JARVIS X — premium light-first AI workspace foundation

.env.example

@@ -0,0 +1,12 @@
+VITE_SUPABASE_URL=https://tmlrveloeirxsankeqrs.supabase.co
+VITE_SUPABASE_PUBLISHABLE_KEY=replace_with_supabase_publishable_key
+VITE_CHAT_FUNCTION_URL=https://tmlrveloeirxsankeqrs.supabase.co/functions/v1/jarvis-chat
+
+# Server-side only — set in Supabase Edge Function Secrets, never in VITE_ variables:
+# GEMINI_API_KEY=
+# GITHUB_TOKEN=
+# CLOUDFLARE_API_TOKEN=
+# CLOUDFLARE_ACCOUNT_ID=
+# TAVILY_API_KEY=
+# APP_ORIGIN=
+# JARVIS_GATEWAY_URL=https://<your-worker-subdomain>.workers.dev

.github/workflows/build.yml

@@ -1,20 +1,18 @@
-name: Production build and browser smoke tests
-
+name: JARVIS X build and tests
 on:
   push:
-    branches: [main]
+    branches: [main, jarvis-x-foundation]
   pull_request:
     branches: [main]
-
 jobs:
-  build-and-test:
+  verify:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 22
       - run: npm install
-      - run: npx playwright install --with-deps chromium
+      - run: npm test
+      - run: node --check cloudflare/worker.js
       - run: npm run build
-      - run: npm run test:e2e

.github/workflows/deploy-cloudflare.yml

@@ -0,0 +1,77 @@
+name: Deploy generated project to Cloudflare Pages
+on:
+  workflow_dispatch:
+    inputs:
+      project_name:
+        description: Cloudflare Pages project name
+        required: true
+        type: string
+      branch:
+        description: Source repository branch
+        required: true
+        default: main
+        type: string
+      repository:
+        description: owner/repository to build and deploy
+        required: true
+        type: string
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ inputs.repository }}
+          ref: ${{ inputs.branch }}
+          token: ${{ secrets.GITHUB_TOKEN_JARVIS }}
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Install dependencies without lifecycle scripts
+        run: npm install --ignore-scripts --no-audit --no-fund
+      - name: Run project tests when available
+        run: npm test --if-present
+      - name: Build project
+        env:
+          VITE_SUPABASE_URL: ${{ secrets.VITE_SUPABASE_URL }}
+          VITE_SUPABASE_PUBLISHABLE_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_KEY }}
+          VITE_CHAT_FUNCTION_URL: ${{ secrets.VITE_CHAT_FUNCTION_URL }}
+        run: npm run build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: jarvis-pages-dist
+          path: dist/
+          if-no-files-found: error
+          retention-days: 1
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: jarvis-pages-dist
+          path: dist
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Install Wrangler
+        run: npm install --global wrangler
+      - name: Create Pages project if needed
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          PROJECT_NAME: ${{ inputs.project_name }}
+          BRANCH: ${{ inputs.branch }}
+        run: wrangler pages project create "$PROJECT_NAME" --production-branch "$BRANCH" || true
+      - name: Deploy static build
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          PROJECT_NAME: ${{ inputs.project_name }}
+          BRANCH: ${{ inputs.branch }}
+        run: wrangler pages deploy dist --project-name "$PROJECT_NAME" --branch "$BRANCH"

.github/workflows/deploy-worker.yml

@@ -0,0 +1,39 @@
+name: Deploy JARVIS X gateway Worker
+on:
+  workflow_dispatch:
+jobs:
+  deploy-worker:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: jarvis-x-foundation
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Install Wrangler
+        run: npm install --global wrangler
+      - name: Configure Worker secrets
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
+          SUPABASE_PUBLISHABLE_KEY: ${{ secrets.SUPABASE_PUBLISHABLE_KEY }}
+          JARVIS_OWNER_EMAILS: ${{ secrets.JARVIS_OWNER_EMAILS }}
+          APP_ORIGIN: ${{ secrets.APP_ORIGIN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN_JARVIS }}
+          GITHUB_OWNER: ${{ secrets.GITHUB_OWNER }}
+          GITHUB_REPO: ${{ secrets.GITHUB_REPO }}
+          CLOUDFLARE_PAGES_READY: 'true'
+        run: |
+          set -euo pipefail
+          for key in SUPABASE_URL SUPABASE_PUBLISHABLE_KEY JARVIS_OWNER_EMAILS APP_ORIGIN GITHUB_TOKEN GITHUB_OWNER GITHUB_REPO CLOUDFLARE_PAGES_READY; do
+            value="${!key}"
+            if [ -z "$value" ]; then echo "Missing required secret: $key"; exit 1; fi
+            printf '%s' "$value" | wrangler secret put "$key" --config cloudflare/wrangler.toml
+          done
+      - name: Deploy Worker
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: wrangler deploy --config cloudflare/wrangler.toml

README-JARVIS-X.md

@@ -0,0 +1,31 @@
+# JARVIS X
+
+A light, premium personal AI workspace built with Vite and Supabase. The visual system uses pearl, ivory, warm stone and champagne accents; no dark theme or neon gradients.
+
+## Current foundation
+- Responsive web app/PWA shell and Google OAuth entry point.
+- Supabase Auth, persistent chat history, projects, memory, tasks, approvals, agent runs and audit log.
+- Supabase Edge Functions: `jarvis-chat` and `jarvis-agent`.
+- Provider status screen and secret-name checklist.
+- Cloudflare Worker gateway starter and Wrangler deployment config.
+- Risky actions are designed around explicit approvals; credentials remain server-side.
+
+## Local setup
+1. `npm install`
+2. Copy `.env.example` to `.env.local` and set the Supabase URL and publishable key.
+3. In Supabase Auth, enable Google and configure the OAuth redirect URLs for the app domain.
+4. Add `GEMINI_API_KEY` to Supabase Edge Function secrets.
+5. Run `npm run dev`; validate with `npm run build`.
+
+## Supabase Edge Function secrets
+Required for AI chat: `GEMINI_API_KEY`.
+
+Optional integrations: `GITHUB_TOKEN`, `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`, `SEARCH_API_KEY`, `IMAGE_PROVIDER_API_KEY`, `TTS_API_KEY`, `EMAIL_PROVIDER_API_KEY`.
+
+Supabase URL and publishable key are public client configuration values. Never place service-role keys, OAuth client secrets, or provider tokens in frontend variables or source control.
+
+## Cloudflare
+Set `APP_ORIGIN` and provider credentials as Worker secrets/vars. Deploy using Wrangler only after configuring the Cloudflare account and reviewing the deployment target.
+
+## Current limitations
+External GitHub actions, real web search, image generation, file parsing, background scheduling and production Cloudflare deployments still require their provider adapters, credentials, tests and explicit authorization. The presence of a settings entry does not mean an integration is active.

README.md

@@ -1,36 +1,47 @@
-# NEON HORIZON
+# JARVIS X — Personal Intelligence
 
-A browser-based 3D night-drive prototype built with Three.js, Vite and cannon-es.
+A light-first personal AI workspace with a pearl, ivory and champagne visual system. The canonical app is the Vite project at the repository root.
 
-## Requirements
-- Node.js 22 or newer
-- npm
+## Implemented in this branch
+- Responsive chat UI and installable PWA shell.
+- Google OAuth flow with a database-backed email allowlist.
+- Supabase conversation history, model selection, search and custom instructions.
+- Optional automatic memory extraction (off until enabled in Settings).
+- Private file library; image, PDF and plain-text/CSV/JSON analysis.
+- Gemini image generation and natural text-to-speech.
+- Browser speech input with language preference.
+- Tavily web research with source links.
+- Projects, memories, tasks, agent runs and approval queue.
+- Agent planning for generated starter projects, approval-gated GitHub repository creation and Cloudflare Pages deployment.
+- Supabase RLS, private Storage policies and JWT-verified Edge Functions.
+
+See [the feature matrix](docs/FEATURE-MATRIX.md) for limitations and features not yet at full ChatGPT parity.
 
 ## Local development
-```bash
-npm install
-npm run dev
-```
-
-## Production build
-```bash
-npm run build
-npm run preview
-```
-
-The production site is generated in dist/.
-
-## Deployment
-- Vercel: Framework preset Vite, build command `npm run build`, output directory `dist`.
-- Netlify: build command `npm run build`, publish directory `dist`.
-
-## Controls
-- A / D or Left / Right: steer
-- W / Up: accelerate
-- S / Down: brake
-- Space / Shift: nitro
-- Escape: pause
-- Touch: drag left/right to steer; on-screen pedals on touch devices
-
-## Notes
-The vehicle simulation uses a rigid chassis and raycast suspension. It is not a soft-body deformation simulator and does not claim BeamNG.drive parity. Third-party model and texture assets should only be added after their licenses are checked.
+1. Copy `.env.example` to `.env`.
+2. Set `VITE_SUPABASE_URL` and `VITE_SUPABASE_PUBLISHABLE_KEY`.
+3. Run `npm install`, then `npm run dev`.
+4. Run `npm test` and `npm run build`.
+
+## Supabase setup
+- Project ref: `tmlrveloeirxsankeqrs` (Driver saathi; Plivex is not used).
+- Migrations: `supabase/migrations`.
+- Edge Functions: `jarvis-chat`, `jarvis-agent`, `jarvis-research`, `jarvis-image`, `jarvis-tts`.
+- Configure Google OAuth under Supabase Auth → Providers and set allowed redirect URLs.
+- Add approved Gmail addresses to `public.jarvis_allowed_users` using the SQL example in [Provider setup](docs/PROVIDER-SETUP.md). The allowlist is empty by default.
+- Keep all server-side keys in the correct provider's secrets store.
+
+## Credentials by location
+- Supabase Edge Function Secrets: `GEMINI_API_KEY`, `TAVILY_API_KEY`, `JARVIS_GATEWAY_URL`, and optional `APP_ORIGIN`.
+- GitHub Actions Secrets: `GITHUB_TOKEN_JARVIS`, `GITHUB_OWNER`, `GITHUB_REPO`, `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`, `SUPABASE_URL`, `SUPABASE_PUBLISHABLE_KEY`, `JARVIS_OWNER_EMAILS`, `APP_ORIGIN`, and the `VITE_*` frontend build variables.
+- Google OAuth: configure the Client ID and Client Secret in Supabase Auth provider settings.
+- Never use a Supabase service-role or secret key in a `VITE_*` variable or browser code.
+
+## Safety model
+- User data is isolated with RLS and an email allowlist.
+- Repository creation and deployment require explicit approval.
+- The gateway verifies the signed-in user and the approved action payload before performing side effects.
+- Provider keys are never stored in Git history or chat.
+
+## Current status
+This is a working foundation in the `jarvis-x-foundation` branch with CI passing. Provider credentials, OAuth configuration, end-to-end tests and Cloudflare deployment are still required before the live app can be used. This project does not claim full ChatGPT feature parity yet.