v1.2.5

v1.2.5 — one research loop across clients, documents on processor-only machines, and a bot that can reach its deployment

A patch release that makes the research loop behave the same way in the Web interface, in Telegram, on a fresh installation and after an upgrade, and that moves several unchecked or duplicated control paths onto smaller, independently tested owners. It also repairs two failures that appeared only at runtime on published images: document processing on machines without a graphics accelerator, and the Telegram bot's ability to reach the rest of the deployment.
This release includes two automatic migrations (0112, 0113); they apply on startup and need no operator action.
This release changes application code, so the :1.2.5 images differ from :1.2.4.

Added

• One focus session across Web and Telegram. A focus session started in either client drives the same durable timer. It survives client restarts, records completed time once, and pauses scheduled Telegram digests, reminders, alerts and warnings until focus ends.
• Cross-client job visibility. Work started from Telegram or another browser appears in the Web job indicator and refreshes the affected view when it finishes, including short Pulse jobs that complete between polls.
• A sync schedule anyone can set. The Zotero library sync schedule is chosen from named options — hourly, every few hours, daily at a time, weekly on a day — instead of typed as a five-field expression. The expression field stays under Advanced for schedules the options cannot express, and a schedule more frequent than every fifteen minutes is refused.
• Stored provider credentials can be removed. A saved key or endpoint can be cleared from the interface rather than only overwritten. Removal is refused while a model route still depends on that provider, and it is recorded in the audit log distinctly from a replacement.
• A checked Telegram command reference. Bot registration, Telegram's command menu, /help and the manual all derive from one command catalog, and the pairing artifact is called a code everywhere it appears.
• A local security scan. make security-scan reproduces the local dependency and secret-scanning subset of the hosted Security workflow. Downloaded scanner artifacts stay outside the repository and are hash-verified on every use.

Fixed

• Documents can be processed on processor-only installations. The published images for machines without a graphics accelerator paired the document reader with a build of its companion library that could not load beside it, so the first document a researcher opened failed while every service still reported healthy. Both now come from the same source, and no image may be released until it has loaded that stack, converted a real document and refused a corrupt one, inside the exact image being published and with no network access at all.
• The Telegram bot can reach the rest of the deployment. The outbound address policy introduced in this release did not list the deployment's own service names, so every command and every scheduled message failed before a connection was opened. Those names are now permitted, a name that merely resembles one is still refused, and a first-run check makes one real call between containers so this cannot pass unnoticed again.
• Document models ship inside the image. The reader previously downloaded several hundred megabytes the first time a researcher opened a document, which stalled that first document and could not complete at all without internet access. The models are now built in.
• A setting that fails to save says so. Eighteen controls across the author, topic, extraction-template, automation, source, model and Telegram panels changed the screen and then stayed silent when the server rejected the change, leaving the old value on display as though it had been stored. Every panel now reports a rejected save the same way.
• Ask behaves predictably with reasoning-capable models. Thinking is off unless explicitly enabled, one answer budget governs both prompt fitting and the model request, and known response-hygiene failures produce actionable retry and administrator guidance instead of a generic error.
• Zotero exports stay with their research projects. Sending a paper creates or reuses a collection for each linked project, including when an existing item is matched by DOI, and the interface follows the queued export through to completion. A failed collection or DOI lookup can no longer be reported as an unfiled or duplicate success. Switching between personal and group libraries clears only the previous library's remote identifiers; local papers and analysis history remain intact.
• Outbound connections stay bound to the address that policy checked. PDF downloads, custom model providers, Better BibTeX, SMTP and LiteLLM custom-provider traffic connect to the address that was validated, so a name cannot resolve to one address for the check and another for the request. Certificate and hostname verification are unchanged.
• Telegram Pulse reports what it is showing. Telegram labels current, older, reduced-signal, empty and unverified results, and shows the first five cards from the same ranked deck as the Web interface. Backend ranking is unchanged.
• Saving metadata-only papers no longer creates failed analysis jobs. Web, batch and Pulse saves schedule analysis only when the paper has a remote or local PDF; a paper with only bibliographic metadata still enters the library.
• The in-app PDF reader works under the production security policy, and Ask routing metadata is decoded without producing misleading malformed-stream warnings.
• Upgrade diagnosis is read-only. Lifecycle commands distinguish a stale access-service target from custom or shared state and print a targeted, operator-confirmed repair command instead of changing that state themselves.
• Historical migrations run in ordinary pull-request checks from one shared fixture that proves the complete path, and smaller corrections landed for blank SMTP identities, benchmark scoring of ordinary prose, warnings about unset optional certificate settings, and fallback model-route parsing.

Changed

• Successful Web API responses are decoded at runtime. Named schemas guard every JSON domain before any state change, including job events and results; the generic unchecked response cast has been removed.
• Large PDF and backup workflows have smaller state owners. PDF preparation, persistence and cleanup keep their lock and transaction order, while restore recovery and retention editing move to independently tested controllers.
• Installation has one implementation. New installs use setup.sh; the former development command is a strict deprecated forwarder. Rollback now requires a complete setup-owned credential snapshot before it changes access services.
• First-use navigation teaches the real loop. Discover is present in the simple navigation, and milestone-based guidance covers Discover, Save, Analyze and Ask on wide and narrow layouts. A researcher's tour dismissal is respected across browsers.
• The model catalogue stays responsive as it grows. The picker renders a fixed number of matches and states how many of how many are shown, so typing costs the same on a catalogue of four hundred models as on one of a dozen.
• Settings behaves the same way throughout. Sliders commit once when released rather than on every step, every control carries a name a screen reader announces, clearing a topic's feedback asks first like the other irreversible actions, and the status page states what it actually checked.
• A severe, fixable vulnerability blocks a release. The published-image scan fails the verification run when it finds a critical problem a rebuild would fix, so such an image cannot reach a stable tag. Findings with no available fix stay out of the gate and remain in the report.
• Expired compatibility branches and inert configuration were removed. The browser keeps API-key exchange but no longer stores or sends raw keys, and the unused fixed Telegram chat setting and global Zotero schedule are gone.
• Dependency floors and locks include current security fixes for GitPython and the frontend's transitive identifier generator; local and hosted scans reject a return to their affected versions.
• Every service image is rebuilt on a patched distribution base. The Python service images and the dashboard image move to current Debian 12 and Alpine bases, clearing critical OpenSSL and GnuTLS advisories. The published-image scan described above is what keeps them current: it refuses to release an image carrying a critical problem a rebuild would fix.

Upgrading

An installation already on v1.2.4 upgrades in place:

jarvis-research update

An installation on v1.2.0, v1.2.1, v1.2.2, or v1.2.3 runs the one-time bootstrap from the installation directory:

(
  set -e
  bootstrap="$(mktemp)"
  trap 'rm -f "$bootstrap"' EXIT
  curl -fsSL -o "$bootstrap" \
    https://raw.githubusercontent.com/limitcycle-oss/jarvis-rd-assistant/v1.2.5/scripts/update-bootstrap.sh
  bash "$bootstrap" --repo "$PWD" --to v1.2.5
)

With this release v1.1.3 leaves the supported upgrade window. An installation on v1.1.3 or older completes the one-time step in the command-line reference and then follows the bootstrap path above; below that floor, a fresh install plus a backup restore is the supported route.

Either path validates the selected release, creates and authenticates a restore point, stages the new images, advances the checkout fast-forward only, and commits after services report healthy. Because this release migrates data, rolling back to an earlier version afterwards requires a matching database restore.

Full changelog: CHANGELOG.md