fix: AI incorrectly using local exec for remote nodes + KB download

1. AI system prompt now clearly states [EXEC] ALWAYS runs locally and
   when asking about a specific remote node, [EXEC_ALL] must be used.
   Also clarifies Proxmox nodes cannot be exec'd into — use metrics.

2. setup.sh now downloads the AI knowledge base from GitHub when
   installing from prebuilt binary (previously only worked from source).

Author: Paul C

setup.sh

@@ -986,10 +986,19 @@ fi
 echo "✓ wolfstack installed to /usr/local/bin/wolfstack"
 
 # ─── Install AI knowledge base ──────────────────────────────────────────────
-if [ -d "$INSTALL_DIR/knowledge" ]; then
-    mkdir -p /etc/wolfstack/knowledge
+mkdir -p /etc/wolfstack/knowledge
+if [ -d "$INSTALL_DIR/knowledge" ] && ls "$INSTALL_DIR/knowledge/"*.md >/dev/null 2>&1; then
     cp "$INSTALL_DIR/knowledge/"*.md /etc/wolfstack/knowledge/ 2>/dev/null || true
-    echo "✓ AI knowledge base installed"
+    echo "✓ AI knowledge base installed (from source)"
+else
+    # Download knowledge base from GitHub (for prebuilt binary installs)
+    echo "  Downloading AI knowledge base..."
+    KB_URL="https://raw.githubusercontent.com/wolfsoftwaresystemsltd/WolfStack/${CHANNEL:-master}/knowledge/wolfstack-kb.md"
+    if curl -fsSL --connect-timeout 10 -o /etc/wolfstack/knowledge/wolfstack-kb.md "$KB_URL" 2>/dev/null; then
+        echo "✓ AI knowledge base installed"
+    else
+        echo "  ⚠ Could not download AI knowledge base (non-critical)"
+    fi
 fi
 
 # ─── Install web UI ─────────────────────────────────────────────────────────

src/ai/mod.rs

@@ -1370,17 +1370,19 @@ fn build_system_prompt(knowledge: &str, server_context: &str) -> String {
          - **Run read-only commands** on this server and across the WolfStack cluster\n\n\
          ## Command Execution\n\
          You can run commands on the server by using these special tags:\n\
-         - `[EXEC]command[/EXEC]` — runs the command on this server only\n\
-         - `[EXEC_ALL]command[/EXEC_ALL]` — runs the command on ALL WolfStack servers in the cluster\n\n\
-         **Rules:**\n\
+         - `[EXEC]command[/EXEC]` — runs the command on the LOCAL WolfStack node only (the machine running this dashboard)\n\
+         - `[EXEC_ALL]command[/EXEC_ALL]` — runs the command on ALL WolfStack nodes in the cluster. Results come back labelled by hostname.\n\n\
+         **CRITICAL RULES:**\n\
+         - [EXEC] ALWAYS runs on the LOCAL node — even if the user is viewing a different node in the dashboard\n\
+         - When the user asks about a SPECIFIC REMOTE node (e.g. 'what is using CPU on pbs?'), you MUST use [EXEC_ALL] and then look at the results for that specific hostname in the output\n\
+         - Do NOT use [EXEC] when the user asks about a remote node — [EXEC] cannot reach remote nodes\n\
          - Only read-only commands are allowed (ls, cat, lscpu, df, ps, docker ps, systemctl status, etc.)\n\
          - Destructive commands (rm, kill, reboot, etc.) are blocked and will fail\n\
-         - Use [EXEC_ALL] when the user asks about the cluster or all servers\n\
-         - Use [EXEC] when the user asks about this specific server\n\
          - You MUST use these tags when the user asks a question that requires live data\n\
          - Do NOT just tell the user how to run a command — run it yourself and present the results\n\
          - After receiving command output, summarize the results clearly for the user\n\
-         - Keep commands simple and focused\n\n\
+         - Keep commands simple and focused\n\
+         - When showing results from [EXEC_ALL], clearly label which node each result came from\n\n\
          ## Cluster Topology\n\
          - All WolfStack nodes are **equal peers** — do NOT label any node as 'main', 'primary', or 'secondary'\n\
          - Each node runs whatever Wolf components it needs; not all nodes run the same services\n\
@@ -1389,7 +1391,8 @@ fn build_system_prompt(knowledge: &str, server_context: &str) -> String {
          ## Proxmox Nodes\n\
          - Proxmox nodes are **monitored but not managed** — you can see their metrics, VM/CT counts, and status\n\
          - You CANNOT execute commands on Proxmox nodes (they don't run WolfStack agents)\n\
-         - Proxmox data is shown in the server state below; use it to answer questions about the infrastructure\n\
+         - For Proxmox node issues (high CPU, high memory), use the metrics data provided below — you cannot SSH or exec into them\n\
+         - When a user asks about a Proxmox node, answer from the metrics/VM/CT data, and explain you cannot run commands on it\n\
          - When reporting on the full infrastructure, include Proxmox node health data (CPU, RAM, disk)\n\n\
          ## Proposed Actions (Fix It)\n\
          When you identify a problem and know how to fix it, propose the fix using ACTION tags.\n\