Someone asked in Discord how to give Jarvis access to their whole
machine and hit a confusing failure. With no ~/.openjarvis/config.toml,
tools.enabled and agent.tools both come back empty, and SystemBuilder
builds the agent with no tools at all. It reads like a permissions
problem but it's just missing config, and nothing in the docs points
you anywhere useful.
Adds docs/user-guide/system-access.md, covering the empty tool list as
the usual cause, what shell_exec and the file tools actually reach,
which entry points prompt for confirmation and which quietly
auto-approve, Full Disk Access on macOS and which process needs it, and
the fact that there's no computer use at all, so Accessibility and
Screen Recording grants buy you nothing on their own.
Also adds a full-system-access.toml example to copy from.
Fixes two config tables that describe security.enforce_tool_confirmation
as requiring confirmation before tools run. The loader accepts the key
but nothing on the execution path reads it, so anyone setting it gets
assurance they don't actually have.
* security: harden network-exposed surface
Hardening for the network-reachable attack surface, prioritizing fixes
that are strong but do not change working local/loopback defaults.
- auth_middleware: constant-time API key comparison (secrets.compare_digest)
for the HTTP path, and gate /metrics behind auth so operational counters
are not readable unauthenticated. /health stays open.
- webhook_routes: fail closed when a channel's secret/token is unset. Twilio,
BlueBubbles, WhatsApp (verify + inbound), and SendBlue now reject (403)
instead of processing unsigned/unauthenticated input. Constant-time
comparisons for BlueBubbles/SendBlue/WhatsApp verify token.
- http_request: follow redirects manually and re-run the SSRF check on every
hop (capped at 5) so an allowed public URL cannot 30x-redirect to an
internal/metadata address.
- api_routes /v1/memory/index: restrict indexing to OPENJARVIS_WORKSPACE roots
when configured and refuse sensitive files (.env, keys, credentials).
- config.toml: default [server] host to 127.0.0.1 (loopback) with a comment
on how to safely expose to a LAN (0.0.0.0 + API key).
Tests: new fail-closed webhook tests, /metrics auth tests, and SSRF
redirect block/follow tests; updated SendBlue tests for the new
secret-required behavior. Affected suites pass (95 tests), ruff clean.
* fix(http): keep SSRF redirect-following patchable via httpx.request
The manual redirect-following loop used a private httpx.Client, which
bypassed the `http_request.httpx.request` mock seam that consumers' tests
rely on (e.g. the twitter-bot GitHub-issue tests escaped to the real
network and 401'd). Issue each hop via module-level httpx.request with
follow_redirects=False instead — same per-hop SSRF re-check, restored
testability.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Jon Saad-Falcon <jonsaadfalcon@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
configs/openjarvis/config.toml is the file users copy as their starting
configuration. It explicitly set [security] enabled = false (with a
comment about eval performance) — meaning users who follow the
quickstart unknowingly run with GuardrailsEngine, InjectionScanner,
CapabilityPolicy, and rate limiting all disabled.
The SecurityConfig.enabled default in code is True, so removing the
override here lets every install ship with security on. Eval workflows
that genuinely need it disabled can opt out via their own config.
Closes#224
New example configs:
- deep-research.toml — multi-hop research with citations
- code-assistant.toml — orchestrator with code execution + file I/O
- scheduled-monitor.toml — persistent operative on cron schedule
- chat-simple.toml — lightweight chat, no tools
CLI:
- `jarvis init --preset <name>` installs any starter config in one command
- Presets: morning-digest-mac, morning-digest-linux, morning-digest-minimal,
deep-research, code-assistant, scheduled-monitor, chat-simple
All configs tested live on M2 Max with Ollama + Qwen3.5 9B.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Priority-first structure with decreasing importance
- Email triage: real people only, skip automated/marketing
- Message triage: key people + replies needed, acknowledge casual
- Health interpreted as trends, not raw numbers
- Strict 200-word limit, honorific 2-3 times only
- Skip disconnected sources silently
- Tested 7 iterations, each improving on the last
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Prompt rewrite:
- Priority-first briefing structure (deadlines > schedule > messages)
- Interpret health trends, don't list raw numbers
- Connect related items across sections
- Configurable honorific (sir/ma'am/boss) from config.toml
- 250 word limit, no markdown, spoken-aloud format
New connectors:
- Weather (OpenWeatherMap API) — current conditions + 12h forecast
- GitHub Notifications — PR reviews, mentions, assignments
- Hacker News — top 5 stories with scores
- News/RSS — configurable feeds (Arxiv, NYT, WSJ, etc.)
Other:
- Gmail filters to category:primary (no promotions)
- Email body previews in digest data
- iMessage text content included
- WORLD section replaces MUSIC as default
- voice_speed plumbed through full pipeline
- 22 new tests for connectors
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Data collection:
- Restructure digest_collect output into priority-ordered sections
(HEALTH > MESSAGES > CALENDAR > MUSIC) with human-readable formatting
- Extract key metrics from Oura (HR, HRV, sleep duration, scores)
- Format Gmail as sender + subject + time ago
- Group music tracks into single lines per source
- Cap 15 items per source, truncate content to 500 chars
Calendar:
- Pass `since` parameter to Google Calendar API as `timeMin`
- Default to 24h lookback instead of dumping all-time events
Gmail:
- Re-enable gmail connector registration in __init__.py
Prompt:
- Add section summary + closing encouragement to Jarvis persona
- Reinforce no-markdown, no-hallucination rules in user message
- Strip markdown artifacts before sending to TTS
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Full morning digest system:
- MorningDigestAgent, DigestStore, digest_collect tool, TTS backends
- Connectors: Oura, Strava, Spotify, Google Tasks, Apple Health, Apple Music
- CLI `jarvis digest` command + FastAPI /api/digest endpoints
- Cartesia, Kokoro, OpenAI TTS backends with persona prompts
Unified OAuth setup across all surfaces:
- Generic OAuthProvider registry for Google, Strava, Spotify
- CLI auto-opens browser + catches callback (no more paste-code)
- Server /oauth/start + /oauth/callback endpoints for desktop/browser
- Frontend OAuthPanel with popup + polling
Apple connectors:
- Apple Health reads from HealthKit DB or iPhone export XML
- Apple Music queries Music.app via AppleScript
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
