@better-openclaw/core 1.0.23 → 1.0.25

package/src/resolver.test.ts

@@ -1,18 +1,30 @@
 import { describe, expect, it } from "vitest";
 import { resolve } from "./resolver.js";
 
+// Mandatory services (convex, mission-control, tailscale) are always auto-included.
+// These IDs and their combined memory are accounted for in all tests.
+const MANDATORY_IDS = ["convex", "mission-control", "tailscale"];
+const MANDATORY_MEMORY = 256 + 128 + 64; // convex + mission-control + tailscale
+
 describe("resolve", () => {
-	it("returns empty services for empty input", () => {
+	it("returns only mandatory services for empty input", () => {
 		const result = resolve({ services: [], skillPacks: [] });
-		expect(result.services).toHaveLength(0);
+		const ids = result.services.map((s) => s.definition.id);
+		for (const id of MANDATORY_IDS) {
+			expect(ids).toContain(id);
+		}
 		expect(result.isValid).toBe(true);
-		expect(result.estimatedMemoryMB).toBe(512); // base OpenClaw only
+		// 512 (base) + mandatory services memory
+		expect(result.estimatedMemoryMB).toBe(512 + MANDATORY_MEMORY);
 	});
 
-	it("resolves a single service with no dependencies", () => {
+	it("resolves a single service alongside mandatory services", () => {
 		const result = resolve({ services: ["redis"], skillPacks: [] });
-		expect(result.services).toHaveLength(1);
-		expect(result.services[0]!.definition.id).toBe("redis");
+		const ids = result.services.map((s) => s.definition.id);
+		expect(ids).toContain("redis");
+		for (const id of MANDATORY_IDS) {
+			expect(ids).toContain(id);
+		}
 		expect(result.isValid).toBe(true);
 	});
 
@@ -97,8 +109,8 @@ describe("resolve", () => {
 
 	it("estimates memory correctly", () => {
 		const result = resolve({ services: ["redis"], skillPacks: [] });
-		// 512 (base) + 128 (redis) = 640
-		expect(result.estimatedMemoryMB).toBe(640);
+		// 512 (base) + 128 (redis) + mandatory services
+		expect(result.estimatedMemoryMB).toBe(512 + 128 + MANDATORY_MEMORY);
 	});
 
 	it("adds proxy service when specified", () => {
@@ -133,18 +145,15 @@ describe("resolve", () => {
 	});
 
 	it("warns about GPU when AI services selected without gpu flag", () => {
-		// Ollama doesn't have gpuRequired=true (it's recommended not required)
-		// but we should still check GPU warning logic works
 		const result = resolve({ services: ["redis"], skillPacks: [], gpu: false });
-		// Redis doesn't need GPU, so no GPU warnings
 		const gpuWarnings = result.warnings.filter((w) => w.type === "gpu");
 		expect(gpuWarnings).toHaveLength(0);
 	});
 
-	it("resolves tailscale as single service with no dependencies", () => {
-		const result = resolve({ services: ["tailscale"], skillPacks: [] });
-		expect(result.services).toHaveLength(1);
-		expect(result.services[0]!.definition.id).toBe("tailscale");
+	it("resolves tailscale (mandatory, always present)", () => {
+		const result = resolve({ services: [], skillPacks: [] });
+		const ids = result.services.map((s) => s.definition.id);
+		expect(ids).toContain("tailscale");
 		expect(result.isValid).toBe(true);
 	});
 
@@ -201,4 +210,33 @@ describe("resolve", () => {
 		expect(backendIdx).toBeGreaterThan(livekitIdx);
 		expect(frontendIdx).toBeGreaterThan(backendIdx);
 	});
+
+	// ── Mandatory services enforcement ──────────────────────────────────────
+
+	it("auto-includes mandatory services even when not selected", () => {
+		const result = resolve({ services: ["redis"], skillPacks: [] });
+		const ids = result.services.map((s) => s.definition.id);
+		expect(ids).toContain("mission-control");
+		expect(ids).toContain("convex");
+		expect(ids).toContain("tailscale");
+		const mc = result.services.find((s) => s.definition.id === "mission-control");
+		expect(mc!.addedBy).toBe("mandatory");
+	});
+
+	it("marks user-selected mandatory services as 'user' not 'mandatory'", () => {
+		const result = resolve({ services: ["mission-control"], skillPacks: [] });
+		const mc = result.services.find((s) => s.definition.id === "mission-control");
+		expect(mc!.addedBy).toBe("user");
+		// convex should still be auto-added as dependency of mission-control
+		const convex = result.services.find((s) => s.definition.id === "convex");
+		expect(convex).toBeDefined();
+	});
+
+	it("orders convex before mission-control (dependency ordering)", () => {
+		const result = resolve({ services: ["redis"], skillPacks: [] });
+		const ids = result.services.map((s) => s.definition.id);
+		const convexIdx = ids.indexOf("convex");
+		const mcIdx = ids.indexOf("mission-control");
+		expect(convexIdx).toBeLessThan(mcIdx);
+	});
 });

package/src/resolver.ts

@@ -1,4 +1,4 @@
-import { getServiceById } from "./services/registry.js";
+import { getAllServices, getServiceById } from "./services/registry.js";
 import { getSkillPackById } from "./skills/registry.js";
 import type {
 	AddedDependency,
@@ -99,6 +99,18 @@ export function resolve(input: ResolverInput): ResolverOutput {
 		}
 	}
 
+	// Add mandatory platform services (mission-control, convex, tailscale, etc.)
+	for (const def of getAllServices()) {
+		if (def.mandatory && !serviceIds.has(def.id)) {
+			serviceIds.add(def.id);
+			serviceAddedBy.set(def.id, "mandatory");
+			addedDependencies.push({
+				service: def.id,
+				reason: "Mandatory OpenClaw platform service",
+			});
+		}
+	}
+
 	// Validate all service IDs exist
 	const unknownIds: string[] = [];
 	for (const id of serviceIds) {

package/src/schema.ts

@@ -38,6 +38,7 @@ export const ServiceCategorySchema = z.enum([
 	"business-intelligence",
 	"dns-networking",
 	"iot",
+	"saas-boilerplate",
 ]);
 
 export const MaturitySchema = z.enum(["stable", "beta", "experimental"]);
@@ -153,6 +154,48 @@ export const NativeRecipeSchema = z.object({
 	systemdUnit: z.string().optional(),
 });
 
+// ─── Git Source / Build Context (for repo-based services) ───────────────────
+
+export const GitSourceSchema = z.object({
+	/** Git clone URL, e.g. "https://github.com/wasp-lang/open-saas.git" */
+	repoUrl: z.string().url(),
+	/** Branch or tag to clone. Defaults to repo's default branch. */
+	branch: z.string().optional(),
+	/** Subdirectory within the cloned repo to use as build context root. */
+	subdirectory: z.string().optional(),
+	/** Commands to run after cloning (e.g. "cp .env.example .env"). */
+	postCloneCommands: z.array(z.string()).default([]),
+});
+
+export const BuildContextSchema = z.object({
+	/** Path to Dockerfile relative to the context root. Defaults to "Dockerfile". */
+	dockerfile: z.string().optional(),
+	/** Build context path relative to the subdirectory root. Defaults to ".". */
+	context: z.string().default("."),
+	/** Docker build args to pass at build time. */
+	args: z.record(z.string(), z.string()).optional(),
+	/** Target stage in a multi-stage Dockerfile. */
+	target: z.string().optional(),
+});
+
+// ─── Env Quirks (for addon stack generation) ────────────────────────────────
+
+export const EnvQuirkFixSchema = z.object({
+	type: z.enum(["set_value", "generate_hex", "generate_base64url", "sync_with"]),
+	/** Fixed value to set (for set_value type). */
+	value: z.string().optional(),
+	/** Minimum bytes for generated secrets (for generate_hex/generate_base64url). */
+	minBytes: z.number().int().min(1).optional(),
+	/** Key to synchronize with (for sync_with type). */
+	syncKey: z.string().optional(),
+});
+
+export const EnvQuirkSchema = z.object({
+	key: z.string(),
+	issue: z.enum(["empty_string_crashes", "min_length", "must_sync"]),
+	fix: EnvQuirkFixSchema,
+});
+
 // ─── Service Definition ─────────────────────────────────────────────────────
 
 export const ServiceDefinitionSchema = z.object({
@@ -166,9 +209,13 @@ export const ServiceDefinitionSchema = z.object({
 	category: ServiceCategorySchema,
 	icon: z.string(),
 
-	// Docker
-	image: z.string().min(1),
-	imageTag: z.string().min(1),
+	// Docker (required for image-based services, omitted for git-based)
+	image: z.string().min(1).optional(),
+	imageTag: z.string().min(1).optional(),
+
+	// Git source (for services built from cloned repositories)
+	gitSource: GitSourceSchema.optional(),
+	buildContext: BuildContextSchema.optional(),
 	ports: z.array(PortMappingSchema).default([]),
 	volumes: z.array(VolumeMappingSchema).default([]),
 	environment: z.array(EnvVariableSchema).default([]),
@@ -207,6 +254,18 @@ export const ServiceDefinitionSchema = z.object({
 	// Bare-metal native (install/run on host when no Docker)
 	nativeSupported: z.boolean().optional(),
 	nativeRecipes: z.array(NativeRecipeSchema).optional(),
+
+	// Clawexa addon metadata
+	/** Whether the service works with cap_drop: ALL (default: undefined = not audited). */
+	capDropCompatible: z.boolean().optional(),
+	/** Pre-built Docker image for cloud-init deployment (replaces build: directives). */
+	prebuiltImage: z.string().optional(),
+	/** Default reverse proxy path (e.g. "/n8n", "/grafana"). */
+	proxyPath: z.string().optional(),
+	/** Linux capabilities needed at first boot (e.g. ["CHOWN", "SETGID"]). */
+	firstBootCapabilities: z.array(z.string()).optional(),
+	/** Known environment variable quirks that need special handling. */
+	envQuirks: z.array(EnvQuirkSchema).optional(),
 });
 
 // ─── Skill Pack ─────────────────────────────────────────────────────────────
@@ -278,7 +337,7 @@ export const GenerationInputSchema = z.object({
 
 export const ResolvedServiceSchema = z.object({
 	definition: ServiceDefinitionSchema,
-	addedBy: z.enum(["user", "dependency", "skill-pack", "proxy", "monitoring"]).default("user"),
+	addedBy: z.enum(["user", "dependency", "skill-pack", "proxy", "monitoring", "mandatory"]).default("user"),
 });
 
 export const AddedDependencySchema = z.object({
@@ -335,6 +394,159 @@ export const ComposeOptionsSchema = z.object({
 	openclawInstallMethod: OpenclawInstallMethodSchema.default("docker"),
 });
 
+// ─── Addon Stack (Clawexa) ───────────────────────────────────────────────────
+
+export const SkippedServiceReasonSchema = z.enum([
+	"missing_credentials",
+	"no_image",
+	"platform_unsupported",
+	"conflict",
+	"gpu_required",
+	"unknown_service",
+	"resolution_error",
+]);
+
+export const SkippedServiceSchema = z.object({
+	serviceId: z.string(),
+	reason: SkippedServiceReasonSchema,
+	details: z.string(),
+	requiredCredentials: z.array(z.string()).optional(),
+});
+
+export const ProxyRouteSchema = z.object({
+	serviceId: z.string(),
+	path: z.string(),
+	port: z.number().int(),
+	protocol: z.enum(["http", "https", "ws"]).default("http"),
+	stripPrefix: z.boolean().default(true),
+});
+
+export const AddonStackInputSchema = z.object({
+	/** Instance identifier (used for project name sanitization). */
+	instanceId: z.string().min(1),
+	/** Addon service IDs to deploy. */
+	services: z.array(z.string()),
+	/** Optional skill packs. */
+	skillPacks: z.array(z.string()).default([]),
+	/** Platform architecture. */
+	platform: PlatformSchema.default("linux/amd64"),
+	/** OpenClaw version running on the instance. */
+	openclawVersion: z.string().default("latest"),
+	/** Services already running on the instance (to detect conflicts). */
+	existingServices: z.array(z.string()).default([]),
+	/** Ports already in use on the host. */
+	reservedPorts: z.array(z.number().int()).default([]),
+	/** Whether to generate secrets (default: true). */
+	generateSecrets: z.boolean().default(true),
+	/** User-provided credentials for services that need them. */
+	credentials: z.record(z.string(), z.record(z.string(), z.string())).default({}),
+	/** Port overrides for specific services. */
+	portOverrides: z.record(z.string(), z.record(z.string(), z.number().int().min(1).max(65535))).optional(),
+	/** Whether the host has GPU support. */
+	gpu: z.boolean().default(false),
+	/** AI providers configured on this instance. */
+	aiProviders: z.array(AiProviderSchema).default([]),
+	/** Pre-built image overrides (serviceId → image:tag). */
+	prebuiltImages: z.record(z.string(), z.string()).default({}),
+});
+
+export const AddonStackResultSchema = z.object({
+	/** Single docker-compose.override.yml content. */
+	composeOverride: z.string(),
+	/** Complete .env file with all secrets generated. */
+	envFile: z.string(),
+	/** Structured env vars for UI display / credential management. */
+	envVars: z.array(z.object({
+		serviceName: z.string(),
+		vars: z.array(z.object({
+			key: z.string(),
+			description: z.string(),
+			value: z.string(),
+			secret: z.boolean(),
+		})),
+	})),
+	/** SKILL.md files keyed by slug. */
+	skillFiles: z.record(z.string(), z.string()),
+	/** OpenClaw config additions (skills.entries to merge). */
+	openclawConfigPatch: z.object({
+		skills: z.object({
+			entries: z.record(z.string(), z.object({ enabled: z.boolean() })),
+		}),
+	}),
+	/** Port mapping for reverse proxy configuration. */
+	proxyRoutes: z.array(ProxyRouteSchema),
+	/** Metadata. */
+	metadata: z.object({
+		serviceCount: z.number(),
+		skillCount: z.number(),
+		estimatedMemoryMB: z.number(),
+		resolvedServices: z.array(z.string()),
+		skippedServices: z.array(SkippedServiceSchema),
+		generatedSecretKeys: z.array(z.string()),
+		portAssignments: z.record(z.string(), z.number()),
+	}),
+	/** Warnings (non-fatal issues). */
+	warnings: z.array(z.string()),
+});
+
+export const AddonStackUpdateInputSchema = z.object({
+	instanceId: z.string().min(1),
+	/** Current compose override YAML (from the running instance). */
+	currentCompose: z.string(),
+	/** Current .env content. */
+	currentEnv: z.string(),
+	/** Services to add. */
+	addServices: z.array(z.string()).default([]),
+	/** Services to remove. */
+	removeServices: z.array(z.string()).default([]),
+	/** Whether to generate secrets for newly added services (default: true). */
+	generateSecrets: z.boolean().default(true),
+	/** User-provided credentials for new services. */
+	credentials: z.record(z.string(), z.record(z.string(), z.string())).default({}),
+	/** Port overrides for specific services. */
+	portOverrides: z.record(z.string(), z.record(z.string(), z.number().int().min(1).max(65535))).optional(),
+	/** Reserved ports. */
+	reservedPorts: z.array(z.number().int()).default([]),
+	platform: PlatformSchema.default("linux/amd64"),
+	openclawVersion: z.string().default("latest"),
+	aiProviders: z.array(AiProviderSchema).default([]),
+	prebuiltImages: z.record(z.string(), z.string()).default({}),
+});
+
+export const AddonStackUpdateResultSchema = z.object({
+	/** Updated compose override (merged with existing). */
+	composeOverride: z.string(),
+	/** Updated .env (existing values preserved, new ones added). */
+	envFile: z.string(),
+	/** Only NEW skill files to deploy. */
+	newSkillFiles: z.record(z.string(), z.string()),
+	/** Skill slugs to remove from openclaw.json. */
+	removedSkillSlugs: z.array(z.string()),
+	/** Config patch to apply. */
+	openclawConfigPatch: z.object({
+		skills: z.object({
+			add: z.record(z.string(), z.object({ enabled: z.boolean() })),
+			remove: z.array(z.string()),
+		}),
+	}),
+	/** New proxy routes to add. */
+	addProxyRoutes: z.array(ProxyRouteSchema),
+	/** Proxy routes to remove (service IDs). */
+	removeProxyRoutes: z.array(z.string()),
+	/** Services that need their images pulled. */
+	imagesToPull: z.array(z.string()),
+	/** Services to restart (due to dependency changes). */
+	restartRequired: z.array(z.string()),
+	/** Metadata. */
+	metadata: z.object({
+		added: z.array(z.string()),
+		removed: z.array(z.string()),
+		unchanged: z.array(z.string()),
+		estimatedMemoryDelta: z.number(),
+	}),
+	warnings: z.array(z.string()),
+});
+
 // ─── API Request/Response ───────────────────────────────────────────────────
 
 export const ValidateRequestSchema = z.object({

package/src/services/definitions/apptension-saas.ts

@@ -0,0 +1,84 @@
+import type { ServiceDefinition } from "../../types.js";
+
+export const apptensionSaasDefinition: ServiceDefinition = {
+	id: "apptension-saas",
+	name: "SaaS Boilerplate (Apptension)",
+	description:
+		"Production-ready SaaS boilerplate with React frontend, Django backend, GraphQL API, PostgreSQL, async workers, email, Stripe payments, and Docker Compose support.",
+	category: "saas-boilerplate",
+	icon: "🚀",
+
+	gitSource: {
+		repoUrl: "https://github.com/apptension/saas-boilerplate.git",
+		branch: "master",
+		postCloneCommands: [],
+	},
+	buildContext: {
+		dockerfile: "Dockerfile",
+		context: ".",
+	},
+
+	ports: [
+		{
+			host: 3101,
+			container: 80,
+			description: "Apptension SaaS web application",
+			exposed: true,
+		},
+	],
+	volumes: [],
+	environment: [
+		{
+			key: "APPTENSION_SAAS_DB_PASSWORD",
+			defaultValue: "",
+			secret: true,
+			description: "Database password for Apptension SaaS",
+			required: true,
+		},
+		{
+			key: "DB_CONNECTION",
+			defaultValue: "postgresql://apptensionsaas:${APPTENSION_SAAS_DB_PASSWORD}@postgresql:5432/apptensionsaas",
+			secret: false,
+			description: "PostgreSQL connection string",
+			required: true,
+		},
+		{
+			key: "DJANGO_SECRET_KEY",
+			defaultValue: "",
+			secret: true,
+			description: "Django secret key",
+			required: true,
+		},
+		{
+			key: "REDIS_URL",
+			defaultValue: "redis://redis:6379/0",
+			secret: false,
+			description: "Redis connection URL for caching and async workers",
+			required: true,
+		},
+	],
+	healthcheck: {
+		test: "wget -q --spider http://localhost:80/ || exit 1",
+		interval: "30s",
+		timeout: "10s",
+		retries: 3,
+		startPeriod: "60s",
+	},
+	dependsOn: ["postgresql", "redis"],
+	restartPolicy: "unless-stopped",
+	networks: ["openclaw-network"],
+
+	skills: [],
+	openclawEnvVars: [],
+
+	docsUrl: "https://docs.demo.saas.apptension.com",
+	tags: ["saas", "boilerplate", "react", "django", "graphql", "stripe", "enterprise"],
+	maturity: "beta",
+
+	requires: ["postgresql", "redis"],
+	recommends: [],
+	conflictsWith: [],
+
+	minMemoryMB: 768,
+	gpuRequired: false,
+};

package/src/services/definitions/boxyhq-saas.ts

@@ -0,0 +1,84 @@
+import type { ServiceDefinition } from "../../types.js";
+
+export const boxyhqSaasDefinition: ServiceDefinition = {
+	id: "boxyhq-saas",
+	name: "BoxyHQ Enterprise SaaS Starter",
+	description:
+		"Enterprise-grade Next.js SaaS starter kit with SSO (SAML/OIDC), directory sync, audit logs, team management, Prisma ORM, Stripe billing, and PostgreSQL.",
+	category: "saas-boilerplate",
+	icon: "🚀",
+
+	gitSource: {
+		repoUrl: "https://github.com/boxyhq/saas-starter-kit.git",
+		branch: "main",
+		postCloneCommands: ["cp .env.example .env"],
+	},
+	buildContext: {
+		dockerfile: "Dockerfile",
+		context: ".",
+	},
+
+	ports: [
+		{
+			host: 3102,
+			container: 3000,
+			description: "BoxyHQ SaaS web application",
+			exposed: true,
+		},
+	],
+	volumes: [],
+	environment: [
+		{
+			key: "BOXYHQ_SAAS_DB_PASSWORD",
+			defaultValue: "",
+			secret: true,
+			description: "Database password for BoxyHQ SaaS",
+			required: true,
+		},
+		{
+			key: "DATABASE_URL",
+			defaultValue: "postgresql://boxyhqsaas:${BOXYHQ_SAAS_DB_PASSWORD}@postgresql:5432/boxyhqsaas",
+			secret: false,
+			description: "PostgreSQL connection string",
+			required: true,
+		},
+		{
+			key: "NEXTAUTH_SECRET",
+			defaultValue: "",
+			secret: true,
+			description: "NextAuth.js session encryption secret",
+			required: true,
+		},
+		{
+			key: "NEXTAUTH_URL",
+			defaultValue: "http://localhost:3102",
+			secret: false,
+			description: "NextAuth.js callback URL",
+			required: true,
+		},
+	],
+	healthcheck: {
+		test: "wget -q --spider http://localhost:3000/ || exit 1",
+		interval: "30s",
+		timeout: "10s",
+		retries: 3,
+		startPeriod: "60s",
+	},
+	dependsOn: ["postgresql"],
+	restartPolicy: "unless-stopped",
+	networks: ["openclaw-network"],
+
+	skills: [],
+	openclawEnvVars: [],
+
+	docsUrl: "https://github.com/boxyhq/saas-starter-kit#readme",
+	tags: ["saas", "boilerplate", "nextjs", "enterprise", "sso", "saml", "stripe", "prisma"],
+	maturity: "beta",
+
+	requires: ["postgresql"],
+	recommends: [],
+	conflictsWith: [],
+
+	minMemoryMB: 512,
+	gpuRequired: false,
+};

package/src/services/definitions/browserless.ts

@@ -81,4 +81,7 @@ export const browserlessDefinition: ServiceDefinition = {
 
 	minMemoryMB: 512,
 	gpuRequired: false,
+	capDropCompatible: false,
+	proxyPath: "/browserless",
+	firstBootCapabilities: ["SYS_ADMIN"],
 };

package/src/services/definitions/cmsaas-starter.ts

@@ -0,0 +1,84 @@
+import type { ServiceDefinition } from "../../types.js";
+
+export const cmsaasStarterDefinition: ServiceDefinition = {
+	id: "cmsaas-starter",
+	name: "CMSaasStarter",
+	description:
+		"SvelteKit SaaS starter with Supabase backend, Stripe payments, user management, blog engine, SEO optimization, and edge deployment support.",
+	category: "saas-boilerplate",
+	icon: "🚀",
+
+	gitSource: {
+		repoUrl: "https://github.com/CriticalMoments/CMSaasStarter.git",
+		branch: "main",
+		postCloneCommands: [],
+	},
+	buildContext: {
+		dockerfile: "Dockerfile",
+		context: ".",
+	},
+
+	ports: [
+		{
+			host: 3104,
+			container: 3000,
+			description: "CMSaasStarter web application",
+			exposed: true,
+		},
+	],
+	volumes: [],
+	environment: [
+		{
+			key: "PUBLIC_SUPABASE_URL",
+			defaultValue: "",
+			secret: false,
+			description: "Supabase project URL",
+			required: true,
+		},
+		{
+			key: "PUBLIC_SUPABASE_ANON_KEY",
+			defaultValue: "",
+			secret: false,
+			description: "Supabase anonymous/public key",
+			required: true,
+		},
+		{
+			key: "PRIVATE_SUPABASE_SERVICE_ROLE",
+			defaultValue: "",
+			secret: true,
+			description: "Supabase service role key (server-side only)",
+			required: true,
+		},
+		{
+			key: "PRIVATE_STRIPE_API_KEY",
+			defaultValue: "",
+			secret: true,
+			description: "Stripe secret API key",
+			required: true,
+		},
+	],
+	healthcheck: {
+		test: "wget -q --spider http://localhost:3000/ || exit 1",
+		interval: "30s",
+		timeout: "10s",
+		retries: 3,
+		startPeriod: "60s",
+	},
+	dependsOn: [],
+	restartPolicy: "unless-stopped",
+	networks: ["openclaw-network"],
+
+	skills: [],
+	openclawEnvVars: [],
+
+	docsUrl: "https://github.com/CriticalMoments/CMSaasStarter#readme",
+	tags: ["saas", "boilerplate", "sveltekit", "supabase", "stripe", "seo"],
+	maturity: "beta",
+
+	requires: [],
+	recommends: ["postgresql"],
+	conflictsWith: [],
+
+	minMemoryMB: 256,
+	gpuRequired: false,
+};

package/src/services/definitions/convex.ts

@@ -89,6 +89,14 @@ export const convexDefinition: ServiceDefinition = {
 				"Admin key for CLI access. Generate with: docker compose exec convex ./generate_admin_key.sh",
 			required: false,
 		},
+		{
+			key: "CONVEX_INSTANCE_SECRET",
+			defaultValue: "${INSTANCE_SECRET}",
+			secret: true,
+			description:
+				"Convex instance secret used by Mission Control (synced with INSTANCE_SECRET)",
+			required: false,
+		},
 	],
 	healthcheck: {
 		test: "curl -f http://localhost:3210/version",
@@ -118,4 +126,27 @@ export const convexDefinition: ServiceDefinition = {
 
 	minMemoryMB: 256,
 	gpuRequired: false,
+	capDropCompatible: false,
+	envQuirks: [
+		{
+			key: "DISABLE_BEACON",
+			issue: "empty_string_crashes" as const,
+			fix: { type: "set_value" as const, value: "true" },
+		},
+		{
+			key: "INSTANCE_SECRET",
+			issue: "min_length" as const,
+			fix: { type: "generate_hex" as const, minBytes: 32 },
+		},
+		{
+			key: "CONVEX_SELF_HOSTED_ADMIN_KEY",
+			issue: "min_length" as const,
+			fix: { type: "generate_hex" as const, minBytes: 32 },
+		},
+		{
+			key: "INSTANCE_SECRET",
+			issue: "must_sync" as const,
+			fix: { type: "sync_with" as const, syncKey: "CONVEX_INSTANCE_SECRET" },
+		},
+	],
 };