Feat v0.5.4 package updates (#34)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/handlers/packages_bundled.go

@@ -22,13 +22,28 @@ import (
 	"switchboard-core/triggers"
 )
 
+// defaultBundledPackages is the curated set of packages installed by default.
+// Other packages still ship in the Docker image but require BUNDLED_PACKAGES
+// to be set explicitly (or "*" for all).
+var defaultBundledPackages = map[string]bool{
+	"notes":                 true,
+	"chat-core":             true,
+	"workflow-chat":         true,
+	"dashboard":             true,
+	"workflow-demo":         true,
+	"bug-report-triage":     true,
+	"content-approval":      true,
+	"employee-onboarding":   true,
+}
+
 // InstallBundledPackages scans bundledDir for .pkg archives and installs
 // any that don't already exist in the database. Called once at startup
 // (unless SKIP_BUNDLED_PACKAGES=true).
 //
-// allowlist is an optional comma-separated list of package IDs to install.
-// Empty string means install all. This allows Helm/K8s deployments to
-// select a subset: e.g. "tasks,schedules,hello-dashboard".
+// allowlist controls which packages are installed:
+//   - Empty string → install the curated default set (see defaultBundledPackages)
+//   - "*" → install all .pkg archives found in the directory
+//   - Comma-separated IDs → install only those (e.g. "tasks,schedules")
 //
 // Design: install-once, skip-if-present. If an admin uninstalls a bundled
 // package, it won't be re-installed on the next restart.
@@ -43,10 +58,14 @@ func InstallBundledPackages(bundledDir, packagesDir, allowlist string, stores st
 		return
 	}
 
-	// Parse allowlist into a set (empty = allow all)
+	// Parse allowlist: "" → curated defaults, "*" → all, "a,b" → explicit list
 	allowed := parseBundleAllowlist(allowlist)
-	if len(allowed) > 0 {
-		log.Printf("[bundled] Allowlist: %v", allowlist)
+	if allowed != nil {
+		if allowlist == "" || allowlist == " " {
+			log.Printf("[bundled] Using curated default set (%d packages)", len(defaultBundledPackages))
+		} else {
+			log.Printf("[bundled] Allowlist: %v", allowlist)
+		}
 	}
 
 	var installed, skipped, filtered int
@@ -87,10 +106,16 @@ func InstallBundledPackages(bundledDir, packagesDir, allowlist string, stores st
 }
 
 // parseBundleAllowlist parses a comma-separated string into a set of
-// package IDs. Returns nil for empty input (meaning "allow all").
+// package IDs. Returns:
+//   - nil for "*" input (meaning "install all")
+//   - defaultBundledPackages for empty input
+//   - explicit set for comma-separated list
 func parseBundleAllowlist(s string) map[string]bool {
 	s = strings.TrimSpace(s)
 	if s == "" {
+		return defaultBundledPackages
+	}
+	if s == "*" {
 		return nil
 	}
 	parts := strings.Split(s, ",")