docs: sync after #219 (np+mcp shipped with desktop installer) - #227
Closed
Sev7eNup wants to merge 1 commit into
Closed
docs: sync after #219 (np+mcp shipped with desktop installer)#227Sev7eNup wants to merge 1 commit into
Sev7eNup wants to merge 1 commit into
Conversation
deploy/desktop/README.md: - Architecture directory tree: add tools\np and tools\mcp - Build description: mention self-contained operator client publish step - Files table: update Build-DesktopInstaller.ps1 description src/nodepilot-docs-ui/content/deployment/desktop.md: - Installierte Pfade: add tools\np and tools\mcp rows - Build step list: add operator-client publish as step 2
Sev7eNup
added a commit
that referenced
this pull request
Aug 19, 2026
…ing blockers, cut the README Answers one question end to end: can a stranger find NodePilot, trust it, install it, and reach a first login without asking anyone? Onboarding blockers - Desktop first run broke under a separate admin account: the setup token went to the elevated account's profile while the app looked in the interacting user's. Anyone installing with different admin credentials — the norm in managed environments — reached a login form for an account that did not exist, with no documented way out. - A failed desktop provisioning step reported success; the installer now fails and names the log. The app's readiness timeout sat below the provisioning script's own and now sits above it. - The documented trust ceremony could not be performed: the publisher certificate stopped being attached after 1.2.8 and was never checksum-covered even when present. It is now a build output listed in SHA256SUMS, and the install scripts ship as their own checksum-covered zip so verifying no longer requires extracting the unverified archive. - Version placeholders replace hardcoded versions in copy-paste commands; the three npm manifests move to the product version, guarded by a new parity test. Security - NetworkGuard treated the unspecified addresses 0.0.0.0 and :: as public. Both reach the local host on Windows and IPAddress.IsLoopback does not recognise them, so http://0.0.0.0:5000/ walked straight through RestApi:BlockPrivateNetworks. - SECURITY.md adds a private reporting path and a scope section, so intended behaviour (operator trust, the localhost bypass, self-signed signing) is not reported as a finding. - Two easter eggs removed, one of which shipped a third-party photo in every build under no license; the sparkasse skin renamed to bank; the public roadmap no longer names file and class locations for open security work. Documentation site - Published to GitHub Pages and made bilingual: 42 pages in English and German, language in the route, switcher, browser-language detection, search over the active language. A parity test fails the build if a page or nav title lands in only one language. The site had no test suite; it now has 23 tests, wired into CI. Only content/en feeds the in-product AI knowledge assistant. Public surface - README: 1428 lines to 545. Its feature inventory duplicated the documentation site and links there instead. The SCOrch import path moves from undocumented to a section with a comparison table. - Adds CHANGELOG.md, CODE_OF_CONDUCT.md, RELEASING.md and CODEOWNERS; fixes 56 broken links; retires a stale branch-name column; moves E2ETests.md out of the repository root; relabels eight pinned action SHAs with the version they actually are; retakes the screenshots in the default dark skin. Desktop build - Asserts the bundled PostgreSQL major version by reading the binary rather than trusting a path — a 17.x payload produced an installer that failed against every existing database. The desktop shortcut becomes an opt-out task. Supersedes #227, whose content is folded in here in both languages.
Owner
Author
|
Superseded by #229, which is now on The Nothing was dropped: the install-layout table, the build-step list and the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
PR #219 added
tools\npandtools\mcpto the desktop installer but did not update the two desktop-specific doc surfaces that carry the directory listing and build step description.How
Two files corrected:
deploy/desktop/README.mdtools\npandtools\mcpBuild-DesktopInstaller.ps1descriptionsrc/nodepilot-docs-ui/content/deployment/desktop.mdtools\npandtools\mcpTesting
Docs-only change — no code modified, no tests to run.
Checklist
main; no direct commits tomaincontent/anddeploy/desktop/README.md) to reflect Ship np and nodepilot-mcp with both installers #219Generated by Claude Code