIC_SITE_PORT:-3002}:8080"

package/assets/portable/releases.json

@@ -1,5 +1,27 @@
 {
   "releases": [
+    {
+      "version": "0.41.0",
+      "flavors": [
+        "portable",
+        "portable-gcp"
+      ],
+      "releasedAt": "2026-08-31T00:00:00Z",
+      "minCliVersion": null,
+      "notes": null,
+      "digests": null
+    },
+    {
+      "version": "0.40.2",
+      "flavors": [
+        "portable",
+        "portable-gcp"
+      ],
+      "releasedAt": "2026-08-30T00:00:00Z",
+      "minCliVersion": null,
+      "notes": null,
+      "digests": null
+    },
     {
       "version": "0.35.2",
       "flavors": [

package/assets/selfhosted/.env.example

@@ -0,0 +1,19 @@
+# Knowz Self-Hosted pull kit — copied by `knowz up` into ~/.knowz/selfhosted/{name}/.env
+# The CLI mints required secrets on first up. Do not bake passwords into images.
+
+KNOWZ_SELFHOSTED_VERSION=0.15.1
+API_PORT=5000
+WEB_PORT=3000
+MCP_PORT=3001
+DB_PORT=1433
+
+SA_PASSWORD=
+JWT_SECRET=
+ADMIN_USERNAME=admin
+ADMIN_PASSWORD=
+MCP_SERVICE_KEY=
+
+# Optional: AI via Knowz mothership (operator-supplied; never baked)
+# KNOWZ_PLATFORM_ENABLED=true
+# KNOWZ_PLATFORM_URL=https://api.knowz.io
+# KNOWZ_PLATFORM_APIKEY=

package/assets/selfhosted/docker-compose.yml

@@ -0,0 +1,96 @@
+# Knowz Self-Hosted — pull-only kit for `knowz up` (public images).
+# Canonical source: this file. The npm CLI copies it via sync-selfhosted-assets.mjs.
+# Source-build remains selfhosted/docker-compose.yml (build: contexts).
+#
+# FAIL-CLOSED: SA_PASSWORD, JWT_SECRET, ADMIN_USERNAME, ADMIN_PASSWORD, MCP_SERVICE_KEY
+# have no defaults. The CLI mints them into a 0600 .env on first up.
+# Pin KNOWZ_SELFHOSTED_VERSION to a concrete semver — never `latest`.
+
+services:
+  db:
+    image: mcr.microsoft.com/mssql/server:2022-CU26-ubuntu-22.04
+    environment:
+      ACCEPT_EULA: "Y"
+      MSSQL_SA_PASSWORD: "${SA_PASSWORD:?SA_PASSWORD must be set in .env (>=12 chars, SQL Server complexity rules)}"
+      MSSQL_PID: "Express"
+    ports:
+      - "${DB_PORT:-1433}:1433"
+    volumes:
+      - knowz-db-data:/var/opt/mssql
+    healthcheck:
+      test: /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$${MSSQL_SA_PASSWORD}" -Q "SELECT 1" -C -b
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+
+  api:
+    image: ghcr.io/knowz-io/knowz-selfhosted-api:${KNOWZ_SELFHOSTED_VERSION:?KNOWZ_SELFHOSTED_VERSION must be set}
+    ports:
+      - "${API_PORT:-5000}:8080"
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      ConnectionStrings__McpDb: "Server=db,1433;Database=KnowzSelfHosted;User Id=sa;Password=${SA_PASSWORD:?SA_PASSWORD must be set};TrustServerCertificate=True;Encrypt=True"
+      Database__AutoMigrate: "true"
+      SelfHosted__JwtSecret: "${JWT_SECRET:?JWT_SECRET must be set in .env (>=32 chars)}"
+      SelfHosted__SuperAdminUsername: "${ADMIN_USERNAME:?ADMIN_USERNAME must be set in .env}"
+      SelfHosted__SuperAdminPassword: "${ADMIN_PASSWORD:?ADMIN_PASSWORD must be set in .env}"
+      SelfHosted__AllowedOrigins__0: "http://localhost:${WEB_PORT:-3000}"
+      SelfHosted__RateLimiting__Enabled: "true"
+      MCP__ServiceKey: "${MCP_SERVICE_KEY:?MCP_SERVICE_KEY must be set in .env}"
+      Storage__Provider: "LocalFileSystem"
+      Storage__Local__RootPath: "/data/files"
+      AzureOpenAI__Endpoint: "${AZURE_OPENAI_ENDPOINT:-}"
+      AzureOpenAI__ApiKey: "${AZURE_OPENAI_APIKEY:-}"
+      AzureOpenAI__DeploymentName: "${AZURE_OPENAI_DEPLOYMENT:-gpt-5.4}"
+      AzureOpenAI__EmbeddingDeploymentName: "${AZURE_OPENAI_EMBEDDING:-text-embedding-3-large}"
+      Embedding__ModelName: "${EMBEDDING_MODEL_NAME:-text-embedding-3-large}"
+      Embedding__Dimensions: "${EMBEDDING_DIMENSIONS:-3072}"
+      AzureAISearch__Endpoint: "${AZURE_SEARCH_ENDPOINT:-}"
+      AzureAISearch__ApiKey: "${AZURE_SEARCH_APIKEY:-}"
+      AzureAISearch__IndexName: "${AZURE_SEARCH_INDEX:-knowz-selfhosted}"
+      KnowzPlatform__Enabled: "${KNOWZ_PLATFORM_ENABLED:-false}"
+      KnowzPlatform__BaseUrl: "${KNOWZ_PLATFORM_URL:-}"
+      KnowzPlatform__ApiKey: "${KNOWZ_PLATFORM_APIKEY:-}"
+    volumes:
+      - knowz-file-storage:/data/files
+    healthcheck:
+      test: curl -f http://localhost:8080/healthz || exit 1
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 30s
+
+  web:
+    image: ghcr.io/knowz-io/knowz-selfhosted-web:${KNOWZ_SELFHOSTED_VERSION:?KNOWZ_SELFHOSTED_VERSION must be set}
+    ports:
+      - "${WEB_PORT:-3000}:8080"
+    depends_on:
+      api:
+        condition: service_started
+
+  mcp:
+    image: ghcr.io/knowz-io/knowz-selfhosted-mcp:${KNOWZ_SELFHOSTED_VERSION:?KNOWZ_SELFHOSTED_VERSION must be set}
+    ports:
+      - "${MCP_PORT:-3001}:8080"
+    depends_on:
+      api:
+        condition: service_healthy
+    environment:
+      Knowz__BaseUrl: "${MCP_API_URL:-http://api:8080}"
+      MCP__BackendMode: "${MCP_BACKEND_MODE:-selfhosted}"
+      MCP__ApiKeyValidationEndpoint: "${MCP_API_KEY_VALIDATION_ENDPOINT:-/api/vaults}"
+      MCP__ServiceKey: "${MCP_SERVICE_KEY:?MCP_SERVICE_KEY must be set in .env}"
+      Authentication__ValidateApiKey: "${MCP_VALIDATE_API_KEY:-true}"
+    healthcheck:
+      test: curl -f http://localhost:8080/.well-known/oauth-authorization-server || exit 1
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 15s
+
+volumes:
+  knowz-db-data:
+  knowz-file-storage:

package/assets/selfhosted/releases.json

@@ -0,0 +1,28 @@
+{
+  "releases": [
+    {
+      "version": "0.15.1",
+      "flavors": ["selfhosted"],
+      "releasedAt": "2026-09-01T12:49:00Z",
+      "minCliVersion": null,
+      "notes": "User-role mothership connect/browse/pull. Anonymous GHCR triple.",
+      "digests": null
+    },
+    {
+      "version": "0.15.0",
+      "flavors": ["selfhosted"],
+      "releasedAt": "2026-09-01T12:15:00Z",
+      "minCliVersion": null,
+      "notes": "Look/feel restyle, session decrypt, fail-closed compose, vite-only web image. First complete public GHCR triple since the split 0.14.x tags.",
+      "digests": null
+    },
+    {
+      "version": "0.14.11",
+      "flavors": ["selfhosted"],
+      "releasedAt": "2026-05-28T00:00:00Z",
+      "minCliVersion": null,
+      "notes": "Incomplete GHCR set: api:0.14.11 exists; web/mcp 0.14.11 404 (web/mcp last published at 0.14.10). Do not pin.",
+      "digests": null
+    }
+  ]
+}