Add manifest-driven automatic firmware updates

[Funkelfetisch]

Summary

• add a generic AutoUpdateModule with a configurable manifest URL and empty default
• select compatible newer OTA app images from manifests and validate SHA-256/size before flashing
• expose product/brand/manifest build-info fields and add manifest metadata generation/tests

Validation

• git diff --check origin/main..HEAD
• moondeck/check/check_specs.py
• moondeck/check/check_platform_boundary.py
• product-specific string scan on the PR diff
• moondeck/build/build_esp32.py --firmware esp32s3-n16r8
• esp32s3-n16r8 image: 0x180c50, 62% app partition free

Not Run

• End-to-end device OTA against a real manifest, including download, flash, reboot, and rollback/app-valid behavior
• Desktop CMake/ctest: CMake is not available in this shell

Summary by CodeRabbit

• New Features

  • Added automatic, manifest-driven firmware updates with configurable check intervals, retries, boot delay, and installation controls.
  • Added verified OTA downloads using SHA-256 and expected image size checks.
  • Added firmware product, brand, and update manifest information to the firmware controls.
  • Added OTA status and update metadata documentation.

• Bug Fixes

  • Improved OTA validation and confirmation of successfully booted firmware.

• Tests

  • Added coverage for update selection, version comparison, manifest formats, URL resolution, and firmware metadata controls.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: acf5e4a2-cc76-4393-a193-eb847e7e96aa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/core/AutoUpdateModule.h`:
- Line 7: Remove the direct platform/platform.h dependency from AutoUpdateModule
and replace its platform-specific usage with an injected platform-neutral
OTA/HTTP interface. Define or consume the interface in core, provide its
implementation within src/platform/, and wire the runtime layer to inject it
without adding platform includes under src/core/**.
- Around line 150-152: The OTA validation in AutoUpdateModule must reject c.size
== 0 before invoking the checked OTA API, while preserving the existing
oversized-image rejection. In test/unit/core/unit_AutoUpdateModule.cpp, add
manifest cases for an omitted size and an explicit zero size, asserting both are
rejected.
- Around line 183-185: Update AutoUpdateModule::validateUrl to accept only
https:// URLs, while preserving null or empty values as the disabled-checks
case. Also validate the baked-in default manifest URL before any fetch so all
configured and default manifest requests require HTTPS.
- Line 95: Update the OTA lifecycle guard around otaInFlight() to use a separate
atomic or mutex-protected in-flight flag rather than reading g_otaStatus. Set
and clear this flag across the OTA task lifecycle, while keeping g_otaStatus
limited to display/status reporting.

In `@test/unit/core/unit_AutoUpdateModule.cpp`:
- Around line 15-74: Add a test alongside the existing AutoUpdateModule
selection tests for an otherwise valid newer OTA manifest whose installable
object omits size. Assert that selectCandidate returns the appropriate rejection
decision and does not request installation, covering both the standard ota
fixture and the documented size-required behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: d32e49ed-2be2-42dd-a3b1-8f945e148127

📥 Commits

Reviewing files that changed from the base of the PR and between 0c289ab and de1d696.

⛔ Files ignored due to path filters (3)

• moondeck/build/build_esp32.py is excluded by !**/build/**
• moondeck/build/generate_build_info.py is excluded by !**/build/**
• moondeck/build/generate_manifest.py is excluded by !**/build/**

📒 Files selected for processing (12)

• docs/moonmodules/core/services.md
• esp32/main/CMakeLists.txt
• src/core/AutoUpdateModule.h
• src/core/FirmwareUpdateModule.h
• src/main.cpp
• src/platform/desktop/platform_desktop.cpp
• src/platform/esp32/platform_esp32.cpp
• src/platform/esp32/platform_esp32_ota.cpp
• src/platform/platform.h
• test/CMakeLists.txt
• test/unit/core/unit_AutoUpdateModule.cpp
• test/unit/core/unit_FirmwareUpdateModule.cpp

[Funkelfetisch]

Rebased onto current main and updated AutoUpdateModule to the current defineControls/onControlChanged/tick1s lifecycle. The review findings are covered by the injected platform runtime, atomic OTA gate, HTTPS-only manifest validation, mandatory non-zero image sizes, and missing/zero-size tests. Validation: spec check and platform-boundary check passed; desktop production target and focused AutoUpdate test source built; 55 Python host tests passed; esp32s3-n8r8 firmware built (0x182e40, 50% app partition free). The complete desktop test executable is still blocked by the unrelated existing unused 'place' helper in unit_moonlive_ir.cpp under Zig/Werror.