fix(updatecheck): require configured repo for deb/rpm commands; surface promoted go-install version (Spec 079 US2)

Cross-model review round 4 fixes:

- deb/rpm detection additionally requires the MCPProxy repository config
  (/etc/apt/sources.list.d/mcpproxy.list resp.
  /etc/yum.repos.d/mcpproxy.repo, as written by the documented setup).
  A standalone .deb/.rpm downloaded from a GitHub release is dpkg/rpm-
  owned but has no apt/dnf upgrade candidate, so the channel commands
  would be no-ops; those installs now degrade to unknown and get the
  release-page guidance (FR-009).

- /api/v1/info top-level version now prefers the update checker's
  current version: identical for packaged builds, but for go-install
  builds the checker promotes the build-info module version while the
  ldflags default would render 'development' on status/Web UI next to a
  real go-install update command.

Author: Dumbris

docs/features/version-updates.md

@@ -180,13 +180,19 @@ in decreasing confidence order:
    Homebrew prefix (`/opt/homebrew/`, a `Cellar/` path, or
    `/home/linuxbrew/.linuxbrew`).
 2. **Docker**: `/.dockerenv` exists.
-3. **deb / rpm**: on Linux, the executable is exactly `/usr/bin/mcpproxy`
-   **and** the owning package manager confirms it owns the file
+3. **deb / rpm**: on Linux, the executable is exactly `/usr/bin/mcpproxy`,
+   the owning package manager confirms it owns the file
    (`/var/lib/dpkg/info/mcpproxy.list` for deb; for rpm, an rpm database
    exists **and** a one-shot `rpm -qf /usr/bin/mcpproxy` query names the
-   `mcpproxy` package). Both signals are required — a binary merely copied to
-   `/usr/bin` (e.g. an AUR or manual install), even on an RPM-based distro,
-   stays `unknown`.
+   `mcpproxy` package), **and** the MCPProxy repository is configured
+   (`/etc/apt/sources.list.d/mcpproxy.list` resp.
+   `/etc/yum.repos.d/mcpproxy.repo`, as written by the documented setup).
+   The repo signal matters because the apt/dnf commands only work against
+   `apt.mcpproxy.app` / `rpm.mcpproxy.app`: a standalone `.deb`/`.rpm`
+   downloaded from a GitHub release is dpkg/rpm-owned but has no upgrade
+   candidate, so it stays `unknown` and gets release-page guidance. A binary
+   merely copied to `/usr/bin` (e.g. an AUR or manual install) also stays
+   `unknown`.
 4. **DMG**: on macOS, the executable runs from an `.app/Contents/MacOS` or
    `.app/Contents/Resources/bin` bundle path, or is the tray-staged core at
    `~/Library/Application Support/mcpproxy/bin/mcpproxy` (the process that

internal/httpapi/contracts_test.go

@@ -695,6 +695,12 @@ func TestInfoEndpointIncludesUpdateInfo(t *testing.T) {
 	// The two additive Spec 079 US2 fields.
 	assert.Equal(t, "homebrew", updateInfo["install_channel"], "update info should carry the detected install channel")
 	assert.Equal(t, "brew upgrade mcpproxy", updateInfo["update_command"], "update info should carry the channel update command when an update is available")
+
+	// The top-level version must match the checker's current version: they
+	// are identical for packaged builds, and for go-install builds the
+	// checker promotes the build-info module version while the ldflags
+	// default would read "development" (Spec 079 US2).
+	assert.Equal(t, "v1.0.0", data["version"], "top-level version should prefer the checker's current version")
 }
 
 // MockControllerWithUpdateInfo extends MockServerController with update info

internal/httpapi/server.go

@@ -1055,6 +1055,23 @@ func (s *Server) handleGetInfo(w http.ResponseWriter, r *http.Request) {
 	// Get version from build info or environment
 	version := GetBuildVersion()
 
+	// Update information - refresh if requested
+	refresh := r.URL.Query().Get("refresh") == "true"
+	var versionInfo *updatecheck.VersionInfo
+	if refresh {
+		versionInfo = s.controller.RefreshVersionInfo()
+	} else {
+		versionInfo = s.controller.GetVersionInfo()
+	}
+	if versionInfo != nil && versionInfo.CurrentVersion != "" {
+		// The checker's current version is the ldflags build version for
+		// every packaged build, but for go-install builds it is promoted to
+		// the module version recorded in build info (Spec 079 US2) — the
+		// ldflags default would render "development" on the status/Web UI
+		// surfaces next to a real go-install update command.
+		version = versionInfo.CurrentVersion
+	}
+
 	response := map[string]interface{}{
 		"version":     version,
 		"web_ui_url":  webUIURL,
@@ -1064,15 +1081,6 @@ func (s *Server) handleGetInfo(w http.ResponseWriter, r *http.Request) {
 			"socket": getSocketPath(), // Returns socket path if enabled, empty otherwise
 		},
 	}
-
-	// Add update information - refresh if requested
-	refresh := r.URL.Query().Get("refresh") == "true"
-	var versionInfo *updatecheck.VersionInfo
-	if refresh {
-		versionInfo = s.controller.RefreshVersionInfo()
-	} else {
-		versionInfo = s.controller.GetVersionInfo()
-	}
 	if versionInfo != nil {
 		response["update"] = versionInfo.ToAPIResponse()
 	}

internal/updatecheck/channel.go

@@ -152,20 +152,30 @@ func (d *channelDetector) detect() string {
 		return ChannelDocker
 	}
 
-	// (3) deb/rpm: require BOTH the package-manager-owned install path AND
-	// package-specific ownership evidence. dpkg keeps a per-package file list
-	// (mcpproxy.list); rpm has no per-package file to stat, so the database
-	// presence (host is RPM-based) is confirmed with an `rpm -qf` ownership
-	// query — the DB alone would misclassify a manual tarball copy to
-	// /usr/bin/mcpproxy on any RPM distro. AUR/manual installs have neither
-	// and must fall to unknown; both matching is ambiguous and also falls to
-	// unknown. This branch is terminal for the /usr/bin/mcpproxy path: never
-	// guess (FR-009).
+	// (3) deb/rpm: require the package-manager-owned install path AND
+	// package-specific ownership evidence AND the MCPProxy repository being
+	// configured. dpkg keeps a per-package file list (mcpproxy.list); rpm has
+	// no per-package file to stat, so the database presence (host is
+	// RPM-based) is confirmed with an `rpm -qf` ownership query — the DB
+	// alone would misclassify a manual tarball copy to /usr/bin/mcpproxy on
+	// any RPM distro. The repo-config file (the documented setup writes
+	// /etc/apt/sources.list.d/mcpproxy.list resp. /etc/yum.repos.d/
+	// mcpproxy.repo) is required because the apt/dnf update commands only
+	// work against apt.mcpproxy.app / rpm.mcpproxy.app: a standalone .deb/
+	// .rpm downloaded from a GitHub release is dpkg/rpm-owned but has no
+	// upgrade candidate, so it degrades to unknown and gets the release-page
+	// guidance instead of a no-op command. AUR/manual installs have neither
+	// signal and must fall to unknown; both package managers matching is
+	// ambiguous and also falls to unknown. This branch is terminal for the
+	// /usr/bin/mcpproxy path: never guess (FR-009).
 	if d.goos == "linux" && path == "/usr/bin/mcpproxy" {
-		hasDeb := d.statFile("/var/lib/dpkg/info/mcpproxy.list") == nil
+		hasDeb := d.statFile("/var/lib/dpkg/info/mcpproxy.list") == nil &&
+			d.statFile("/etc/apt/sources.list.d/mcpproxy.list") == nil
 		rpmDBPresent := d.statFile("/var/lib/rpm/rpmdb.sqlite") == nil ||
 			d.statFile("/var/lib/rpm/Packages") == nil
-		hasRPM := rpmDBPresent && d.rpmOwnsBinary()
+		hasRPM := rpmDBPresent &&
+			d.statFile("/etc/yum.repos.d/mcpproxy.repo") == nil &&
+			d.rpmOwnsBinary()
 		switch {
 		case hasDeb && !hasRPM:
 			return ChannelDeb

internal/updatecheck/channel_test.go

@@ -96,12 +96,13 @@ func TestDetectChannel_Docker(t *testing.T) {
 
 func TestDetectChannel_DebRequiresBothSignals(t *testing.T) {
 	dpkgList := "/var/lib/dpkg/info/mcpproxy.list"
+	aptRepo := "/etc/apt/sources.list.d/mcpproxy.list"
 
-	t.Run("path + dpkg entry -> deb", func(t *testing.T) {
+	t.Run("path + dpkg entry + apt repo -> deb", func(t *testing.T) {
 		d := testDetector()
 		d.execPath = func() (string, error) { return "/usr/bin/mcpproxy", nil }
 		d.statFile = func(p string) error {
-			if p == dpkgList {
+			if p == dpkgList || p == aptRepo {
 				return nil
 			}
 			return os.ErrNotExist
@@ -111,6 +112,23 @@ func TestDetectChannel_DebRequiresBothSignals(t *testing.T) {
 		}
 	})
 
+	t.Run("standalone GitHub .deb without the apt repo -> unknown", func(t *testing.T) {
+		// dpkg owns the binary, but without apt.mcpproxy.app configured the
+		// apt upgrade command would be a no-op — degrade to unknown so the
+		// release-page guidance is shown instead (FR-009).
+		d := testDetector()
+		d.execPath = func() (string, error) { return "/usr/bin/mcpproxy", nil }
+		d.statFile = func(p string) error {
+			if p == dpkgList {
+				return nil
+			}
+			return os.ErrNotExist
+		}
+		if got := d.detect(); got != ChannelUnknown {
+			t.Errorf("detect() = %q, want %q", got, ChannelUnknown)
+		}
+	})
+
 	t.Run("dpkg entry without the path -> not deb", func(t *testing.T) {
 		d := testDetector()
 		d.execPath = func() (string, error) { return "/usr/local/bin/mcpproxy", nil }
@@ -135,11 +153,13 @@ func TestDetectChannel_DebRequiresBothSignals(t *testing.T) {
 }
 
 func TestDetectChannel_RPMRequiresBothSignals(t *testing.T) {
-	t.Run("path + rpmdb.sqlite + rpm ownership -> rpm", func(t *testing.T) {
+	yumRepo := "/etc/yum.repos.d/mcpproxy.repo"
+
+	t.Run("path + rpmdb.sqlite + yum repo + rpm ownership -> rpm", func(t *testing.T) {
 		d := testDetector()
 		d.execPath = func() (string, error) { return "/usr/bin/mcpproxy", nil }
 		d.statFile = func(p string) error {
-			if p == "/var/lib/rpm/rpmdb.sqlite" {
+			if p == "/var/lib/rpm/rpmdb.sqlite" || p == yumRepo {
 				return nil
 			}
 			return os.ErrNotExist
@@ -150,11 +170,11 @@ func TestDetectChannel_RPMRequiresBothSignals(t *testing.T) {
 		}
 	})
 
-	t.Run("path + legacy Packages db + rpm ownership -> rpm", func(t *testing.T) {
+	t.Run("path + legacy Packages db + yum repo + rpm ownership -> rpm", func(t *testing.T) {
 		d := testDetector()
 		d.execPath = func() (string, error) { return "/usr/bin/mcpproxy", nil }
 		d.statFile = func(p string) error {
-			if p == "/var/lib/rpm/Packages" {
+			if p == "/var/lib/rpm/Packages" || p == yumRepo {
 				return nil
 			}
 			return os.ErrNotExist
@@ -172,7 +192,7 @@ func TestDetectChannel_RPMRequiresBothSignals(t *testing.T) {
 		d := testDetector()
 		d.execPath = func() (string, error) { return "/usr/bin/mcpproxy", nil }
 		d.statFile = func(p string) error {
-			if p == "/var/lib/rpm/rpmdb.sqlite" {
+			if p == "/var/lib/rpm/rpmdb.sqlite" || p == yumRepo {
 				return nil
 			}
 			return os.ErrNotExist
@@ -183,6 +203,24 @@ func TestDetectChannel_RPMRequiresBothSignals(t *testing.T) {
 		}
 	})
 
+	t.Run("standalone GitHub .rpm without the yum repo -> unknown", func(t *testing.T) {
+		// rpm owns the binary, but without rpm.mcpproxy.app configured the
+		// dnf upgrade command has no candidate — degrade to unknown so the
+		// release-page guidance is shown instead (FR-009).
+		d := testDetector()
+		d.execPath = func() (string, error) { return "/usr/bin/mcpproxy", nil }
+		d.statFile = func(p string) error {
+			if p == "/var/lib/rpm/rpmdb.sqlite" {
+				return nil
+			}
+			return os.ErrNotExist
+		}
+		d.rpmOwnsBinary = func() bool { return true }
+		if got := d.detect(); got != ChannelUnknown {
+			t.Errorf("detect() = %q, want %q", got, ChannelUnknown)
+		}
+	})
+
 	t.Run("both dpkg and rpm evidence is ambiguous -> unknown", func(t *testing.T) {
 		d := testDetector()
 		d.execPath = func() (string, error) { return "/usr/bin/mcpproxy", nil }