@shadowob/cloud 1.1.6 → 1.1.8

package/images/cc-connect-runner/entrypoint.mjs

@@ -9,6 +9,7 @@
  */
 
 import { spawn, spawnSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
 import {
   chmodSync,
   cpSync,
@@ -27,8 +28,13 @@ const CONFIG_MOUNT = process.env.SHADOW_RUNNER_CONFIG_MOUNT ?? '/etc/openclaw'
 const RUNTIME_FILES_PATH = join(CONFIG_MOUNT, 'runtime-files.json')
 const RUNTIME_EXTENSIONS_PATH = join(CONFIG_MOUNT, 'runtime-extensions.json')
 const RUNNER_HOME = process.env.HOME ?? '/home/shadow'
+const TEMPLATE_ROUTINES_PATH =
+  process.env.SHADOW_TEMPLATE_ROUTINES_PATH ?? '/etc/shadowob/template-routines.json'
 const CC_CONNECT_CONFIG_PATH =
   process.env.CC_CONNECT_CONFIG_PATH ?? join(RUNNER_HOME, '.cc-connect/config.toml')
+const CC_CONNECT_DATA_DIR = process.env.CC_CONNECT_DATA_DIR ?? join(RUNNER_HOME, '.cc-connect')
+const CC_CONNECT_CRON_STORE_PATH =
+  process.env.CC_CONNECT_CRON_STORE_PATH ?? join(CC_CONNECT_DATA_DIR, 'crons', 'jobs.json')
 const HEALTH_PORT = Number.parseInt(
   process.env.SHADOW_RUNNER_HEALTH_PORT ??
     process.env.OPENCLAW_GATEWAY_PORT ??
@@ -85,6 +91,227 @@ function modeForPath(path) {
   return 0o644
 }
 
+function isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue)
+  if (!isPlainObject(value)) return value
+  return Object.fromEntries(
+    Object.entries(value)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, item]) => [key, stableValue(item)]),
+  )
+}
+
+function stableHash(value) {
+  return createHash('sha256')
+    .update(JSON.stringify(stableValue(value)))
+    .digest('hex')
+}
+
+function readJsonFile(path, fallback) {
+  if (!existsSync(path)) return fallback
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8'))
+    return parsed && typeof parsed === 'object' ? parsed : fallback
+  } catch (err) {
+    console.warn(`[entrypoint] Failed to parse ${path}: ${err.message}`)
+    return fallback
+  }
+}
+
+function parseRoutineEveryCron(interval) {
+  if (typeof interval !== 'string') return null
+  const match = interval.trim().match(/^(\d+)\s*(m|h|d)$/i)
+  if (!match) return null
+  const amount = Number.parseInt(match[1], 10)
+  if (!Number.isFinite(amount) || amount <= 0) return null
+  const unit = match[2].toLowerCase()
+  if (unit === 'm') return amount < 60 ? `*/${amount} * * * *` : null
+  if (unit === 'h') return amount < 24 ? `0 */${amount} * * *` : null
+  return `0 0 */${amount} * *`
+}
+
+function buildCcConnectRoutineCronExpr(routine) {
+  const schedule = isPlainObject(routine.schedule) ? routine.schedule : {}
+  let expr = null
+  if (typeof schedule.cron === 'string' && schedule.cron.trim()) {
+    expr = schedule.cron.trim()
+  } else {
+    expr = parseRoutineEveryCron(schedule.interval)
+  }
+  if (!expr) return null
+  if (typeof schedule.timezone === 'string' && schedule.timezone.trim()) {
+    return `CRON_TZ=${schedule.timezone.trim()} ${expr}`
+  }
+  return expr
+}
+
+function resolveShadowobRoutineDelivery(routine) {
+  const deliveries = Array.isArray(routine.deliveries) ? routine.deliveries : []
+  for (const delivery of deliveries) {
+    if (
+      !isPlainObject(delivery) ||
+      delivery.pluginId !== 'shadowob' ||
+      delivery.kind !== 'channel'
+    ) {
+      continue
+    }
+    const target = isPlainObject(delivery.target) ? delivery.target : {}
+    const channelEnvKey =
+      typeof target.channelEnvKey === 'string' && target.channelEnvKey.trim()
+        ? target.channelEnvKey.trim()
+        : null
+    const channelId =
+      (channelEnvKey ? process.env[channelEnvKey] : undefined) ??
+      (typeof target.channelId === 'string' ? target.channelId : undefined)
+    if (!channelId) continue
+    return {
+      channelId,
+      threadId:
+        typeof target.threadId === 'string' && target.threadId.trim()
+          ? target.threadId.trim()
+          : null,
+    }
+  }
+  return null
+}
+
+function managedRoutineJobId(routine) {
+  const raw = `shadow-template-${routine.agentId ?? 'agent'}-${routine.id ?? 'routine'}`
+    .toLowerCase()
+    .replace(/[^a-z0-9._:-]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+  if (raw.length >= 8 && raw.length <= 64) return raw
+  return `shadow-template-${stableHash({ agentId: routine.agentId, id: routine.id }).slice(0, 20)}`
+}
+
+function ccConnectRoutineSessionKey(delivery) {
+  if (delivery.threadId) return `shadowob:channel:${delivery.channelId}:thread:${delivery.threadId}`
+  return `shadowob:channel:${delivery.channelId}`
+}
+
+function ccConnectManagedJobShape(job) {
+  return {
+    id: job.id,
+    project: job.project,
+    session_key: job.session_key,
+    cron_expr: job.cron_expr,
+    prompt: job.prompt,
+    exec: job.exec,
+    work_dir: job.work_dir,
+    description: job.description,
+    enabled: job.enabled,
+    silent: job.silent,
+    mute: job.mute,
+    session_mode: job.session_mode,
+    mode: job.mode,
+    timeout_mins: job.timeout_mins,
+  }
+}
+
+function buildCcConnectRoutineJob(routine, now) {
+  if (
+    !isPlainObject(routine) ||
+    typeof routine.id !== 'string' ||
+    typeof routine.agentId !== 'string'
+  ) {
+    return null
+  }
+  const cronExpr = buildCcConnectRoutineCronExpr(routine)
+  const delivery = resolveShadowobRoutineDelivery(routine)
+  if (!cronExpr || !delivery) return null
+  const job = {
+    id: managedRoutineJobId(routine),
+    project: routine.agentId,
+    session_key: ccConnectRoutineSessionKey(delivery),
+    cron_expr: cronExpr,
+    prompt: String(routine.prompt ?? ''),
+    description:
+      typeof routine.title === 'string' && routine.title.trim() ? routine.title.trim() : routine.id,
+    enabled: routine.enabled !== false,
+    session_mode: 'new_per_run',
+    created_at: now,
+    last_run: '0001-01-01T00:00:00Z',
+  }
+  const managedSpecHash = stableHash(ccConnectManagedJobShape(job))
+  return {
+    ...job,
+    shadowTemplateRoutine: {
+      version: 1,
+      routineId: routine.id,
+      agentId: routine.agentId,
+      sourceHash: typeof routine.sourceHash === 'string' ? routine.sourceHash : null,
+      managedSpecHash,
+    },
+  }
+}
+
+function syncTemplateRoutinesToCcConnectCron() {
+  if (!existsSync(TEMPLATE_ROUTINES_PATH)) return
+  const seed = readJsonFile(TEMPLATE_ROUTINES_PATH, null)
+  const routines = Array.isArray(seed?.routines) ? seed.routines : []
+  if (routines.length === 0) return
+
+  const now = new Date().toISOString()
+  const existing = readJsonFile(CC_CONNECT_CRON_STORE_PATH, [])
+  const jobs = Array.isArray(existing) ? existing.filter(Boolean) : []
+  let changed = false
+
+  for (const routine of routines) {
+    const desired = buildCcConnectRoutineJob(routine, now)
+    if (!desired) {
+      console.warn(
+        `[entrypoint] Skipping invalid template routine: ${JSON.stringify(routine?.id ?? null)}`,
+      )
+      continue
+    }
+    const existingIndex = jobs.findIndex((job) => {
+      const marker = isPlainObject(job?.shadowTemplateRoutine) ? job.shadowTemplateRoutine : null
+      return marker?.routineId === desired.shadowTemplateRoutine.routineId || job?.id === desired.id
+    })
+    if (existingIndex < 0) {
+      jobs.push(desired)
+      changed = true
+      console.log(`[entrypoint] Seeded cc-connect cron routine: ${desired.id}`)
+      continue
+    }
+    const current = jobs[existingIndex]
+    const marker = isPlainObject(current.shadowTemplateRoutine)
+      ? current.shadowTemplateRoutine
+      : null
+    const currentManagedSpecHash = stableHash(ccConnectManagedJobShape(current))
+    if (!marker || marker.managedSpecHash !== currentManagedSpecHash) {
+      console.log(
+        `[entrypoint] Preserved user-edited cc-connect cron routine: ${current.id ?? desired.id}`,
+      )
+      continue
+    }
+    if (marker.managedSpecHash === desired.shadowTemplateRoutine.managedSpecHash) continue
+    jobs[existingIndex] = {
+      ...desired,
+      id: current.id ?? desired.id,
+      created_at: current.created_at ?? desired.created_at,
+      last_run: current.last_run ?? desired.last_run,
+      last_error: current.last_error,
+    }
+    changed = true
+    console.log(
+      `[entrypoint] Updated cc-connect cron routine from template: ${jobs[existingIndex].id}`,
+    )
+  }
+
+  if (!changed) return
+  mkdirSync(dirname(CC_CONNECT_CRON_STORE_PATH), { recursive: true })
+  writeFileSync(CC_CONNECT_CRON_STORE_PATH, `${JSON.stringify(jobs, null, 2)}\n`, {
+    encoding: 'utf-8',
+    mode: 0o600,
+  })
+  chmodSync(CC_CONNECT_CRON_STORE_PATH, 0o600)
+}
+
 function materializeRuntimeFiles() {
   const files = loadJson(RUNTIME_FILES_PATH, {})
   for (const [path, content] of Object.entries(files)) {
@@ -290,6 +517,7 @@ async function main() {
   materializeRuntimeFiles()
   materializeCredentialFiles()
   materializePluginRuntimeAssets()
+  syncTemplateRoutinesToCcConnectCron()
 
   if (process.env.SHADOW_RUNNER_VALIDATE_ONLY === '1') {
     verifyBinary('cc-connect', ['--help'])

package/images/claude-runner/RUNNER.md

@@ -167,9 +167,11 @@ not through OpenClaw `models.providers`.
   `.claude/commands` only for compatibility.
 - MCP: write `.mcp.json` for project-scoped MCP and avoid relying on
   `~/.claude.json` in immutable images.
-- Cron/routine: Claude Code has scheduled prompt support in its automation
-  docs, but Cloud phase 1 should treat scheduling as a Cloud/Shadow concern
-  unless explicitly mounting a Claude-native schedule store.
+- Cron/routine: Cloud template routines are materialized by the shared
+  cc-connect runner from `/etc/shadowob/template-routines.json` into
+  `~/.cc-connect/crons/jobs.json`. Managed jobs use deterministic ids and a
+  spec hash so user-edited schedules are preserved. ShadowOB delivery uses
+  `session_key = "shadowob:channel:<channel_id>"` or a thread-qualified variant.
 - Hooks: write Claude settings `hooks`, not OpenClaw `hooks`.
 - Subagents: materialize `.claude/agents` and any preloaded skill references.
 - Logs: collect both cc-connect daemon logs and Claude Code native telemetry or

package/images/codex-runner/RUNNER.md

@@ -165,9 +165,11 @@ type = "shadowob"
 - Skills: materialize `.agents/skills` for repo-scoped workflows and
   `$CODEX_HOME/skills` only if the runner owns the whole home directory.
 - MCP: generate `[mcp_servers.*]` TOML tables.
-- Cron/routine: Codex app automations are not the same as CLI-local cron; Cloud
-  should own phase-1 schedules unless later integrating the Codex app
-  automation APIs.
+- Cron/routine: Cloud template routines are materialized by the shared
+  cc-connect runner from `/etc/shadowob/template-routines.json` into
+  `~/.cc-connect/crons/jobs.json`. Managed jobs use deterministic ids and a
+  spec hash so user-edited schedules are preserved. ShadowOB delivery uses
+  `session_key = "shadowob:channel:<channel_id>"` or a thread-qualified variant.
 - Hooks: write Codex hook config in trusted project or user config.
 - Subagents: generate Codex agent roles and instruction files under `.codex`
   only when `features.multi_agent` or equivalent config is enabled.

package/images/gemini-runner/RUNNER.md

@@ -165,8 +165,11 @@ type = "shadowob"
 - Skills: no native `SKILL.md` surface was found; use `GEMINI.md`, custom
   commands, and extensions for phase 1.
 - MCP: write `mcpServers` in `.gemini/settings.json`.
-- Cron/routine: no native CLI cron surface found in the researched config docs;
-  Cloud should own scheduling for phase 1.
+- Cron/routine: Cloud template routines are materialized by the shared
+  cc-connect runner from `/etc/shadowob/template-routines.json` into
+  `~/.cc-connect/crons/jobs.json`. Managed jobs use deterministic ids and a
+  spec hash so user-edited schedules are preserved. ShadowOB delivery uses
+  `session_key = "shadowob:channel:<channel_id>"` or a thread-qualified variant.
 - Hooks: write `hooksConfig` and `hooks.*` in Gemini settings.
 - Subagents: Gemini settings expose agent override and hook points around agent
   execution, but cc-connect currently drives the main Gemini CLI agent only.

package/images/hermes-runner/RUNNER.md

@@ -176,8 +176,10 @@ SHADOW_TOKEN=...
   runner profile.
 - MCP: write Hermes MCP config rather than OpenClaw or Codex MCP formats.
 - Cron/routine: Hermes has the strongest native cron surface among the target
-  runners; keep cron jobs in Hermes native storage when the agent runtime is
-  Hermes.
+  runners. Cloud template routines are seeded from
+  `/etc/shadowob/template-routines.json` into `~/.hermes/cron/jobs.json`, using
+  Hermes native `deliver`/`origin` ShadowOB delivery. Managed jobs use
+  deterministic ids and a spec hash so user-edited schedules are preserved.
 - Hooks: expose plugin hooks through `plugins.enabled` and plugin files, not a
   central OpenClaw hook adapter.
 - Subagents: support Hermes delegation later as native Hermes multi-agent

package/images/hermes-runner/entrypoint.mjs

@@ -6,6 +6,7 @@
  */
 
 import { spawn, spawnSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
 import {
   chmodSync,
   cpSync,
@@ -24,6 +25,11 @@ const CONFIG_MOUNT = process.env.SHADOW_RUNNER_CONFIG_MOUNT ?? '/etc/openclaw'
 const RUNTIME_FILES_PATH = join(CONFIG_MOUNT, 'runtime-files.json')
 const RUNTIME_EXTENSIONS_PATH = join(CONFIG_MOUNT, 'runtime-extensions.json')
 const RUNNER_HOME = process.env.HOME ?? '/home/shadow'
+const HERMES_HOME = process.env.HERMES_HOME ?? join(RUNNER_HOME, '.hermes')
+const TEMPLATE_ROUTINES_PATH =
+  process.env.SHADOW_TEMPLATE_ROUTINES_PATH ?? '/etc/shadowob/template-routines.json'
+const HERMES_CRON_STORE_PATH =
+  process.env.HERMES_CRON_STORE_PATH ?? join(HERMES_HOME, 'cron', 'jobs.json')
 const HEALTH_PORT = Number.parseInt(
   process.env.SHADOW_RUNNER_HEALTH_PORT ?? process.env.OPENCLAW_GATEWAY_PORT ?? '3100',
   10,
@@ -76,6 +82,267 @@ function modeForPath(path) {
   return 0o644
 }
 
+function isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue)
+  if (!isPlainObject(value)) return value
+  return Object.fromEntries(
+    Object.entries(value)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, item]) => [key, stableValue(item)]),
+  )
+}
+
+function stableHash(value) {
+  return createHash('sha256')
+    .update(JSON.stringify(stableValue(value)))
+    .digest('hex')
+}
+
+function readJsonFile(path, fallback) {
+  if (!existsSync(path)) return fallback
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf-8'))
+    return parsed && typeof parsed === 'object' ? parsed : fallback
+  } catch (err) {
+    console.warn(`[entrypoint] Failed to parse ${path}: ${err.message}`)
+    return fallback
+  }
+}
+
+function parseRoutineEveryMinutes(interval) {
+  if (typeof interval !== 'string') return null
+  const match = interval.trim().match(/^(\d+)\s*(m|h|d)$/i)
+  if (!match) return null
+  const amount = Number.parseInt(match[1], 10)
+  if (!Number.isFinite(amount) || amount <= 0) return null
+  const unit = match[2].toLowerCase()
+  return amount * (unit === 'm' ? 1 : unit === 'h' ? 60 : 1440)
+}
+
+function isoNow() {
+  return new Date().toISOString()
+}
+
+function addMinutesIso(minutes) {
+  return new Date(Date.now() + minutes * 60_000).toISOString()
+}
+
+function buildHermesRoutineSchedule(routine) {
+  const schedule = isPlainObject(routine.schedule) ? routine.schedule : {}
+  if (typeof schedule.cron === 'string' && schedule.cron.trim()) {
+    const expr = schedule.cron.trim()
+    return {
+      schedule: { kind: 'cron', expr, display: expr },
+      scheduleDisplay: expr,
+      nextRunAt: null,
+    }
+  }
+  const minutes = parseRoutineEveryMinutes(schedule.interval)
+  if (minutes) {
+    const display = `every ${minutes}m`
+    return {
+      schedule: { kind: 'interval', minutes, display },
+      scheduleDisplay: display,
+      nextRunAt: addMinutesIso(minutes),
+    }
+  }
+  return null
+}
+
+function resolveShadowobRoutineDelivery(routine) {
+  const deliveries = Array.isArray(routine.deliveries) ? routine.deliveries : []
+  for (const delivery of deliveries) {
+    if (
+      !isPlainObject(delivery) ||
+      delivery.pluginId !== 'shadowob' ||
+      delivery.kind !== 'channel'
+    ) {
+      continue
+    }
+    const target = isPlainObject(delivery.target) ? delivery.target : {}
+    const channelEnvKey =
+      typeof target.channelEnvKey === 'string' && target.channelEnvKey.trim()
+        ? target.channelEnvKey.trim()
+        : null
+    const channelId =
+      (channelEnvKey ? process.env[channelEnvKey] : undefined) ??
+      (typeof target.channelId === 'string' ? target.channelId : undefined)
+    if (!channelId) continue
+    return {
+      channelId,
+      threadId:
+        typeof target.threadId === 'string' && target.threadId.trim()
+          ? target.threadId.trim()
+          : null,
+    }
+  }
+  return null
+}
+
+function managedRoutineJobId(routine) {
+  const raw = `shadow-template-${routine.agentId ?? 'agent'}-${routine.id ?? 'routine'}`
+    .toLowerCase()
+    .replace(/[^a-z0-9._:-]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+  if (raw.length >= 8 && raw.length <= 64) return raw
+  return `shadow-template-${stableHash({ agentId: routine.agentId, id: routine.id }).slice(0, 20)}`
+}
+
+function hermesManagedJobShape(job) {
+  return {
+    id: job.id,
+    name: job.name,
+    prompt: job.prompt,
+    skills: job.skills,
+    skill: job.skill,
+    model: job.model,
+    provider: job.provider,
+    base_url: job.base_url,
+    script: job.script,
+    no_agent: job.no_agent,
+    context_from: job.context_from,
+    schedule: job.schedule,
+    schedule_display: job.schedule_display,
+    repeat: job.repeat,
+    enabled: job.enabled,
+    state: job.state,
+    deliver: job.deliver,
+    origin: job.origin,
+    enabled_toolsets: job.enabled_toolsets,
+    workdir: job.workdir,
+    profile: job.profile,
+  }
+}
+
+function buildHermesRoutineJob(routine, now) {
+  if (
+    !isPlainObject(routine) ||
+    typeof routine.id !== 'string' ||
+    typeof routine.agentId !== 'string'
+  ) {
+    return null
+  }
+  const schedule = buildHermesRoutineSchedule(routine)
+  const delivery = resolveShadowobRoutineDelivery(routine)
+  if (!schedule || !delivery) return null
+
+  const origin = {
+    platform: 'shadowob',
+    chat_id: delivery.channelId,
+    ...(delivery.threadId ? { thread_id: delivery.threadId } : {}),
+  }
+  const job = {
+    id: managedRoutineJobId(routine),
+    name:
+      typeof routine.title === 'string' && routine.title.trim() ? routine.title.trim() : routine.id,
+    prompt: String(routine.prompt ?? ''),
+    skills: [],
+    skill: null,
+    model: null,
+    provider: null,
+    base_url: null,
+    script: null,
+    no_agent: false,
+    context_from: null,
+    schedule: schedule.schedule,
+    schedule_display: schedule.scheduleDisplay,
+    repeat: { times: null, completed: 0 },
+    enabled: routine.enabled !== false,
+    state: routine.enabled === false ? 'paused' : 'scheduled',
+    paused_at: null,
+    paused_reason: null,
+    created_at: now,
+    next_run_at: schedule.nextRunAt,
+    last_run_at: null,
+    last_status: null,
+    last_error: null,
+    last_delivery_error: null,
+    deliver: delivery.threadId ? 'origin' : `shadowob:${delivery.channelId}`,
+    origin,
+    enabled_toolsets: null,
+    workdir: '/workspace',
+    profile: null,
+  }
+  const managedSpecHash = stableHash(hermesManagedJobShape(job))
+  return {
+    ...job,
+    shadowTemplateRoutine: {
+      version: 1,
+      routineId: routine.id,
+      agentId: routine.agentId,
+      sourceHash: typeof routine.sourceHash === 'string' ? routine.sourceHash : null,
+      managedSpecHash,
+    },
+  }
+}
+
+function syncTemplateRoutinesToHermesCron() {
+  if (!existsSync(TEMPLATE_ROUTINES_PATH)) return
+  const seed = readJsonFile(TEMPLATE_ROUTINES_PATH, null)
+  const routines = Array.isArray(seed?.routines) ? seed.routines : []
+  if (routines.length === 0) return
+
+  const now = isoNow()
+  const store = readJsonFile(HERMES_CRON_STORE_PATH, { jobs: [] })
+  const jobs = Array.isArray(store.jobs) ? store.jobs.filter(Boolean) : []
+  let changed = false
+
+  for (const routine of routines) {
+    const desired = buildHermesRoutineJob(routine, now)
+    if (!desired) {
+      console.warn(
+        `[entrypoint] Skipping invalid template routine: ${JSON.stringify(routine?.id ?? null)}`,
+      )
+      continue
+    }
+    const existingIndex = jobs.findIndex((job) => {
+      const marker = isPlainObject(job?.shadowTemplateRoutine) ? job.shadowTemplateRoutine : null
+      return marker?.routineId === desired.shadowTemplateRoutine.routineId || job?.id === desired.id
+    })
+    if (existingIndex < 0) {
+      jobs.push(desired)
+      changed = true
+      console.log(`[entrypoint] Seeded Hermes cron routine: ${desired.id}`)
+      continue
+    }
+    const existing = jobs[existingIndex]
+    const marker = isPlainObject(existing.shadowTemplateRoutine)
+      ? existing.shadowTemplateRoutine
+      : null
+    const currentManagedSpecHash = stableHash(hermesManagedJobShape(existing))
+    if (!marker || marker.managedSpecHash !== currentManagedSpecHash) {
+      console.log(
+        `[entrypoint] Preserved user-edited Hermes cron routine: ${existing.id ?? desired.id}`,
+      )
+      continue
+    }
+    if (marker.managedSpecHash === desired.shadowTemplateRoutine.managedSpecHash) continue
+    jobs[existingIndex] = {
+      ...desired,
+      id: existing.id ?? desired.id,
+      created_at: existing.created_at ?? desired.created_at,
+      last_run_at: existing.last_run_at ?? null,
+      last_status: existing.last_status ?? null,
+      last_error: existing.last_error ?? null,
+      last_delivery_error: existing.last_delivery_error ?? null,
+    }
+    changed = true
+    console.log(`[entrypoint] Updated Hermes cron routine from template: ${jobs[existingIndex].id}`)
+  }
+
+  if (!changed) return
+  mkdirSync(dirname(HERMES_CRON_STORE_PATH), { recursive: true })
+  writeFileSync(HERMES_CRON_STORE_PATH, `${JSON.stringify({ jobs, updated_at: now }, null, 2)}\n`, {
+    encoding: 'utf-8',
+    mode: 0o600,
+  })
+  chmodSync(HERMES_CRON_STORE_PATH, 0o600)
+}
+
 function materializeRuntimeFiles() {
   const files = loadJson(RUNTIME_FILES_PATH, {})
   for (const [path, content] of Object.entries(files)) {
@@ -226,7 +493,7 @@ function startHermes() {
   const proc = spawn('hermes', ['gateway'], {
     env: {
       ...process.env,
-      HERMES_HOME: process.env.HERMES_HOME ?? join(RUNNER_HOME, '.hermes'),
+      HERMES_HOME,
     },
     stdio: ['ignore', 'pipe', 'pipe'],
     cwd: '/workspace',
@@ -262,6 +529,7 @@ async function main() {
   materializeRuntimeFiles()
   materializeCredentialFiles()
   materializePluginRuntimeAssets()
+  syncTemplateRoutinesToHermesCron()
 
   if (process.env.SHADOW_RUNNER_VALIDATE_ONLY === '1') {
     verifyBinary('hermes', ['--version'])

package/images/openclaw-runner/Dockerfile

@@ -61,6 +61,7 @@ RUN find node_modules -type d \( -name ".github" -o -name "test" -o -name "tests
 # TypeScript source changes.
 WORKDIR /workspace
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.json .npmrc ./
+COPY patches patches
 COPY packages/shared/package.json packages/shared/package.json
 COPY packages/sdk/package.json packages/sdk/package.json
 COPY packages/cli/package.json packages/cli/package.json

package/images/openclaw-runner/RUNNER.md

@@ -17,6 +17,9 @@ The current image already follows this model more closely than the ACP runners:
   ShadowOB connector CLI.
 - `entrypoint.mjs` reads `/etc/openclaw/config.json`.
 - Runtime extensions are read from `/etc/openclaw/runtime-extensions.json`.
+- Template routines are read from `/etc/shadowob/template-routines.json` and
+  synced into the OpenClaw cron store before the gateway starts. The sync keeps a
+  managed spec hash so runtime-edited jobs are preserved on redeploy.
 - The generated OpenClaw config is written outside mutable state by default.
 - File logging goes to `/var/log/openclaw/entrypoint.log`.
 - Shadow slash command artifacts are surfaced through