Add manifest-driven automatic firmware updates

[Funkelfetisch]

Summary

• add a generic AutoUpdateModule with an opt-in manifest URL
• select compatible newer OTA app images and require HTTPS, SHA-256, and a nonzero expected image size
• expose product, brand, and update-manifest build information with generated-manifest coverage

Validation

• git diff --check origin/main..HEAD
• spec check: 90/90 modules
• platform-boundary check
• firmware catalog check: 8 variants, 0 issues
• host tests: 55 passed
• focused AutoUpdate C++ tests compile from current sources with -Wall -Wextra -Werror
• fresh ESP32-S3 esp32s3-n8r8 build: projectMM.bin 0x182e40, 50% app partition free

Remaining Before Ready

• run the focused C++ test executable successfully; the Windows host runner did not return after launch, so compilation is not reported as a passing test run
• run the desktop/scenario suite after the existing upstream x86 unit_moonlive_ir.cpp unused-helper warning is fixed
• perform an end-to-end device update against a real HTTPS manifest, including download, verification, flash, reboot, and app-valid behavior

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/core/AutoUpdateModule.h`:
- Line 7: Remove the direct platform/platform.h dependency from AutoUpdateModule
and replace its platform-specific usage with an injected platform-neutral
OTA/HTTP interface. Define or consume the interface in core, provide its
implementation within src/platform/, and wire the runtime layer to inject it
without adding platform includes under src/core/**.
- Around line 150-152: The OTA validation in AutoUpdateModule must reject c.size
== 0 before invoking the checked OTA API, while preserving the existing
oversized-image rejection. In test/unit/core/unit_AutoUpdateModule.cpp, add
manifest cases for an omitted size and an explicit zero size, asserting both are
rejected.
- Around line 183-185: Update AutoUpdateModule::validateUrl to accept only
https:// URLs, while preserving null or empty values as the disabled-checks
case. Also validate the baked-in default manifest URL before any fetch so all
configured and default manifest requests require HTTPS.
- Line 95: Update the OTA lifecycle guard around otaInFlight() to use a separate
atomic or mutex-protected in-flight flag rather than reading g_otaStatus. Set
and clear this flag across the OTA task lifecycle, while keeping g_otaStatus
limited to display/status reporting.

In `@test/unit/core/unit_AutoUpdateModule.cpp`:
- Around line 15-74: Add a test alongside the existing AutoUpdateModule
selection tests for an otherwise valid newer OTA manifest whose installable
object omits size. Assert that selectCandidate returns the appropriate rejection
decision and does not request installation, covering both the standard ota
fixture and the documented size-required behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: d32e49ed-2be2-42dd-a3b1-8f945e148127

📥 Commits

Reviewing files that changed from the base of the PR and between 0c289ab and de1d696.

⛔ Files ignored due to path filters (3)

• moondeck/build/build_esp32.py is excluded by !**/build/**
• moondeck/build/generate_build_info.py is excluded by !**/build/**
• moondeck/build/generate_manifest.py is excluded by !**/build/**

📒 Files selected for processing (12)

• docs/moonmodules/core/services.md
• esp32/main/CMakeLists.txt
• src/core/AutoUpdateModule.h
• src/core/FirmwareUpdateModule.h
• src/main.cpp
• src/platform/desktop/platform_desktop.cpp
• src/platform/esp32/platform_esp32.cpp
• src/platform/esp32/platform_esp32_ota.cpp
• src/platform/platform.h
• test/CMakeLists.txt
• test/unit/core/unit_AutoUpdateModule.cpp
• test/unit/core/unit_FirmwareUpdateModule.cpp

[Funkelfetisch]

Rebased onto current main and updated AutoUpdateModule to the current defineControls/onControlChanged/tick1s lifecycle. The review findings are covered by the injected platform runtime, atomic OTA gate, HTTPS-only manifest validation, mandatory non-zero image sizes, and missing/zero-size tests. Validation: spec check and platform-boundary check passed; desktop production target and focused AutoUpdate test source built; 55 Python host tests passed; esp32s3-n8r8 firmware built (0x182e40, 50% app partition free). The complete desktop test executable is still blocked by the unrelated existing unused 'place' helper in unit_moonlive_ir.cpp under Zig/Werror.