Fix app bundle agent self-update hash mismatch

Agent self-updates were getting dynamically created ZIPs (with .msh file)
which have different hashes than the pre-calculated hash sent to the agent.

Changes:
- Detect self-update requests (installflags=0, no script parameter)
- Serve pre-built app bundle ZIP directly for self-updates
- Use dynamic packaging only for initial installations
- Preserves hash verification for agent updates

Fixes hash mismatch error during agent self-update with &appbundle=1

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: PeetMcK

webserver.js

@@ -5710,20 +5710,35 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
 
             // Check if this is an app bundle request for macOS
             if ((req.query.appbundle == '1') && (argentInfo.platform == 'osx') && (argentInfo.appBundlePath != null)) {
-                // Create app bundle ZIP with .msh file
-                if (obj.fs.existsSync(argentInfo.appBundlePath)) {
-                    var installflags = parseInt(req.query.installflags) || 0;
-                    if (installflags >= 10) {
+                var installflags = parseInt(req.query.installflags) || 0;
+
+                // Agent self-updates (no installflags or script parameter) should get pre-built ZIP directly
+                if ((installflags == 0) && (req.query.script == null)) {
+                    // Self-update: serve pre-built app bundle ZIP with known hash
+                    if (obj.fs.existsSync(argentInfo.appBundlePath)) {
+                        parent.debug('web', 'Serving pre-built app bundle for self-update: ' + argentInfo.appBundlePath);
+                        setContentDispositionHeader(res, 'application/zip', obj.path.basename(argentInfo.appBundlePath), null, 'MeshAgentAPP.zip');
+                        if (argentInfo.mtime != null) { res.setHeader('Last-Modified', argentInfo.mtime.toUTCString()); }
+                        try { res.sendFile(argentInfo.appBundlePath); } catch (ex) { }
+                        return;
+                    } else {
+                        parent.debug('web', 'App bundle not found: ' + argentInfo.appBundlePath);
+                        res.sendStatus(404);
+                        return;
+                    }
+                } else if (installflags >= 10) {
+                    // Initial installation: create dynamic ZIP with .msh file
+                    if (obj.fs.existsSync(argentInfo.appBundlePath)) {
                         return createMacOSAppBundleZipPackage(req, res, argentInfo, meshsettings, installflags, domain);
                     } else {
-                        // For deprecated mode (installflags < 10), fall back to binary
-                        parent.debug('web', 'App bundle requested with deprecated installflags, falling back to binary');
-                        res.sendStatus(400);
+                        parent.debug('web', 'App bundle not found: ' + argentInfo.appBundlePath);
+                        res.sendStatus(404);
                         return;
                     }
                 } else {
-                    parent.debug('web', 'App bundle not found: ' + argentInfo.appBundlePath);
-                    res.sendStatus(404);
+                    // For deprecated mode (installflags < 10), fall back to binary
+                    parent.debug('web', 'App bundle requested with deprecated installflags, falling back to binary');
+                    res.sendStatus(400);
                     return;
                 }
             }
@@ -5779,20 +5794,35 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
 
             // Check if this is an app bundle request for macOS
             if ((req.query.appbundle == '1') && (argentInfo.platform == 'osx') && (argentInfo.appBundlePath != null)) {
-                // Create app bundle ZIP with .msh file
-                if (obj.fs.existsSync(argentInfo.appBundlePath)) {
-                    var installflags = parseInt(req.query.installflags) || 0;
-                    if (installflags >= 10) {
+                var installflags = parseInt(req.query.installflags) || 0;
+
+                // Agent self-updates (no installflags or script parameter) should get pre-built ZIP directly
+                if ((installflags == 0) && (req.query.script == null)) {
+                    // Self-update: serve pre-built app bundle ZIP with known hash
+                    if (obj.fs.existsSync(argentInfo.appBundlePath)) {
+                        parent.debug('web', 'Serving pre-built app bundle for self-update: ' + argentInfo.appBundlePath);
+                        setContentDispositionHeader(res, 'application/zip', obj.path.basename(argentInfo.appBundlePath), null, 'MeshAgentAPP.zip');
+                        if (argentInfo.mtime != null) { res.setHeader('Last-Modified', argentInfo.mtime.toUTCString()); }
+                        try { res.sendFile(argentInfo.appBundlePath); } catch (ex) { }
+                        return;
+                    } else {
+                        parent.debug('web', 'App bundle not found: ' + argentInfo.appBundlePath);
+                        res.sendStatus(404);
+                        return;
+                    }
+                } else if (installflags >= 10) {
+                    // Initial installation: create dynamic ZIP with .msh file
+                    if (obj.fs.existsSync(argentInfo.appBundlePath)) {
                         return createMacOSAppBundleZipPackage(req, res, argentInfo, meshsettings, installflags, domain);
                     } else {
-                        // For deprecated mode (installflags < 10), fall back to binary
-                        parent.debug('web', 'App bundle requested with deprecated installflags, falling back to binary');
-                        res.sendStatus(400);
+                        parent.debug('web', 'App bundle not found: ' + argentInfo.appBundlePath);
+                        res.sendStatus(404);
                         return;
                     }
                 } else {
-                    parent.debug('web', 'App bundle not found: ' + argentInfo.appBundlePath);
-                    res.sendStatus(404);
+                    // For deprecated mode (installflags < 10), fall back to binary
+                    parent.debug('web', 'App bundle requested with deprecated installflags, falling back to binary');
+                    res.sendStatus(400);
                     return;
                 }
             }