docs: update all documentation for Docker, security, update system

- GETTING-STARTED.md: Docker section, update instructions, project structure
- DEPLOYMENT.md: Docker self-hosting, CI/CD pipeline, update system
- ARCHITECTURE.md: withSecurity pattern, Docker infrastructure, perf optimizations
- API-ROUTES.md: withSecurity wrapper, /api/version-check endpoint
- CONTRIBUTING.md: Docker scripts, security requirement for new routes
- STATE-MANAGEMENT.md: useVersionCheck hook
- Fix: repo name 1337vibe -> Devonz in docker-compose + version-check
- Fix: MCPSettings type in mcp.spec.ts

Author: zebbern

app/lib/stores/mcp.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it, vi, beforeEach } from 'vitest';
-import { mcpStore, updateMCPSettings } from './mcp';
+import { mcpStore, updateMCPSettings, type MCPSettings } from './mcp';
 
 // Mock fetch globally
 const mockFetch = vi.fn();
@@ -57,11 +57,11 @@ describe('mcpStore', () => {
     });
 
     it('should update settings', () => {
-      const newSettings = {
+      const newSettings: MCPSettings = {
         maxLLMSteps: 10,
         mcpConfig: {
           mcpServers: {
-            testServer: { command: 'test', args: [], env: {} },
+            testServer: { type: 'stdio', command: 'test', args: [], env: {} },
           },
         },
       };

app/routes/api.version-check.ts

@@ -9,7 +9,7 @@ import { withSecurity } from '~/lib/security';
  */
 async function versionCheckLoader(_args: LoaderFunctionArgs) {
   const owner = 'zebbern';
-  const repo = '1337vibe';
+  const repo = 'Devonz';
   const branch = 'main';
 
   // Get local commit hash (set at build time by pre-start.cjs)

docker-compose.yml

@@ -13,7 +13,7 @@ services:
   # ── Production ────────────────────────────────────────────
   # Pulls from GHCR by default. Use --build to build locally.
   devonz:
-    image: ghcr.io/zebbern/1337vibe:latest
+    image: ghcr.io/zebbern/devonz:latest
     build:
       context: .
       dockerfile: Dockerfile

docs/API-ROUTES.md

@@ -11,6 +11,8 @@ Devonz uses Remix file-based routing. All API endpoints are in `app/routes/api.*
 - `action()` — Handles POST/PUT/DELETE requests
 - `loader()` — Handles GET requests
 
+All route handlers are wrapped with `withSecurity()` from `app/lib/security.ts`. This middleware enforces CORS origin validation, SameSite=Strict cookie policy, and input sanitization.
+
 ---
 
 ## Chat & AI
@@ -133,6 +135,7 @@ Validated with Zod. Returns a data stream with:
 | `/api/system/git-info` | GET | Git installation and version info |
 | `/api/update` | GET | Check for application updates |
 | `/api/bug-report` | POST | Submit bug reports |
+| `/api/version-check` | GET | Compares local commit hash against latest GitHub commit to detect available updates |
 
 ---
 
@@ -166,14 +169,18 @@ const providerSettings = JSON.parse(cookies['providers'] || '{}');
 
 There is no server-side session management — all auth state lives in browser cookies.
 
+Additionally, all routes are protected by the `withSecurity()` wrapper which validates CORS origins, enforces `SameSite=Strict` on cookies, and applies a domain allowlist on the git proxy route (`/api/git-proxy/*`).
+
 ---
 
 ## Error Handling Pattern
 
 API routes follow this pattern:
 
 ```typescript
-export async function action({ request }: ActionFunctionArgs) {
+import { withSecurity } from '~/lib/security';
+
+async function myAction({ request }: ActionFunctionArgs) {
   // 1. Parse request body
   const rawBody = await request.json();
 
@@ -193,4 +200,9 @@ export async function action({ request }: ActionFunctionArgs) {
     return new Response(JSON.stringify({ error: error.message }), { status: 500 });
   }
 }
+
+export const action = withSecurity(myAction, {
+  allowedMethods: ['POST'],
+  rateLimit: false,
+});
 ```

docs/ARCHITECTURE.md

@@ -100,9 +100,9 @@ Handles LLM response parsing and action execution:
 
 ### 7. Server Layer (`app/routes/api.*`)
 
-~35 Remix API routes. See [API Routes](API-ROUTES.md).
+~36 Remix API routes. See [API Routes](API-ROUTES.md).
 
-**Key pattern**: Routes use Remix conventions — `action()` for POST/PUT/DELETE, `loader()` for GET. Server-only code lives in `app/lib/.server/`.
+**Key pattern**: Routes use Remix conventions — `action()` for POST/PUT/DELETE, `loader()` for GET. Server-only code lives in `app/lib/.server/`. All route handlers are wrapped with `withSecurity()` from `app/lib/security.ts`, which enforces CORS origin validation, SameSite cookie attributes, and request sanitization.
 
 ---
 
@@ -196,6 +196,12 @@ User enables Agent Mode + sends task
 
 6. **CSS custom properties for theming**: All theme colors flow through `--bolt-elements-*` variables, enabling runtime theme switching without rebuilds.
 
+7. **Security by default** — Every API route is wrapped with `withSecurity()`, enforcing CORS, SameSite cookies, and a URL allowlist on the git proxy.
+
+8. **Docker-first deployment** — Multi-stage Dockerfile + docker-compose.yml with GHCR CI/CD and optional Watchtower auto-update enables one-command self-hosting.
+
+9. **Startup performance** — Vite `optimizeDeps` pre-bundles critical dependencies and unconfigured LLM providers are skipped during initialization.
+
 ---
 
 ## File Naming Conventions

docs/CONTRIBUTING.md

@@ -138,6 +138,8 @@ describe('MyComponent', () => {
 });
 ```
 
+The project currently has 282 tests across 21 test files.
+
 ### Test File Location
 
 Colocate test files next to source files:
@@ -160,6 +162,8 @@ api.chat.ts           →  POST /api/chat
 api.models.$provider.ts  →  GET /api/models/:provider
 ```
 
+Every route handler must be wrapped with `withSecurity()` from `~/lib/security`. This is mandatory for all new routes.
+
 ### Request Validation
 
 Use Zod for request body validation:
@@ -219,6 +223,7 @@ See [LLM-PROVIDERS.md](LLM-PROVIDERS.md) — step-by-step guide.
 3. Validate input with Zod
 4. Read credentials from cookies
 5. Return `json()` responses with proper status codes
+6. Wrap with `withSecurity()` — import from `~/lib/security` and wrap your handler function
 
 ---
 
@@ -266,3 +271,10 @@ Use conventional commits:
 | `test` | `pnpm test` | Run tests (Vitest) |
 | `test:watch` | `pnpm test:watch` | Watch mode tests |
 | `clean` | `pnpm clean` | Clean build artifacts |
+| `update` | `pnpm run update` | Pull latest and reinstall (git users) |
+| `docker:build` | `pnpm docker:build` | Build Docker image |
+| `docker:run` | `pnpm docker:run` | Run Docker container |
+| `docker:up` | `pnpm docker:up` | Start via Docker Compose |
+| `docker:down` | `pnpm docker:down` | Stop Docker Compose |
+| `docker:dev` | `pnpm docker:dev` | Docker dev mode |
+| `docker:update` | `pnpm docker:update` | Update Docker deployment |

docs/DEPLOYMENT.md

@@ -10,6 +10,101 @@ Devonz supports deploying generated projects to four platforms directly from the
 
 ---
 
+## Docker Self-Hosting
+
+### Quick Start
+
+```bash
+# 1. Clone the repo
+git clone https://github.com/zebbern/Devonz.git
+cd Devonz/bolt.diy
+
+# 2. Copy environment template
+cp .env.example .env.local
+# Edit .env.local with your API keys
+
+# 3. Run with Docker Compose (pulls from GHCR)
+docker compose up -d
+```
+
+### Building Locally
+
+```bash
+pnpm docker:build              # Build image locally
+pnpm docker:run                # Run standalone container
+docker compose up -d --build   # Build + run via Compose
+```
+
+### Docker Image
+
+The project publishes Docker images to GitHub Container Registry on every push to `main`:
+
+- **Image**: `ghcr.io/zebbern/devonz:latest`
+- **Base**: `node:20-slim` with `git` and `curl`
+- **Size**: ~1.5 GB
+- **User**: Non-root (`appuser:1001`)
+
+### Docker Compose Profiles
+
+| Profile | Command | Description |
+| --- | --- | --- |
+| Default | `docker compose up -d` | Production mode |
+| Dev | `docker compose --profile dev up devonz-dev` | Dev mode with hot reload |
+| Auto-Update | `docker compose --profile auto-update up -d` | Adds Watchtower for automatic updates |
+
+### Environment Variables
+
+Set `RUNNING_IN_DOCKER=true` in your Docker environment (automatically set in docker-compose.yml). This adjusts Ollama and LMStudio base URLs to use `host.docker.internal` instead of `localhost`.
+
+See `.env.example` for the complete list of 55+ environment variables.
+
+---
+
+## CI/CD Pipeline
+
+### GitHub Actions
+
+The workflow at `.github/workflows/docker-publish.yml` automatically builds and pushes Docker images to GHCR.
+
+**Triggers:**
+- Push to `main` branch → tags image as `latest` and `sha-<hash>`
+- Push version tag (e.g., `v1.0.0`) → tags image as `1.0.0` and `1.0`
+
+**Features:**
+- Docker Buildx with GitHub Actions cache for fast rebuilds
+- Multi-stage build (base → deps → build → prod-deps → runtime)
+- Automatic authentication via `GITHUB_TOKEN`
+
+---
+
+## Update System
+
+### Version Check
+
+The `/api/version-check` endpoint compares the local git commit hash against the latest commit on `main` via the GitHub API. The `UpdateBanner` component in the UI uses this to show a non-intrusive notification when updates are available.
+
+### Updating
+
+**Git Clone users:**
+```bash
+pnpm run update                # Pulls latest, installs, rebuilds
+pnpm run update -- --skip-build  # Skip rebuild
+```
+
+**Docker users:**
+```bash
+pnpm docker:update   # docker compose pull && docker compose up -d
+```
+
+**Docker auto-update (Watchtower):**
+```bash
+docker compose --profile auto-update up -d
+```
+
+Watchtower polls GHCR every 5 minutes and automatically restarts the container when a new image is available.
+
+---
+
 ## Supported Platforms
 
 | Platform | Push Code | Deploy | Custom Domains | Status Check |

docs/GETTING-STARTED.md

@@ -113,6 +113,8 @@ OPENAI_LIKE_API_MODELS=model-name-1,model-name-2
 
 > **Note**: API keys can also be set through the UI settings panel at runtime. They are stored in browser cookies, not on the server.
 
+> See `.env.example` for the full list of 55+ documented environment variables. Copy it as a starting point: `cp .env.example .env.local`
+
 ---
 
 ## Running the App
@@ -154,13 +156,76 @@ Runs build and start in sequence.
 | `pnpm lint:fix` | Auto-fix lint issues + format with Prettier |
 | `pnpm typecheck` | Run TypeScript type checking (`tsc --noEmit`) |
 | `pnpm clean` | Remove build artifacts |
+| `pnpm run update` | Pull latest code, install deps, rebuild (git clone users) |
+| `pnpm docker:build` | Build production Docker image |
+| `pnpm docker:run` | Run Docker container standalone |
+| `pnpm docker:up` | Start via Docker Compose |
+| `pnpm docker:down` | Stop Docker Compose services |
+| `pnpm docker:dev` | Dev mode with hot reload in Docker |
+| `pnpm docker:update` | Pull latest GHCR image and restart |
+
+---
+
+## Running with Docker
+
+### Quick Start (Pull from GHCR)
+
+```bash
+# Copy env template
+cp .env.example .env.local
+# Edit .env.local with your API keys
+
+# Pull and run
+docker compose up -d
+```
+
+### Build Locally
+
+```bash
+pnpm docker:build    # Build image
+pnpm docker:run      # Run standalone
+# or
+docker compose up -d --build   # Build + run via Compose
+```
+
+### Auto-Update (Watchtower)
+
+```bash
+# Automatically pulls new images every 5 minutes
+docker compose --profile auto-update up -d
+```
+
+The `RUNNING_IN_DOCKER=true` environment variable is set automatically in the Docker Compose configuration, which adjusts Ollama and LMStudio base URLs to use `host.docker.internal`.
+
+---
+
+## Updating Devonz
+
+### Git Clone Users
+
+```bash
+pnpm run update              # Pull, install, rebuild
+pnpm run update -- --skip-build  # Pull + install only
+```
+
+### Docker Users
+
+```bash
+pnpm docker:update           # Pull latest image + restart
+```
+
+The app shows a blue banner at the top of the page when a new version is available, with instructions for both update methods.
 
 ---
 
 ## Project Structure Quick Reference
 
 ```text
 bolt.diy/
+├── .dockerignore         # Docker ignore rules
+├── .github/workflows/    # CI/CD pipelines
+├── Dockerfile            # Production Docker build
+├── docker-compose.yml    # Docker Compose config
 ├── app/                  # Application source code
 │   ├── components/       # React components
 │   ├── lib/              # Core logic

docs/STATE-MANAGEMENT.md

@@ -192,6 +192,7 @@ All hooks live in `app/lib/hooks/`. They often wrap store access or provide data
 | `useShortcuts` | Keyboard shortcut registration |
 | `useSupabaseConnection` | Supabase connection state |
 | `useViewport` | Responsive breakpoint detection |
+| `useVersionCheck` | Polls `/api/version-check` to detect available updates, drives `UpdateBanner` |
 
 ---