@knowzai/cli 0.4.0 → 0.5.1

package/README.md

@@ -0,0 +1,68 @@
+# Knowz CLI
+
+Connect to Knowz endpoints, work with knowledge from your terminal, or start your
+own lightweight, open-source Knowz installation with guided browser setup.
+
+## Install
+
+This 0.5.0 candidate is distributed on the preview channel. Requires **Node.js 22
+or newer**:
+
+```sh
+npm install -g @knowzai/cli@0.5.0
+knowz --version
+```
+
+Native packages bundle Node and are available through the
+[public CLI releases](https://github.com/knowz-io/knowz-cli/releases).
+Check each release's operating-system support, checksum and signing status.
+
+## Start selfhosted
+
+Start a local Docker engine with Compose, then run:
+
+```sh
+knowz up
+```
+
+The browser guides you through configuration and first sign-in. Selfhosted uses
+public images and requires no Knowz license or GitHub login. Replace the temporary
+administrator password and finish connecting the CLI when prompted. Without an AI
+provider, you can still store and browse knowledge; AI answers require a configured
+provider. Saved provider changes take effect after the indicated restart.
+
+```sh
+knowz runtime status
+knowz down
+knowz up
+knowz backup --encrypt --out ./knowz-backup.enc
+```
+
+Stopping preserves your data. Store backups and their passphrases separately.
+Use `knowz restore --help` for checked recovery into a stopped installation.
+
+## Connect to an endpoint
+
+Use `knowz login` for the hosted platform. Named profiles keep endpoint credentials
+separate. For an existing selfhosted endpoint:
+
+```sh
+knowz login --self-hosted --api-url https://knowz.example.com --profile my-knowz
+knowz vault list --profile my-knowz
+knowz search "project notes" --profile my-knowz
+```
+
+Run `knowz --help` and `knowz <command> --help` for knowledge creation, attachments,
+chat, local indexing, encryption, synchronization and runtime management.
+
+## Editions and source
+
+[Knowz Selfhosted](https://github.com/knowz-io/knowz-selfhosted-source) is the
+Apache-2.0 open-source edition. The proprietary portable platform is a separate
+contracted offering selected explicitly with `--edition portable`. New proprietary
+downloads and updates require a valid installation grant; a SaaS subscription or
+registry login alone is insufficient. Public selfhosted setup remains independent.
+
+The [released CLI skills](https://github.com/knowz-io/knowz-cli/releases) include
+matching command inventories for agents. Use the skill for your installed CLI
+version.

package/assets/portable/releases.json

@@ -1,5 +1,60 @@
 {
   "releases": [
+    {
+      "version": "0.47.8",
+      "flavors": [
+        "portable",
+        "portable-gcp"
+      ],
+      "releasedAt": "2026-09-19T19:21:24Z",
+      "minCliVersion": null,
+      "notes": "Weekend MVP: private sites default + soft-accept uploads + Free audio-only (#1015); HF email brand (#1016); AGW WAF chunk-cap (#1014)",
+      "digests": null
+    },
+    {
+      "version": "0.47.6",
+      "flavors": [
+        "portable",
+        "portable-gcp"
+      ],
+      "releasedAt": "2026-09-19T03:27:04Z",
+      "minCliVersion": null,
+      "notes": "HF Q&A quality must-fixes MF1\u2013MF8 (#1010)",
+      "digests": null
+    },
+    {
+      "version": "0.47.5",
+      "flavors": [
+        "portable",
+        "portable-gcp"
+      ],
+      "releasedAt": "2026-09-18T15:24:59Z",
+      "minCliVersion": null,
+      "notes": null,
+      "digests": null
+    },
+    {
+      "version": "0.47.0",
+      "flavors": [
+        "portable",
+        "portable-gcp"
+      ],
+      "releasedAt": "2026-09-12T18:34:28Z",
+      "minCliVersion": null,
+      "notes": null,
+      "digests": null
+    },
+    {
+      "version": "0.46.0",
+      "flavors": [
+        "portable",
+        "portable-gcp"
+      ],
+      "releasedAt": "2026-09-08T20:40:06Z",
+      "minCliVersion": null,
+      "notes": null,
+      "digests": null
+    },
     {
       "version": "0.44.1",
       "flavors": [
@@ -8,8 +63,17 @@
       ],
       "releasedAt": "2026-09-04T05:26:59Z",
       "minCliVersion": "0.3.0",
-      "notes": "Interview Studio v1, guest answer flow, honest knowledge dates. Supersedes v0.44.0 (web image build failed). Commercial grant required for portable pull.",
-      "digests": null
+      "notes": "Interview Studio v1, guest answer flow, honest knowledge dates. Supersedes v0.44.0 (web image build failed). Commercial grant required for portable pull. Exact seven-component manifest bodies and linux/amd64 availability verified on2026-09-07; anonymous GHCR artifact access denied.",
+      "digests": {
+        "api": "sha256:625603c64ddfe8ab411fd6ce314fbc1f4881e6ea7018c68dab6bdf5996c8d2cb",
+        "api-gcp": "sha256:190afad819f6978ca6301b84e316a038e7b1ba835e5197bfbd72ef5bf77b3041",
+        "worker": "sha256:8210c4ba98281202cbec9a0bce91bc8c13a1079c87be677ab3d60bd4539998c0",
+        "worker-gcp": "sha256:2cdecd0dd4efd70a0a89865dffed31684e172eedd194acaa333239d4f657ca8e",
+        "web": "sha256:382efff53f60bbf073c18eb1eec63c6af62cea2f42c5a74d1b81ec36a8c5c048",
+        "mcp": "sha256:7c9e2f5d6f613b77d7b32d5a75f3e613f12cfc36b5c27ed3608435396ca43f5b",
+        "public-site": "sha256:f2eee97faa8c41b9505d80c42ee8d5180bbdd65ddfedfa33af4ad79fac194fea"
+      },
+      "status": "complete"
     },
     {
       "version": "0.43.0",

package/assets/portable/runtime-contract.json

@@ -128,8 +128,8 @@
     "realtime-progress": { "status": "full", "transport": "worker-api-redis-sse" },
     "entity-extraction": { "status": "degraded", "behavior": "terminal completion without structured entities" },
     "face-recognition": { "status": "degraded", "behavior": "job consumed without recognition output" },
-    "graph-sync": { "status": "degraded", "behavior": "job consumed without graph output" },
-    "git-sync": { "status": "unavailable" },
+    "graph-sync": { "status": "full", "queues": ["graph-sync"] },
+    "git-sync": { "status": "full", "queues": ["git-sync", "git-sync-batch"] },
     "engagement-jobs": { "status": "unavailable" },
     "ingestion-jobs": { "status": "unavailable" },
     "sequence-execution": { "status": "unavailable" },

package/assets/selfhosted/docker-compose.yml

@@ -13,8 +13,6 @@ services:
       POSTGRES_USER: knowz
       POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in .env}"
       POSTGRES_DB: knowz_selfhosted
-    ports:
-      - "127.0.0.1:${DB_PORT:-5432}:5432"
     volumes:
       - knowz-db-data:/var/lib/postgresql/data
     healthcheck:
@@ -32,8 +30,12 @@ services:
       db:
         condition: service_healthy
     environment:
+      AllowedHosts: "${ALLOWED_HOSTS:-localhost;127.0.0.1;[::1];api}"
       ConnectionStrings__McpDb: "Host=db;Port=5432;Database=knowz_selfhosted;Username=knowz;Password=${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}"
       Database__AutoMigrate: "true"
+      KNOWZ_AI_CONFIG_UPDATED_AT: "${KNOWZ_AI_CONFIG_UPDATED_AT:-}"
+      KNOWZ_AI_DISABLED: "${KNOWZ_AI_DISABLED:-false}"
+      DataProtection__KeysPath: "/data/keys"
       SelfHosted__JwtSecret: "${JWT_SECRET:?JWT_SECRET must be set in .env (>=32 chars)}"
       SelfHosted__SuperAdminUsername: "${ADMIN_USERNAME:?ADMIN_USERNAME must be set in .env}"
       SelfHosted__SuperAdminPassword: "${ADMIN_PASSWORD:?ADMIN_PASSWORD must be set in .env}"
@@ -62,6 +64,8 @@ services:
       KnowzPlatform__ApiKey: "${KNOWZ_PLATFORM_APIKEY:-}"
     volumes:
       - knowz-file-storage:/data/files
+      - knowz-protected-keys:/data/keys
+      - knowz-protected-keys:/home/app/.aspnet/DataProtection-Keys
     extra_hosts:
       - "host.docker.internal:host-gateway"
     healthcheck:
@@ -87,6 +91,7 @@ services:
       api:
         condition: service_healthy
     environment:
+      AllowedHosts: "${ALLOWED_HOSTS:-localhost;127.0.0.1;[::1];mcp}"
       Knowz__BaseUrl: "${MCP_API_URL:-http://api:8080}"
       MCP__BackendMode: "${MCP_BACKEND_MODE:-selfhosted}"
       MCP__ApiKeyValidationEndpoint: "${MCP_API_KEY_VALIDATION_ENDPOINT:-/api/vaults}"
@@ -102,3 +107,4 @@ services:
 volumes:
   knowz-db-data:
   knowz-file-storage:
+  knowz-protected-keys:

package/assets/selfhosted/releases.json

@@ -1,22 +1,143 @@
 {
   "releases": [
+    {
+      "version": "0.17.0",
+      "status": "complete",
+      "flavors": [
+        "selfhosted"
+      ],
+      "digests": {
+        "api": "sha256:9baa070fff55d6ea031708433680b24a76e7b490620f49f8ee3b47d758ec0d78",
+        "web": "sha256:c041ecc61b33982391502c9203a40ef63653aa255cc105d931f6674c27e6164d",
+        "mcp": "sha256:00bd12459844b5bc84ec4bca335c789a7a4a7280f87bbd51ede07f5cc88c5095"
+      },
+      "platforms": {
+        "api": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "web": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "mcp": [
+          "linux/amd64",
+          "linux/arm64"
+        ]
+      },
+      "runtime": {
+        "database": "postgres",
+        "composeAsset": "docker-compose.yml"
+      },
+      "releasedAt": "2026-09-19T23:09:10Z",
+      "minCliVersion": "0.5.1",
+      "notes": "Verified public API/web/MCP image set. Anydoc-first local document conversion, OpenAI Apps challenge/MCP tool annotations, destinations live-connect UI parity, vault/tenant import-export fidelity and MCP plan-gate 402 surfacing. Exact released-image acceptance is required before CLI stable promotion."
+    },
+    {
+      "version": "0.16.2",
+      "status": "complete",
+      "flavors": [
+        "selfhosted"
+      ],
+      "digests": {
+        "api": "sha256:f1f9682bb1c6634f02d3fa3a5dd515e11ffb55b8203c14fc340e3aa50d086b88",
+        "web": "sha256:b12cee9b670e357bfeaeca21851fcf0047cefdf57c57cf20d2f84aa711dae38b",
+        "mcp": "sha256:64df9eb93c31a77a252ae6ffa45e03cfe8b8e10ad1bcad5684f9ba4ffc4a2c3d"
+      },
+      "platforms": {
+        "api": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "web": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "mcp": [
+          "linux/amd64",
+          "linux/arm64"
+        ]
+      },
+      "runtime": {
+        "database": "postgres",
+        "composeAsset": "docker-compose.yml"
+      },
+      "releasedAt": "2026-09-07T18:55:51Z",
+      "minCliVersion": "0.5.0",
+      "notes": "Verified public API/web/MCP image set. Preserves unsaved Settings drafts through browser navigation and retains the 0.16.1 API-key, provider, attachment and recovery fixes. Exact released-image acceptance is required before CLI stable promotion."
+    },
+    {
+      "version": "0.16.1",
+      "status": "complete",
+      "flavors": [
+        "selfhosted"
+      ],
+      "digests": {
+        "api": "sha256:0d2578a29b1be1d4f06fd7b9f07b94928ba4d08b2c5f47d9fce4e98d9dfa85cc",
+        "web": "sha256:5d5df632dc40ae459ffe8692eaaec89001d276068ca9cf0fffac28b39dc39426",
+        "mcp": "sha256:f8c2a72658abf409d1065d8d9c520fc5527395d2c0b5a05d53af133d615f55a0"
+      },
+      "platforms": {
+        "api": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "web": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "mcp": [
+          "linux/amd64",
+          "linux/arm64"
+        ]
+      },
+      "runtime": {
+        "database": "postgres",
+        "composeAsset": "docker-compose.yml"
+      },
+      "releasedAt": "2026-09-07T16:54:11Z",
+      "minCliVersion": "0.5.0",
+      "notes": "Verified public API/web/MCP image set. Repairs API-key tenant reads and attachments, provider configuration across restart, and browser recovery. Exact released-image acceptance is required before CLI stable promotion."
+    },
     {
       "version": "0.16.0",
       "status": "complete",
-      "flavors": ["selfhosted"],
+      "flavors": [
+        "selfhosted"
+      ],
       "releasedAt": "2026-09-04T05:28:39Z",
       "minCliVersion": "0.4.0",
       "notes": "Native PostgreSQL 16 + pgvector. Limited edition (honesty). MCP 26/36. Azure deploy not offered. File-sync uses PlatformConnection credentials.",
-      "digests": null,
+      "digests": {
+        "api": "sha256:96be758eaede90e472d33ea4a3a1231893d5075a4ef4426d6f460a7cfc7c35ab",
+        "web": "sha256:ed85e3bd68dcceac2100afbd82426e54e67a88f59498b820b2f847d5054b02e7",
+        "mcp": "sha256:0a5a542048506c66ed16455d6e97b0c762be6f10ce0f1c530457743775641efc"
+      },
       "runtime": {
         "database": "postgres",
         "composeAsset": "docker-compose.yml"
+      },
+      "platforms": {
+        "api": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "web": [
+          "linux/amd64",
+          "linux/arm64"
+        ],
+        "mcp": [
+          "linux/amd64",
+          "linux/arm64"
+        ]
       }
     },
     {
       "version": "0.15.1",
       "status": "complete",
-      "flavors": ["selfhosted"],
+      "flavors": [
+        "selfhosted"
+      ],
       "releasedAt": "2026-09-01T12:49:00Z",
       "minCliVersion": null,
       "notes": "User-role mothership connect/browse/pull. Anonymous GHCR triple.",
@@ -30,7 +151,9 @@
     {
       "version": "0.15.0",
       "status": "complete",
-      "flavors": ["selfhosted"],
+      "flavors": [
+        "selfhosted"
+      ],
       "releasedAt": "2026-09-01T12:15:00Z",
       "minCliVersion": null,
       "notes": "Look/feel restyle, session decrypt, fail-closed compose, vite-only web image. First complete public GHCR triple since the split 0.14.x tags.",
@@ -44,7 +167,9 @@
     {
       "version": "0.14.11",
       "status": "incomplete",
-      "flavors": ["selfhosted"],
+      "flavors": [
+        "selfhosted"
+      ],
       "releasedAt": "2026-05-28T00:00:00Z",
       "minCliVersion": null,
       "notes": "Incomplete GHCR set: api:0.14.11 exists; web/mcp 0.14.11 404 (web/mcp last published at 0.14.10). Do not pin.",

package/bin/run.js

@@ -1,4 +1,9 @@
 #!/usr/bin/env node
-import { execute } from '@oclif/core';
+import { ensureBaselineWasmRuntime } from './wasm-runtime.js';
 
-await execute({ dir: import.meta.url });
+if (!(await ensureBaselineWasmRuntime())) {
+  const { applyCliBrandFromProcess } = await import('../dist/lib/brand.js');
+  const { execute } = await import('@oclif/core');
+  applyCliBrandFromProcess();
+  await execute({ dir: import.meta.url });
+}

package/bin/wasm-runtime.js

@@ -0,0 +1,27 @@
+import { spawn } from 'node:child_process';
+
+// Large mixed-grammar workloads can exhaust V8's optimizing-WASM compiler zone.
+// Set the flag before VM startup: changing V8 flags after startup is unreliable.
+// Liftoff retains baseline WASM compilation and normal JavaScript JIT execution.
+export async function ensureBaselineWasmRuntime() {
+  if (process.execArgv.includes('--liftoff-only')) return false;
+
+  const child = spawn(process.execPath,
+    [...process.execArgv, '--liftoff-only', ...process.argv.slice(1)],
+    { stdio: 'inherit', env: process.env });
+  const signals = ['SIGINT', 'SIGTERM', ...(process.platform === 'win32' ? [] : ['SIGHUP'])];
+  const forwarders = new Map(signals.map(signal => [signal, () => child.kill(signal)]));
+  for (const [signal, forward] of forwarders) process.on(signal, forward);
+  try {
+    const { code, signal } = await new Promise((resolve, reject) => {
+      child.once('error', reject);
+      child.once('exit', (code, signal) => resolve({ code, signal }));
+    });
+    for (const [name, forward] of forwarders) process.removeListener(name, forward);
+    if (signal) process.kill(process.pid, signal);
+    else process.exitCode = code ?? 1;
+  } finally {
+    for (const [signal, forward] of forwarders) process.removeListener(signal, forward);
+  }
+  return true;
+}