@knowzai/cli 0.3.0 → 0.5.0

package/README.md

@@ -0,0 +1,68 @@
+# Knowz CLI
+
+Connect to Knowz endpoints, work with knowledge from your terminal, or start your
+own lightweight, open-source Knowz installation with guided browser setup.
+
+## Install
+
+This 0.5.0 candidate is distributed on the preview channel. Requires **Node.js 22
+or newer**:
+
+```sh
+npm install -g @knowzai/cli@0.5.0
+knowz --version
+```
+
+Native packages bundle Node and are available through the
+[public CLI releases](https://github.com/knowz-io/knowz-cli/releases).
+Check each release's operating-system support, checksum and signing status.
+
+## Start selfhosted
+
+Start a local Docker engine with Compose, then run:
+
+```sh
+knowz up
+```
+
+The browser guides you through configuration and first sign-in. Selfhosted uses
+public images and requires no Knowz license or GitHub login. Replace the temporary
+administrator password and finish connecting the CLI when prompted. Without an AI
+provider, you can still store and browse knowledge; AI answers require a configured
+provider. Saved provider changes take effect after the indicated restart.
+
+```sh
+knowz runtime status
+knowz down
+knowz up
+knowz backup --encrypt --out ./knowz-backup.enc
+```
+
+Stopping preserves your data. Store backups and their passphrases separately.
+Use `knowz restore --help` for checked recovery into a stopped installation.
+
+## Connect to an endpoint
+
+Use `knowz login` for the hosted platform. Named profiles keep endpoint credentials
+separate. For an existing selfhosted endpoint:
+
+```sh
+knowz login --self-hosted --api-url https://knowz.example.com --profile my-knowz
+knowz vault list --profile my-knowz
+knowz search "project notes" --profile my-knowz
+```
+
+Run `knowz --help` and `knowz <command> --help` for knowledge creation, attachments,
+chat, local indexing, encryption, synchronization and runtime management.
+
+## Editions and source
+
+[Knowz Selfhosted](https://github.com/knowz-io/knowz-selfhosted-source) is the
+Apache-2.0 open-source edition. The proprietary portable platform is a separate
+contracted offering selected explicitly with `--edition portable`. New proprietary
+downloads and updates require a valid installation grant; a SaaS subscription or
+registry login alone is insufficient. Public selfhosted setup remains independent.
+
+The [released CLI skills](https://github.com/knowz-io/knowz-cli/releases) include
+matching command inventories for agents. Use the skill for your installed CLI
+version.

package/assets/portable/releases.json

@@ -1,5 +1,47 @@
 {
   "releases": [
+    {
+      "version": "0.44.1",
+      "flavors": [
+        "portable",
+        "portable-gcp"
+      ],
+      "releasedAt": "2026-09-04T05:26:59Z",
+      "minCliVersion": "0.3.0",
+      "notes": "Interview Studio v1, guest answer flow, honest knowledge dates. Supersedes v0.44.0 (web image build failed). Commercial grant required for portable pull. Exact seven-component manifest bodies and linux/amd64 availability verified on2026-09-07; anonymous GHCR artifact access denied.",
+      "digests": {
+        "api": "sha256:625603c64ddfe8ab411fd6ce314fbc1f4881e6ea7018c68dab6bdf5996c8d2cb",
+        "api-gcp": "sha256:190afad819f6978ca6301b84e316a038e7b1ba835e5197bfbd72ef5bf77b3041",
+        "worker": "sha256:8210c4ba98281202cbec9a0bce91bc8c13a1079c87be677ab3d60bd4539998c0",
+        "worker-gcp": "sha256:2cdecd0dd4efd70a0a89865dffed31684e172eedd194acaa333239d4f657ca8e",
+        "web": "sha256:382efff53f60bbf073c18eb1eec63c6af62cea2f42c5a74d1b81ec36a8c5c048",
+        "mcp": "sha256:7c9e2f5d6f613b77d7b32d5a75f3e613f12cfc36b5c27ed3608435396ca43f5b",
+        "public-site": "sha256:f2eee97faa8c41b9505d80c42ee8d5180bbdd65ddfedfa33af4ad79fac194fea"
+      },
+      "status": "complete"
+    },
+    {
+      "version": "0.43.0",
+      "flavors": [
+        "portable",
+        "portable-gcp"
+      ],
+      "releasedAt": "2026-09-02T00:00:00Z",
+      "minCliVersion": "0.3.0",
+      "notes": "Commercial grant required for portable pull. Registration alone does not entitle image pulls.",
+      "digests": null
+    },
+    {
+      "version": "0.42.0",
+      "flavors": [
+        "portable",
+        "portable-gcp"
+      ],
+      "releasedAt": "2026-09-02T00:00:00Z",
+      "minCliVersion": "0.3.0",
+      "notes": "Commercial grant required for portable pull. Registration alone does not entitle image pulls.",
+      "digests": null
+    },
     {
       "version": "0.41.0",
       "flavors": [

package/assets/selfhosted/.env.example

@@ -5,14 +5,35 @@ KNOWZ_SELFHOSTED_VERSION=0.15.1
 API_PORT=5000
 WEB_PORT=3000
 MCP_PORT=3001
-DB_PORT=1433
+# Database host port (loopback only). `knowz up` derives API_PORT+10432 so a local Postgres or a
+# second instance never collides; set it explicitly for hand-written .env files.
+DB_PORT=5432
 
+POSTGRES_PASSWORD=
 SA_PASSWORD=
 JWT_SECRET=
 ADMIN_USERNAME=admin
 ADMIN_PASSWORD=
+# The CLI sets true only for a freshly generated first-boot password.
+ADMIN_PASSWORD_REQUIRES_CHANGE=false
 MCP_SERVICE_KEY=
 
+# Optional: native OpenAI-compatible AI (LM Studio / Ollama / vLLM / OpenAI)
+# For a model server on this host, the CLI rewrites localhost to host.docker.internal.
+# OPENAI_COMPAT_ENDPOINT=http://host.docker.internal:1234/v1
+# OPENAI_COMPAT_APIKEY=
+# OPENAI_COMPAT_CHAT_MODEL=your-chat-model
+# OPENAI_COMPAT_EMBEDDING_MODEL=your-embedding-model
+# EMBEDDING_DIMENSIONS=768
+
+# SQL-era public releases use an internal compatibility adapter automatically.
+# These are derived by the CLI from the OpenAI-compatible values above; users
+# do not need Azure credentials.
+# AZURE_OPENAI_ENDPOINT=http://lmstudio-bridge:12345
+# AZURE_OPENAI_APIKEY=local-compatible-adapter
+# AZURE_OPENAI_DEPLOYMENT=your-chat-model
+# AZURE_OPENAI_EMBEDDING=your-embedding-model
+
 # Optional: AI via Knowz mothership (operator-supplied; never baked)
 # KNOWZ_PLATFORM_ENABLED=true
 # KNOWZ_PLATFORM_URL=https://api.knowz.io

package/assets/selfhosted/docker-compose.mssql.yml

@@ -0,0 +1,113 @@
+# Knowz Self-Hosted — compatibility kit for SQL-era public releases.
+# Selected automatically from releases.json; do not use for native Postgres images.
+# The optional local adapter lets legacy Azure-shaped APIs consume the provider
+# already tested as OpenAI-compatible by the guided setup UI.
+
+services:
+  lmstudio-bridge:
+    image: node:20-alpine
+    command: ["node", "/app/lmstudio-azure-bridge.mjs"]
+    environment:
+      OPENAI_COMPAT_ENDPOINT: "${OPENAI_COMPAT_ENDPOINT:-http://host.docker.internal:1234/v1}"
+      OPENAI_COMPAT_APIKEY: "${OPENAI_COMPAT_APIKEY:-}"
+      PORT: "12345"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    volumes:
+      - ./lmstudio-azure-bridge.mjs:/app/lmstudio-azure-bridge.mjs:ro
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:12345/healthz"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  db:
+    image: mcr.microsoft.com/mssql/server:2022-CU26-ubuntu-22.04
+    environment:
+      ACCEPT_EULA: "Y"
+      MSSQL_SA_PASSWORD: "${SA_PASSWORD:?SA_PASSWORD must be set in .env (>=12 chars, SQL Server complexity rules)}"
+      MSSQL_PID: "Express"
+    ports:
+      - "127.0.0.1:${DB_PORT:-1433}:1433"
+    volumes:
+      - knowz-db-data:/var/opt/mssql
+    healthcheck:
+      test: /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$${MSSQL_SA_PASSWORD}" -Q "SELECT 1" -C -b
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+
+  api:
+    image: ghcr.io/knowz-io/knowz-selfhosted-api:${KNOWZ_SELFHOSTED_VERSION:?KNOWZ_SELFHOSTED_VERSION must be set}
+    ports:
+      - "${API_PORT:-5000}:8080"
+    depends_on:
+      db:
+        condition: service_healthy
+      lmstudio-bridge:
+        condition: service_healthy
+    environment:
+      ConnectionStrings__McpDb: "Server=db,1433;Database=KnowzSelfHosted;User Id=sa;Password=${SA_PASSWORD:?SA_PASSWORD must be set};TrustServerCertificate=True;Encrypt=True"
+      Database__AutoMigrate: "true"
+      SelfHosted__JwtSecret: "${JWT_SECRET:?JWT_SECRET must be set in .env (>=32 chars)}"
+      SelfHosted__SuperAdminUsername: "${ADMIN_USERNAME:?ADMIN_USERNAME must be set in .env}"
+      SelfHosted__SuperAdminPassword: "${ADMIN_PASSWORD:?ADMIN_PASSWORD must be set in .env}"
+      SelfHosted__RequireSuperAdminPasswordChange: "${ADMIN_PASSWORD_REQUIRES_CHANGE:-false}"
+      SelfHosted__AllowedOrigins__0: "http://localhost:${WEB_PORT:-3000}"
+      SelfHosted__RateLimiting__Enabled: "true"
+      MCP__ServiceKey: "${MCP_SERVICE_KEY:?MCP_SERVICE_KEY must be set in .env}"
+      Storage__Provider: "LocalFileSystem"
+      Storage__Local__RootPath: "/data/files"
+      AzureOpenAI__Endpoint: "${AZURE_OPENAI_ENDPOINT:-}"
+      AzureOpenAI__ApiKey: "${AZURE_OPENAI_APIKEY:-}"
+      AzureOpenAI__DeploymentName: "${AZURE_OPENAI_DEPLOYMENT:-gpt-5.4}"
+      AzureOpenAI__EmbeddingDeploymentName: "${AZURE_OPENAI_EMBEDDING:-text-embedding-3-large}"
+      Embedding__ModelName: "${EMBEDDING_MODEL_NAME:-text-embedding-3-large}"
+      Embedding__Dimensions: "${EMBEDDING_DIMENSIONS:-3072}"
+      AzureAISearch__Endpoint: "${AZURE_SEARCH_ENDPOINT:-}"
+      AzureAISearch__ApiKey: "${AZURE_SEARCH_APIKEY:-}"
+      AzureAISearch__IndexName: "${AZURE_SEARCH_INDEX:-knowz-selfhosted}"
+      KnowzPlatform__Enabled: "${KNOWZ_PLATFORM_ENABLED:-false}"
+      KnowzPlatform__BaseUrl: "${KNOWZ_PLATFORM_URL:-}"
+      KnowzPlatform__ApiKey: "${KNOWZ_PLATFORM_APIKEY:-}"
+    volumes:
+      - knowz-file-storage:/data/files
+    healthcheck:
+      test: curl -f http://localhost:8080/healthz || exit 1
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 30s
+
+  web:
+    image: ghcr.io/knowz-io/knowz-selfhosted-web:${KNOWZ_SELFHOSTED_VERSION:?KNOWZ_SELFHOSTED_VERSION must be set}
+    ports:
+      - "${WEB_PORT:-3000}:8080"
+    depends_on:
+      api:
+        condition: service_started
+
+  mcp:
+    image: ghcr.io/knowz-io/knowz-selfhosted-mcp:${KNOWZ_SELFHOSTED_VERSION:?KNOWZ_SELFHOSTED_VERSION must be set}
+    ports:
+      - "${MCP_PORT:-3001}:8080"
+    depends_on:
+      api:
+        condition: service_healthy
+    environment:
+      Knowz__BaseUrl: "${MCP_API_URL:-http://api:8080}"
+      MCP__BackendMode: "${MCP_BACKEND_MODE:-selfhosted}"
+      MCP__ApiKeyValidationEndpoint: "${MCP_API_KEY_VALIDATION_ENDPOINT:-/api/vaults}"
+      MCP__ServiceKey: "${MCP_SERVICE_KEY:?MCP_SERVICE_KEY must be set in .env}"
+      Authentication__ValidateApiKey: "${MCP_VALIDATE_API_KEY:-true}"
+    healthcheck:
+      test: curl -f http://localhost:8080/.well-known/oauth-authorization-server || exit 1
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 15s
+
+volumes:
+  knowz-db-data:
+  knowz-file-storage:

package/assets/selfhosted/docker-compose.yml

@@ -2,27 +2,25 @@
 # Canonical source: this file. The npm CLI copies it via sync-selfhosted-assets.mjs.
 # Source-build remains selfhosted/docker-compose.yml (build: contexts).
 #
-# FAIL-CLOSED: SA_PASSWORD, JWT_SECRET, ADMIN_USERNAME, ADMIN_PASSWORD, MCP_SERVICE_KEY
+# FAIL-CLOSED: POSTGRES_PASSWORD, JWT_SECRET, ADMIN_USERNAME, ADMIN_PASSWORD, MCP_SERVICE_KEY
 # have no defaults. The CLI mints them into a 0600 .env on first up.
 # Pin KNOWZ_SELFHOSTED_VERSION to a concrete semver — never `latest`.
 
 services:
   db:
-    image: mcr.microsoft.com/mssql/server:2022-CU26-ubuntu-22.04
+    image: pgvector/pgvector:pg16
     environment:
-      ACCEPT_EULA: "Y"
-      MSSQL_SA_PASSWORD: "${SA_PASSWORD:?SA_PASSWORD must be set in .env (>=12 chars, SQL Server complexity rules)}"
-      MSSQL_PID: "Express"
-    ports:
-      - "${DB_PORT:-1433}:1433"
+      POSTGRES_USER: knowz
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in .env}"
+      POSTGRES_DB: knowz_selfhosted
     volumes:
-      - knowz-db-data:/var/opt/mssql
+      - knowz-db-data:/var/lib/postgresql/data
     healthcheck:
-      test: /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$${MSSQL_SA_PASSWORD}" -Q "SELECT 1" -C -b
-      interval: 10s
+      test: ["CMD-SHELL", "pg_isready -U knowz -d knowz_selfhosted"]
+      interval: 5s
       timeout: 5s
       retries: 10
-      start_period: 30s
+      start_period: 10s
 
   api:
     image: ghcr.io/knowz-io/knowz-selfhosted-api:${KNOWZ_SELFHOSTED_VERSION:?KNOWZ_SELFHOSTED_VERSION must be set}
@@ -32,22 +30,32 @@ services:
       db:
         condition: service_healthy
     environment:
-      ConnectionStrings__McpDb: "Server=db,1433;Database=KnowzSelfHosted;User Id=sa;Password=${SA_PASSWORD:?SA_PASSWORD must be set};TrustServerCertificate=True;Encrypt=True"
+      AllowedHosts: "${ALLOWED_HOSTS:-localhost;127.0.0.1;[::1];api}"
+      ConnectionStrings__McpDb: "Host=db;Port=5432;Database=knowz_selfhosted;Username=knowz;Password=${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}"
       Database__AutoMigrate: "true"
+      KNOWZ_AI_CONFIG_UPDATED_AT: "${KNOWZ_AI_CONFIG_UPDATED_AT:-}"
+      KNOWZ_AI_DISABLED: "${KNOWZ_AI_DISABLED:-false}"
+      DataProtection__KeysPath: "/data/keys"
       SelfHosted__JwtSecret: "${JWT_SECRET:?JWT_SECRET must be set in .env (>=32 chars)}"
       SelfHosted__SuperAdminUsername: "${ADMIN_USERNAME:?ADMIN_USERNAME must be set in .env}"
       SelfHosted__SuperAdminPassword: "${ADMIN_PASSWORD:?ADMIN_PASSWORD must be set in .env}"
+      SelfHosted__RequireSuperAdminPasswordChange: "${ADMIN_PASSWORD_REQUIRES_CHANGE:-false}"
       SelfHosted__AllowedOrigins__0: "http://localhost:${WEB_PORT:-3000}"
       SelfHosted__RateLimiting__Enabled: "true"
       MCP__ServiceKey: "${MCP_SERVICE_KEY:?MCP_SERVICE_KEY must be set in .env}"
       Storage__Provider: "LocalFileSystem"
       Storage__Local__RootPath: "/data/files"
+      OpenAiCompatible__Endpoint: "${OPENAI_COMPAT_ENDPOINT:-}"
+      OpenAiCompatible__ApiKey: "${OPENAI_COMPAT_APIKEY:-}"
+      OpenAiCompatible__ChatModel: "${OPENAI_COMPAT_CHAT_MODEL:-}"
+      OpenAiCompatible__EmbeddingModel: "${OPENAI_COMPAT_EMBEDDING_MODEL:-}"
+      OpenAiCompatible__EmbeddingDimensions: "${EMBEDDING_DIMENSIONS:-1536}"
       AzureOpenAI__Endpoint: "${AZURE_OPENAI_ENDPOINT:-}"
       AzureOpenAI__ApiKey: "${AZURE_OPENAI_APIKEY:-}"
       AzureOpenAI__DeploymentName: "${AZURE_OPENAI_DEPLOYMENT:-gpt-5.4}"
-      AzureOpenAI__EmbeddingDeploymentName: "${AZURE_OPENAI_EMBEDDING:-text-embedding-3-large}"
-      Embedding__ModelName: "${EMBEDDING_MODEL_NAME:-text-embedding-3-large}"
-      Embedding__Dimensions: "${EMBEDDING_DIMENSIONS:-3072}"
+      AzureOpenAI__EmbeddingDeploymentName: "${AZURE_OPENAI_EMBEDDING:-text-embedding-3-small}"
+      Embedding__ModelName: "${EMBEDDING_MODEL_NAME:-text-embedding-3-small}"
+      Embedding__Dimensions: "${EMBEDDING_DIMENSIONS:-1536}"
       AzureAISearch__Endpoint: "${AZURE_SEARCH_ENDPOINT:-}"
       AzureAISearch__ApiKey: "${AZURE_SEARCH_APIKEY:-}"
       AzureAISearch__IndexName: "${AZURE_SEARCH_INDEX:-knowz-selfhosted}"
@@ -56,6 +64,10 @@ services:
       KnowzPlatform__ApiKey: "${KNOWZ_PLATFORM_APIKEY:-}"
     volumes:
       - knowz-file-storage:/data/files
+      - knowz-protected-keys:/data/keys
+      - knowz-protected-keys:/home/app/.aspnet/DataProtection-Keys
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     healthcheck:
       test: curl -f http://localhost:8080/healthz || exit 1
       interval: 30s
@@ -79,6 +91,7 @@ services:
       api:
         condition: service_healthy
     environment:
+      AllowedHosts: "${ALLOWED_HOSTS:-localhost;127.0.0.1;[::1];mcp}"
       Knowz__BaseUrl: "${MCP_API_URL:-http://api:8080}"
       MCP__BackendMode: "${MCP_BACKEND_MODE:-selfhosted}"
       MCP__ApiKeyValidationEndpoint: "${MCP_API_KEY_VALIDATION_ENDPOINT:-/api/vaults}"
@@ -94,3 +107,4 @@ services:
 volumes:
   knowz-db-data:
   knowz-file-storage:
+  knowz-protected-keys:

package/assets/selfhosted/lmstudio-azure-bridge.mjs

@@ -0,0 +1,73 @@
+import http from 'node:http';
+import { Readable } from 'node:stream';
+
+const listenPort = Number(process.env.PORT || 12345);
+const upstreamBase = (process.env.OPENAI_COMPAT_ENDPOINT || 'http://host.docker.internal:1234/v1')
+  .replace(/\/$/, '');
+const upstreamApiKey = process.env.OPENAI_COMPAT_APIKEY || 'local-compatible-adapter';
+
+function sendJson(response, statusCode, payload) {
+  response.writeHead(statusCode, { 'content-type': 'application/json' });
+  response.end(JSON.stringify(payload));
+}
+
+const server = http.createServer(async (request, response) => {
+  if (request.method === 'GET' && request.url === '/healthz') {
+    sendJson(response, 200, { status: 'healthy' });
+    return;
+  }
+
+  const route = request.url?.match(
+    /^\/openai\/deployments\/([^/]+)\/(chat\/completions|embeddings)(?:\?.*)?$/,
+  );
+  if (request.method !== 'POST' || !route) {
+    sendJson(response, 404, { error: { message: 'Unsupported compatibility route' } });
+    return;
+  }
+
+  const chunks = [];
+  for await (const chunk of request) chunks.push(chunk);
+
+  try {
+    const deployment = decodeURIComponent(route[1]);
+    const body = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    body.model = deployment;
+
+    const upstream = await fetch(`${upstreamBase}/${route[2]}`, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        accept: request.headers.accept || 'application/json',
+        authorization: `Bearer ${upstreamApiKey}`,
+      },
+      body: JSON.stringify(body),
+    });
+
+    if (route[2] === 'embeddings' && upstream.ok) {
+      const payload = await upstream.json();
+      for (const item of payload.data || []) {
+        if (!Array.isArray(item.embedding)) continue;
+        const packed = Buffer.allocUnsafe(item.embedding.length * 4);
+        item.embedding.forEach((value, index) => packed.writeFloatLE(value, index * 4));
+        item.embedding = packed.toString('base64');
+      }
+      response.writeHead(upstream.status, { 'content-type': 'application/json' });
+      response.end(JSON.stringify(payload));
+      return;
+    }
+
+    const headers = {};
+    for (const [key, value] of upstream.headers) {
+      if (key !== 'content-length' && key !== 'transfer-encoding') headers[key] = value;
+    }
+    response.writeHead(upstream.status, headers);
+    if (upstream.body) Readable.fromWeb(upstream.body).pipe(response);
+    else response.end();
+  } catch (error) {
+    sendJson(response, 502, {
+      error: { message: `OpenAI-compatible adapter request failed: ${error.message}` },
+    });
+  }
+});
+
+server.listen(listenPort, '0.0.0.0');

package/assets/selfhosted/releases.json

@@ -1,28 +1,151 @@
 {
   "releases": [
+    {
+      "version": "0.16.2",
+      "status": "complete",
+      "flavors": [
+        "selfhosted"
+      ],
+      "digests": {
+        "api": "sha256:f1f9682bb1c6634f02d3fa3a5dd515e11ffb55b8203c14fc340e3aa50d086b88",
+        "web": "sha256:b12cee9b670e357bfeaeca21851fcf0047cefdf57c57cf20d2f84aa711dae38b",
+        "mcp": "sha256:64df9eb93c31a77a252ae6ffa45e03cfe8b8e10ad1bcad5684f9ba4ffc4a2c3d"
+      },
+      "platforms": {
+        "api": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "web": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "mcp": [
+          "linux/amd64",
+          "linux/arm64"
+        ]
+      },
+      "runtime": {
+        "database": "postgres",
+        "composeAsset": "docker-compose.yml"
+      },
+      "releasedAt": "2026-09-07T18:55:51Z",
+      "minCliVersion": "0.5.0",
+      "notes": "Verified public API/web/MCP image set. Preserves unsaved Settings drafts through browser navigation and retains the 0.16.1 API-key, provider, attachment and recovery fixes. Exact released-image acceptance is required before CLI stable promotion."
+    },
+    {
+      "version": "0.16.1",
+      "status": "complete",
+      "flavors": [
+        "selfhosted"
+      ],
+      "digests": {
+        "api": "sha256:0d2578a29b1be1d4f06fd7b9f07b94928ba4d08b2c5f47d9fce4e98d9dfa85cc",
+        "web": "sha256:5d5df632dc40ae459ffe8692eaaec89001d276068ca9cf0fffac28b39dc39426",
+        "mcp": "sha256:f8c2a72658abf409d1065d8d9c520fc5527395d2c0b5a05d53af133d615f55a0"
+      },
+      "platforms": {
+        "api": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "web": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "mcp": [
+          "linux/amd64",
+          "linux/arm64"
+        ]
+      },
+      "runtime": {
+        "database": "postgres",
+        "composeAsset": "docker-compose.yml"
+      },
+      "releasedAt": "2026-09-07T16:54:11Z",
+      "minCliVersion": "0.5.0",
+      "notes": "Verified public API/web/MCP image set. Repairs API-key tenant reads and attachments, provider configuration across restart, and browser recovery. Exact released-image acceptance is required before CLI stable promotion."
+    },
+    {
+      "version": "0.16.0",
+      "status": "complete",
+      "flavors": [
+        "selfhosted"
+      ],
+      "releasedAt": "2026-09-04T05:28:39Z",
+      "minCliVersion": "0.4.0",
+      "notes": "Native PostgreSQL 16 + pgvector. Limited edition (honesty). MCP 26/36. Azure deploy not offered. File-sync uses PlatformConnection credentials.",
+      "digests": {
+        "api": "sha256:96be758eaede90e472d33ea4a3a1231893d5075a4ef4426d6f460a7cfc7c35ab",
+        "web": "sha256:ed85e3bd68dcceac2100afbd82426e54e67a88f59498b820b2f847d5054b02e7",
+        "mcp": "sha256:0a5a542048506c66ed16455d6e97b0c762be6f10ce0f1c530457743775641efc"
+      },
+      "runtime": {
+        "database": "postgres",
+        "composeAsset": "docker-compose.yml"
+      },
+      "platforms": {
+        "api": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "web": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "mcp": [
+          "linux/amd64",
+          "linux/arm64"
+        ]
+      }
+    },
     {
       "version": "0.15.1",
-      "flavors": ["selfhosted"],
+      "status": "complete",
+      "flavors": [
+        "selfhosted"
+      ],
       "releasedAt": "2026-09-01T12:49:00Z",
       "minCliVersion": null,
       "notes": "User-role mothership connect/browse/pull. Anonymous GHCR triple.",
-      "digests": null
+      "digests": null,
+      "runtime": {
+        "database": "mssql",
+        "composeAsset": "docker-compose.mssql.yml",
+        "compatibleProviderAdapter": "lmstudio-azure-bridge.mjs"
+      }
     },
     {
       "version": "0.15.0",
-      "flavors": ["selfhosted"],
+      "status": "complete",
+      "flavors": [
+        "selfhosted"
+      ],
       "releasedAt": "2026-09-01T12:15:00Z",
       "minCliVersion": null,
       "notes": "Look/feel restyle, session decrypt, fail-closed compose, vite-only web image. First complete public GHCR triple since the split 0.14.x tags.",
-      "digests": null
+      "digests": null,
+      "runtime": {
+        "database": "mssql",
+        "composeAsset": "docker-compose.mssql.yml",
+        "compatibleProviderAdapter": "lmstudio-azure-bridge.mjs"
+      }
     },
     {
       "version": "0.14.11",
-      "flavors": ["selfhosted"],
+      "status": "incomplete",
+      "flavors": [
+        "selfhosted"
+      ],
       "releasedAt": "2026-05-28T00:00:00Z",
       "minCliVersion": null,
       "notes": "Incomplete GHCR set: api:0.14.11 exists; web/mcp 0.14.11 404 (web/mcp last published at 0.14.10). Do not pin.",
-      "digests": null
+      "digests": null,
+      "runtime": {
+        "database": "mssql",
+        "composeAsset": "docker-compose.mssql.yml",
+        "compatibleProviderAdapter": "lmstudio-azure-bridge.mjs"
+      }
     }
   ]
 }

package/bin/run.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { applyCliBrandFromProcess } from '../dist/lib/brand.js';
 import { execute } from '@oclif/core';
 
+applyCliBrandFromProcess();
 await execute({ dir: import.meta.url });