🎃 Show the build version and git commit in the UI and the backend startup log #1000

Part of the October Challenge #997.

Why

"Which version are you running?" is the first question on every bug report, and right now nobody can answer it from the product. The UI shows no version anywhere. The backend startup log prints URLs but no version. Inside the container npm_package_version is unset (the backend starts with node dist/src/main.js, start.sh:47), so the OpenTelemetry service.version falls back to 0.0.0 (tracing.ts:33-36). Grafana, n8n and Gitea all show version and commit in the footer or on an About page.

Self-hosted vs Cloud

• Self-hosted: enabled in Community and Business. Images built locally (docker compose build) or from source have no commit, so they show dev and the UI must handle that.
• Cloud (DEPLOYMENT_MODE=cloud): enabled. Cloud runs the same public helpcodeai/anythingmcp image built from this AGPL repo, so version and commit reveal nothing private and nothing tenant-specific. Serve them only to signed-in users anyway. Do not add them to the unauthenticated /health/server-info, because that would hand vulnerability scanners a free fingerprint.
• Who can use it: any signed-in user (all roles) sees version and short commit in the footer. Admins also get a copyable "About this instance" block in Settings → Administration. Nothing here is per-org.

What to build

1. Single source of truth: create packages/backend/src/common/app-version.ts and move readAppVersion() there from mcp-endpoint.controller.ts:80-110 (keep its walk-up logic and its comment, which explains why). Export APP_VERSION, APP_COMMIT (process.env.APP_COMMIT || process.env.SENTRY_RELEASE || 'dev') and APP_BUILD_DATE (process.env.APP_BUILD_DATE || null). Use them in mcp-endpoint.controller.ts, tracing.ts:33-36, and as the fallback in instrument.ts:31.
2. Startup log: in main.ts before line 209, log one line: AnythingMCP v0.18.0 (commit 3bd9f8b, built 2026-10-04, mode self-hosted).
3. Endpoint: GET /api/version behind AuthGuard('jwt') that returns { version, commit, buildDate, deploymentMode }. Put it in a new small controller in packages/backend/src/health/ and register it in health.module.ts.
4. Docker: in the runner stage of the Dockerfile (near lines 114-116), add ARG APP_COMMIT= / ARG APP_BUILD_DATE= → ENV, and add the OCI labels org.opencontainers.image.revision and org.opencontainers.image.version. In .github/workflows/docker-publish.yml:70-71, add APP_COMMIT=${{ github.sha }} and a build date to build-args. Edits under .github/ get extra review (see the comment at docker-publish.yml:86-92), so keep the diff minimal. deploy-cloud.yml needs no change because it pulls the published image.
5. Frontend: Footer (components/footer.tsx:59-79) appends v0.18.0 · 3bd9f8b. If the commit is a 40-hex SHA, it links to https://github.com/HelpCode-ai/anythingmcp/commit/<sha>; dev is plain text. Fetch it once per session (signed-in only, since the footer only renders inside AppShell). Add a "Copy version info" card to app/settings/admin/page.tsx.

Where to look

• packages/backend/src/mcp-server/mcp-endpoint.controller.ts:80-110: existing readAppVersion().
• packages/backend/src/tracing.ts:33-36, packages/backend/src/instrument.ts:31: version fallbacks that are wrong in the container.
• packages/backend/src/main.ts:209-212: startup log lines.
• packages/backend/src/health/health.controller.ts:30-72: public server-info. Do not add the version here.
• Dockerfile:94-116: SENTRY_RELEASE is already passed as a build arg and set as ENV (copy this pattern). Dockerfile:150-156: OCI labels.
• .github/workflows/docker-publish.yml:65-82: image build.
• packages/frontend/src/components/footer.tsx, packages/frontend/src/lib/api.ts:964: server client.

Acceptance criteria

• docker build --build-arg APP_COMMIT=$(git rev-parse HEAD) . → the footer and startup log show the short SHA. Without the arg they show dev.
• GET /api/version returns 401 without a JWT. /health/server-info is unchanged.
• Unit test app-version.spec.ts covers the env precedence and the dev fallback (cd packages/backend && npm test).
• The MCP serverInfo.version still equals package.json version.
• docs/deployment.md mentions the build args, and docs/operations/observability.md notes that service.version now comes from APP_VERSION.

Out of scope

• "Update available" checks (outbound calls to GitHub, especially on Cloud).
• Changing the release/versioning process or the tags docker-publish.yml pushes.
• Showing Node or dependency versions.

Size

S (a few hours)

How to claim

Comment "I'd like to work on this" and we'll assign you. Rules in #997.