config.yaml gains an optional update section (remote / remote_url / branch). The
resolver keeps its default - whatever remote this tree already tracks - and the
explicit choice wins when set, which is also what lets a tarball installation
that never saw git get on the update rails at all.
- RemoteURL is fetched straight into a ref namespace of its own, so a URL source
cannot be shadowed by a same-named remote's stale refs. ValidRemoteURL allowlists
https/http/ssh/git/file and local absolute paths, and rejects git's ext::
transport (which executes commands) before anything reaches argv.
- Adopt connects a plain directory to the source. Preview is side-effect free (the
fetch happens in a throwaway bare repository) and lists every local file whose
content the target would replace, plus the operator content that is put aside.
The confirmed run inits, adds origin, stashes operator content, keeps every
replaced file under .update-backup/<ts>/overwritten/ so "the update ate my edit"
has an address, lands the target content, sets upstream, rebuilds the binary.
A failure removes only the .git it created itself; once the content has landed
the tree stays adopted even if the build fails.
- Console/API: the status envelope carries the configured source;
POST /system/update/source writes it through the same config path every other
setting uses (validated, audited); POST /system/update/adopt is preview-then-job,
with the job's kind recorded. OpenAPI updated; RBAC rides the existing
update:apply prefix and the route inventory stays green.
Tests: URL-mode check/apply against real repositories (including the address
beating a remote name), URL validation table, and the full adoption story -
preview touches nothing, operator content survives, the replaced edit is in the
backup, and the adopted tree updates and rolls back like any other installation.
An operator running a fork has no honest way to upgrade: upgrade.sh downloads the
Release tarball of one hard-coded third-party repository and rsyncs it over the
tree, so "upgrade" means "overwrite yourself with somebody else's code", and the
safe alternative is to pull by hand and remember the build command.
internal/update drives the remote the directory already tracks: fetch, fast-forward,
go build into .update-staging, atomic rename of the binary (the previous one kept as
cyberstrike-ai.prev), and a .update-state.json so a rollback has a target that is
not guessed at. Refusals are the point - local source edits and a diverged branch
stop with the file names and commit counts in the error rather than being reset to
match, and operator-owned content (roles/skills/tools/agents/data/config.yaml) is put
aside before the merge and restored over it, with what was kept listed in keptContent
instead of quietly dropped.
Consumers: GET/POST /api/system/update* behind update:read / update:apply (mutations
are process-global, so they need a global-scope session); a console page at
#system-update with an apply button that names why it is blocked, a job polled from
the server and a rollback control; the same three actions as -check-update / -update
/ -update-rollback on the binary; OpenAPI entries for all five endpoints. Permission
gating no longer re-enables a control a page disabled for a reason of its own
(data-state-disabled), which every state-disabled, permission-gated button in the
console was subject to. upgrade.sh becomes a thin shell over the same implementation
and only falls back to the tarball path for installs that are not git work trees.
Docs and the zh/EN/RU dictionaries are updated. The package runs 13 tests against
real temporary git repositories; the HTTP layer, RBAC and the console page each
carry their own contract tests.
Sycun