@teamclaws/teamclaw 2026.3.21 → 2026.3.25

package/src/controller/worker-provisioning.ts

@@ -2,7 +2,6 @@ import fs from "node:fs/promises";
 import http from "node:http";
 import https from "node:https";
 import net from "node:net";
-import os from "node:os";
 import path from "node:path";
 import readline from "node:readline";
 import { createHash } from "node:crypto";
@@ -10,7 +9,10 @@ import { spawn, type ChildProcess } from "node:child_process";
 import JSON5 from "json5";
 import type { PluginLogger } from "../../api.js";
 import { generateId } from "../protocol.js";
-import { resolveDefaultOpenClawConfigPath } from "../openclaw-workspace.js";
+import {
+  resolveDefaultOpenClawConfigPath,
+  resolveDefaultTeamClawRuntimeRootDir,
+} from "../openclaw-workspace.js";
 import { ROLES } from "../roles.js";
 import type {
   PluginConfig,
@@ -45,6 +47,7 @@ type LaunchSpec = {
   controllerUrl: string;
   workerPort: number;
   gatewayPort: number;
+  workspaceDir?: string;
   env: Record<string, string>;
   configJson: string;
 };
@@ -377,6 +380,7 @@ export class WorkerProvisioningManager {
         controllerUrl,
         workerPort,
         gatewayPort,
+        workspaceDir: buildProvisionedWorkspaceDir(this.backend.type, this.deps.config, role, workerId),
       });
       const launchResult = await this.backend.launch({
         workerId,
@@ -385,6 +389,7 @@ export class WorkerProvisioningManager {
         controllerUrl,
         workerPort,
         gatewayPort,
+        workspaceDir: getConfiguredWorkerWorkspaceDir(workerConfig),
         env: this.buildForwardedEnv(),
         configJson: `${JSON.stringify(workerConfig, null, 2)}\n`,
       });
@@ -620,7 +625,9 @@ class ProcessProvisioner implements WorkerProvisionerBackend {
 
   constructor(logger: PluginLogger) {
     this.logger = logger;
-    this.baseDirPromise = fs.mkdtemp(path.join(os.tmpdir(), "teamclaw-provisioned-"));
+    const provisionedRoot = path.join(resolveDefaultTeamClawRuntimeRootDir(), "provisioned-workers");
+    this.baseDirPromise = fs.mkdir(provisionedRoot, { recursive: true })
+      .then(() => fs.mkdtemp(path.join(provisionedRoot, "session-")));
   }
 
   async launch(spec: LaunchSpec): Promise<LaunchResult> {
@@ -733,6 +740,7 @@ class DockerProvisioner implements WorkerProvisionerBackend {
       TEAMCLAW_BOOTSTRAP_CONFIG_B64: Buffer.from(spec.configJson, "utf8").toString("base64"),
       TEAMCLAW_WORKER_ID: spec.workerId,
       TEAMCLAW_LAUNCH_TOKEN: spec.launchToken,
+      ...(spec.workspaceDir ? { TEAMCLAW_WORKSPACE_DIR: spec.workspaceDir } : {}),
     };
 
     const script = buildContainerBootstrapScript();
@@ -750,7 +758,7 @@ class DockerProvisioner implements WorkerProvisionerBackend {
           "teamclaw.worker_id": spec.workerId,
         },
         HostConfig: {
-          Binds: this.config.workerProvisioningDockerMounts,
+          Binds: buildDockerBinds(this.config),
           NetworkMode: this.config.workerProvisioningDockerNetwork || undefined,
         },
       },
@@ -806,7 +814,12 @@ class KubernetesProvisioner implements WorkerProvisionerBackend {
       TEAMCLAW_BOOTSTRAP_CONFIG_B64: Buffer.from(spec.configJson, "utf8").toString("base64"),
       TEAMCLAW_WORKER_ID: spec.workerId,
       TEAMCLAW_LAUNCH_TOKEN: spec.launchToken,
+      ...(spec.workspaceDir ? { TEAMCLAW_WORKSPACE_DIR: spec.workspaceDir } : {}),
     };
+    const workspaceRoot = this.config.workerProvisioningWorkspaceRoot;
+    const hasPersistentWorkspace = Boolean(
+      workspaceRoot && this.config.workerProvisioningKubernetesWorkspacePersistentVolumeClaim,
+    );
 
     const manifest = {
       apiVersion: "v1",
@@ -829,6 +842,23 @@ class KubernetesProvisioner implements WorkerProvisionerBackend {
         restartPolicy: "Never",
         hostname: buildManagedHostname(this.config.teamName, spec.role, spec.workerId),
         serviceAccountName: this.config.workerProvisioningKubernetesServiceAccount || undefined,
+        securityContext: hasPersistentWorkspace
+          ? {
+              runAsUser: 1000,
+              runAsGroup: 1000,
+              fsGroup: 1000,
+            }
+          : undefined,
+        volumes: hasPersistentWorkspace
+          ? [
+              {
+                name: "workspace",
+                persistentVolumeClaim: {
+                  claimName: this.config.workerProvisioningKubernetesWorkspacePersistentVolumeClaim,
+                },
+              },
+            ]
+          : undefined,
         containers: [
           {
             name: "worker",
@@ -836,6 +866,14 @@ class KubernetesProvisioner implements WorkerProvisionerBackend {
             command: ["sh", "-lc"],
             args: [buildContainerBootstrapScript()],
             env: Object.entries(env).map(([name, value]) => ({ name, value })),
+            volumeMounts: hasPersistentWorkspace
+              ? [
+                  {
+                    name: "workspace",
+                    mountPath: workspaceRoot,
+                  },
+                ]
+              : undefined,
           },
         ],
       },
@@ -976,9 +1014,21 @@ function buildProvisionedWorkerConfig(
     controllerUrl: string;
     workerPort: number;
     gatewayPort: number;
+    workspaceDir?: string;
   },
 ): Record<string, unknown> {
   const config = cloneJson(baseConfig);
+  const agents = ensureRecord(config.agents);
+  const agentDefaults = ensureRecord(agents.defaults);
+  delete agentDefaults.repoRoot;
+  if (spec.workspaceDir) {
+    agentDefaults.workspace = spec.workspaceDir;
+  } else {
+    delete agentDefaults.workspace;
+  }
+  agents.defaults = agentDefaults;
+  config.agents = agents;
+
   const gateway = ensureRecord(config.gateway);
   gateway.mode = "local";
   gateway.bind = "loopback";
@@ -1016,9 +1066,12 @@ function buildProvisionedWorkerConfig(
   teamclawConfig.workerProvisioningExtraEnv = {};
   teamclawConfig.workerProvisioningDockerNetwork = "";
   teamclawConfig.workerProvisioningDockerMounts = [];
+  teamclawConfig.workerProvisioningWorkspaceRoot = "";
+  teamclawConfig.workerProvisioningDockerWorkspaceVolume = "";
   teamclawConfig.workerProvisioningKubernetesNamespace = "default";
   teamclawConfig.workerProvisioningKubernetesContext = "";
   teamclawConfig.workerProvisioningKubernetesServiceAccount = "";
+  teamclawConfig.workerProvisioningKubernetesWorkspacePersistentVolumeClaim = "";
   teamclawConfig.workerProvisioningKubernetesLabels = {};
   teamclawConfig.workerProvisioningKubernetesAnnotations = {};
   teamclawEntry.config = teamclawConfig;
@@ -1205,11 +1258,47 @@ function buildContainerBootstrapScript(): string {
   return [
     "set -eu",
     "mkdir -p \"$OPENCLAW_STATE_DIR\"",
+    "if [ -n \"${TEAMCLAW_WORKSPACE_DIR:-}\" ]; then mkdir -p \"$TEAMCLAW_WORKSPACE_DIR\"; fi",
     "node -e 'const fs=require(\"fs\"); const configPath=process.env.OPENCLAW_CONFIG_PATH; const raw=Buffer.from(process.env.TEAMCLAW_BOOTSTRAP_CONFIG_B64||\"\", \"base64\").toString(\"utf8\"); fs.mkdirSync(require(\"path\").dirname(configPath), { recursive: true }); fs.writeFileSync(configPath, raw);'",
     "exec node dist/index.js gateway --allow-unconfigured",
   ].join("\n");
 }
 
+function buildDockerBinds(config: PluginConfig): string[] {
+  const binds = [...config.workerProvisioningDockerMounts];
+  if (config.workerProvisioningDockerWorkspaceVolume && config.workerProvisioningWorkspaceRoot) {
+    binds.unshift(`${config.workerProvisioningDockerWorkspaceVolume}:${config.workerProvisioningWorkspaceRoot}`);
+  }
+  return [...new Set(binds)];
+}
+
+function buildProvisionedWorkspaceDir(
+  provider: WorkerProvisioningType,
+  config: PluginConfig,
+  role: RoleId,
+  workerId: string,
+): string {
+  if (
+    (provider !== "docker" && provider !== "kubernetes") ||
+    !config.workerProvisioningWorkspaceRoot
+  ) {
+    return "";
+  }
+
+  return path.posix.join(
+    config.workerProvisioningWorkspaceRoot,
+    sanitizePathSegment(config.teamName),
+    sanitizePathSegment(role),
+    sanitizePathSegment(workerId),
+  );
+}
+
+function getConfiguredWorkerWorkspaceDir(config: Record<string, unknown>): string {
+  const agents = ensureRecord(config.agents);
+  const defaults = ensureRecord(agents.defaults);
+  return typeof defaults.workspace === "string" ? defaults.workspace : "";
+}
+
 function resolveDockerEndpoint(): DockerEndpoint {
   const dockerHost = process.env.DOCKER_HOST?.trim();
   if (!dockerHost) {

package/src/install-defaults.ts

@@ -0,0 +1 @@
+export const TEAMCLAW_PUBLISHED_RUNTIME_IMAGE = "ghcr.io/topcheer/teamclaw-openclaw:latest";

package/src/openclaw-workspace.ts

@@ -1,6 +1,8 @@
+import { readFileSync } from "node:fs";
+import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import fs from "node:fs/promises";
+import JSON5 from "json5";
 import type { PluginLogger } from "../api.js";
 
 const DEFAULT_AGENTS_MD = `# AGENTS.md
@@ -29,6 +31,49 @@ const DEFAULT_HEARTBEAT_MD = `# HEARTBEAT.md
 # Keep this file empty (or with only comments) to skip heartbeat API calls.
 `;
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function expandUserPath(
+  value: string,
+  homedir: () => string = os.homedir,
+): string {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return "";
+  }
+  if (trimmed === "~") {
+    return homedir();
+  }
+  if (trimmed.startsWith("~/")) {
+    return path.join(homedir(), trimmed.slice(2));
+  }
+  return path.resolve(trimmed);
+}
+
+function resolveConfiguredOpenClawWorkspaceDir(
+  env: NodeJS.ProcessEnv = process.env,
+  homedir: () => string = os.homedir,
+): string {
+  const configPath = resolveDefaultOpenClawConfigPath(env, homedir);
+  try {
+    const raw = readFileSync(configPath, "utf8");
+    const parsed = JSON5.parse(raw);
+    if (!isRecord(parsed)) {
+      return "";
+    }
+    const agents = isRecord(parsed.agents) ? parsed.agents : null;
+    const defaults = agents && isRecord(agents.defaults) ? agents.defaults : null;
+    if (defaults && typeof defaults.workspace === "string" && defaults.workspace.trim()) {
+      return expandUserPath(defaults.workspace, homedir);
+    }
+  } catch {
+    // Fall back to the legacy state-dir-derived workspace path below.
+  }
+  return "";
+}
+
 export function resolveDefaultOpenClawHomeDir(
   env: NodeJS.ProcessEnv = process.env,
   homedir: () => string = os.homedir,
@@ -65,6 +110,10 @@ export function resolveDefaultOpenClawWorkspaceDir(
   env: NodeJS.ProcessEnv = process.env,
   homedir: () => string = os.homedir,
 ): string {
+  const configuredWorkspaceDir = resolveConfiguredOpenClawWorkspaceDir(env, homedir);
+  if (configuredWorkspaceDir) {
+    return configuredWorkspaceDir;
+  }
   const stateDir = resolveDefaultOpenClawStateDir(env, homedir);
   const profile = env.OPENCLAW_PROFILE?.trim();
   if (profile && profile.toLowerCase() !== "default") {
@@ -73,6 +122,13 @@ export function resolveDefaultOpenClawWorkspaceDir(
   return path.join(stateDir, "workspace");
 }
 
+export function resolveDefaultTeamClawRuntimeRootDir(
+  env: NodeJS.ProcessEnv = process.env,
+  homedir: () => string = os.homedir,
+): string {
+  return path.join(path.dirname(resolveDefaultOpenClawWorkspaceDir(env, homedir)), "teamclaw-runtimes");
+}
+
 export async function ensureOpenClawWorkspaceMemoryDir(logger: PluginLogger): Promise<string> {
   const workspaceDir = resolveDefaultOpenClawWorkspaceDir();
   const memoryDir = path.join(workspaceDir, "memory");

package/src/roles.ts

@@ -10,6 +10,7 @@ const ROLES: RoleDefinition[] = [
       "requirements-analysis", "user-stories", "product-specification",
       "priority-planning", "stakeholder-communication",
     ],
+    recommendedSkills: ["find-skills"],
     systemPrompt: [
       "You are a Product Manager in a virtual software team.",
       "Your responsibilities include analyzing requirements, writing user stories,",
@@ -28,6 +29,7 @@ const ROLES: RoleDefinition[] = [
       "system-design", "api-design", "database-schema",
       "technology-selection", "code-review-architecture",
     ],
+    recommendedSkills: ["find-skills"],
     systemPrompt: [
       "You are a Software Architect in a virtual software team.",
       "Your responsibilities include system design, API design, database schema design,",
@@ -46,6 +48,7 @@ const ROLES: RoleDefinition[] = [
       "coding", "debugging", "feature-implementation",
       "code-refactoring", "unit-testing",
     ],
+    recommendedSkills: ["find-skills"],
     systemPrompt: [
       "You are a Developer in a virtual software team.",
       "Your responsibilities include implementing features, fixing bugs, refactoring code,",
@@ -64,6 +67,7 @@ const ROLES: RoleDefinition[] = [
       "test-planning", "test-case-writing", "bug-reporting",
       "regression-testing", "quality-assurance",
     ],
+    recommendedSkills: ["find-skills"],
     systemPrompt: [
       "You are a QA Engineer in a virtual software team.",
       "Your responsibilities include test planning, writing test cases, reporting bugs,",
@@ -82,6 +86,7 @@ const ROLES: RoleDefinition[] = [
       "release-management", "deployment", "version-control",
       "ci-cd-pipeline", "release-notes",
     ],
+    recommendedSkills: ["find-skills"],
     systemPrompt: [
       "You are a Release Engineer in a virtual software team.",
       "Your responsibilities include managing releases, deployment pipelines,",
@@ -100,6 +105,7 @@ const ROLES: RoleDefinition[] = [
       "storage-design", "compute-provisioning", "cost-optimization",
       "disaster-recovery", "capacity-planning", "iac-terraform",
     ],
+    recommendedSkills: ["find-skills"],
     systemPrompt: [
       "You are an Infrastructure Engineer in a virtual software team.",
       "Your core responsibilities include designing, provisioning, and maintaining cloud infrastructure.",
@@ -137,7 +143,8 @@ const ROLES: RoleDefinition[] = [
       "infrastructure", "ci-cd", "monitoring",
       "docker-kubernetes", "automation",
     ],
-     systemPrompt: [
+    recommendedSkills: ["find-skills"],
+      systemPrompt: [
        "You are a DevOps Engineer in a virtual software team.",
        "Your responsibilities include infrastructure management, CI/CD pipelines,",
        "monitoring, and automation.",
@@ -158,6 +165,7 @@ const ROLES: RoleDefinition[] = [
       "code-security-review", "secrets-management", "auth-design",
       "data-protection",
     ],
+    recommendedSkills: ["find-skills"],
     systemPrompt: [
       "You are a Security Engineer in a virtual software team.",
       "Your core responsibility is ensuring the security posture of all software, infrastructure, and data.",
@@ -193,6 +201,7 @@ const ROLES: RoleDefinition[] = [
       "ui-design", "ux-research", "wireframing",
       "prototyping", "design-systems",
     ],
+    recommendedSkills: ["ui-ux-pro-max", "find-skills"],
     systemPrompt: [
       "You are a UI/UX Designer in a virtual software team.",
       "Your responsibilities include user interface design, UX research,",
@@ -210,6 +219,7 @@ const ROLES: RoleDefinition[] = [
       "product-marketing", "content-creation",
       "launch-strategy", "user-acquisition", "analytics",
     ],
+    recommendedSkills: ["find-skills"],
     systemPrompt: [
       "You are a Marketing Specialist in a virtual software team.",
       "Your responsibilities include product marketing, content creation,",
@@ -235,6 +245,7 @@ const TEAMCLAW_ROLE_IDS_TEXT = [
 
 for (const role of ROLES) {
   const suggestedRoles = role.suggestedNextRoles.length > 0 ? role.suggestedNextRoles.join(", ") : "none";
+  const recommendedSkills = role.recommendedSkills.length > 0 ? role.recommendedSkills.join(", ") : "none";
   role.systemPrompt = [
     role.systemPrompt,
     "",
@@ -250,11 +261,12 @@ for (const role of ROLES) {
      "- Treat file paths from plans, docs, and teammate messages as hints, not facts. Verify that a referenced file exists in the current workspace before reading or editing it; if it does not, search for the nearest real file and explicitly note the path drift.",
      "- Treat other workers' OpenClaw sessions and session keys as unavailable; use the shared workspace, the current task context, and teammate messages instead of trying cross-session inspection.",
      "- Do not mark a task completed or failed via progress updates. Finish by returning the deliverable or raising the blocking error so TeamClaw can close the task correctly.",
-     "- If only a commercial or proprietary option would unblock the task, ask the human for approval before assuming it is allowed.",
-     "- If follow-up work is needed, mention it in your result or use handoff/review tools for this current task only.",
-     `- Use exact TeamClaw role IDs when collaborating: ${TEAMCLAW_ROLE_IDS_TEXT}.`,
-     `- If a true follow-up is required after your deliverable, prefer these exact next roles: ${suggestedRoles}.`,
-    ].join("\n");
+      "- If only a commercial or proprietary option would unblock the task, ask the human for approval before assuming it is allowed.",
+      "- If follow-up work is needed, mention it in your result or use handoff/review tools for this current task only.",
+      `- Use exact TeamClaw role IDs when collaborating: ${TEAMCLAW_ROLE_IDS_TEXT}.`,
+      `- If a true follow-up is required after your deliverable, prefer these exact next roles: ${suggestedRoles}.`,
+      `- Default starter skills for this role: ${recommendedSkills}. If the task includes more specific recommended skills, prefer those.`,
+     ].join("\n");
 }
 
 const ROLE_MAP = new Map<string, RoleDefinition>(ROLES.map((r) => [r.id, r]));
@@ -264,6 +276,29 @@ function getRole(id: RoleId): RoleDefinition | undefined {
   return ROLE_MAP.get(id);
 }
 
+function normalizeRecommendedSkills(skills: string[] = []): string[] {
+  const seen = new Set<string>();
+  const normalized: string[] = [];
+  for (const entry of skills) {
+    const value = String(entry || "").trim();
+    if (!value) {
+      continue;
+    }
+    const key = value.toLowerCase();
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    normalized.push(value);
+  }
+  return normalized;
+}
+
+function resolveRecommendedSkillsForRole(roleId?: RoleId, taskSkills: string[] = []): string[] {
+  const roleSkills = roleId ? (getRole(roleId)?.recommendedSkills ?? []) : [];
+  return normalizeRecommendedSkills([...roleSkills, ...taskSkills]);
+}
+
 function buildRolePrompt(role: RoleDefinition, teamContext?: string): string {
   const parts = [role.systemPrompt];
   if (teamContext) {
@@ -272,4 +307,4 @@ function buildRolePrompt(role: RoleDefinition, teamContext?: string): string {
   return parts.join("\n");
 }
 
-export { ROLES, ROLE_IDS, getRole, buildRolePrompt };
+export { ROLES, ROLE_IDS, getRole, buildRolePrompt, normalizeRecommendedSkills, resolveRecommendedSkillsForRole };

package/src/state.ts

@@ -40,6 +40,9 @@ async function loadTeamState(teamName: string): Promise<TeamState | null> {
     ) {
       return null;
     }
+    if (!parsed.controllerRuns || typeof parsed.controllerRuns !== "object") {
+      parsed.controllerRuns = {};
+    }
     if (!Array.isArray(parsed.messages)) {
       parsed.messages = [];
     }
@@ -71,6 +74,9 @@ async function saveTeamState(state: TeamState): Promise<void> {
   state.provisioning.workers = state.provisioning.workers && typeof state.provisioning.workers === "object"
     ? state.provisioning.workers
     : {};
+  state.controllerRuns = state.controllerRuns && typeof state.controllerRuns === "object"
+    ? state.controllerRuns
+    : {};
   await fs.writeFile(filePath, `${JSON.stringify(state, null, 2)}\n`, "utf8");
 }
 

package/src/task-executor.ts

@@ -438,6 +438,7 @@ function buildTaskMessage(taskDescription: string, taskId: string, roleLabel: st
     "- Do NOT delegate the core work of this task away to another role.",
     "- If Task Context includes recent completed deliverables, treat them as upstream inputs and search the shared workspace for any referenced task IDs or filenames before requesting clarification.",
     "- Do NOT attempt to inspect or resolve another worker's OpenClaw session or session key; those sessions are isolated per worker.",
+    "- If the task includes a Recommended Skills section, use those skills first and prefer the exact listed slugs when searching for additional help.",
     "- Do NOT mark the task completed or failed via progress tools. Return the final deliverable (or raise an error) and let TeamClaw close the task.",
     "- If critical information is missing and you cannot proceed safely, request clarification and wait instead of guessing.",
     "- If more work is needed, mention it briefly in your result or use a handoff/review tool on this same task.",

package/src/types.ts

@@ -1,3 +1,5 @@
+import { TEAMCLAW_PUBLISHED_RUNTIME_IMAGE } from "./install-defaults.js";
+
 export type TeamClawMode = "controller" | "worker";
 
 export type WorkerStatus = "idle" | "busy" | "offline";
@@ -70,6 +72,7 @@ export type RoleDefinition = {
   icon: string;
   description: string;
   capabilities: string[];
+  recommendedSkills: string[];
   systemPrompt: string;
   suggestedNextRoles: RoleId[];
 };
@@ -96,6 +99,7 @@ export type TaskInfo = {
   assignedRole?: RoleId;
   assignedWorkerId?: string;
   createdBy: string;
+  recommendedSkills?: string[];
   controllerSessionKey?: string;
   createdAt: number;
   updatedAt: number;
@@ -125,9 +129,32 @@ export type TaskAssignmentPayload = {
   title: string;
   description: string;
   priority?: TaskPriority;
+  recommendedSkills?: string[];
   repo?: RepoSyncInfo;
 };
 
+export type ControllerRunSource = "human" | "task_follow_up";
+
+export type ControllerRunInfo = {
+  id: string;
+  title: string;
+  sessionKey: string;
+  runId?: string;
+  source: ControllerRunSource;
+  sourceTaskId?: string;
+  sourceTaskTitle?: string;
+  request: string;
+  reply?: string;
+  error?: string;
+  createdTaskIds: string[];
+  status: TaskExecutionStatus;
+  createdAt: number;
+  updatedAt: number;
+  startedAt?: number;
+  completedAt?: number;
+  execution?: TaskExecution;
+};
+
 export type TaskExecution = {
   status: TaskExecutionStatus;
   runId?: string;
@@ -239,9 +266,12 @@ export type PluginConfig = {
   workerProvisioningExtraEnv: Record<string, string>;
   workerProvisioningDockerNetwork: string;
   workerProvisioningDockerMounts: string[];
+  workerProvisioningWorkspaceRoot: string;
+  workerProvisioningDockerWorkspaceVolume: string;
   workerProvisioningKubernetesNamespace: string;
   workerProvisioningKubernetesContext: string;
   workerProvisioningKubernetesServiceAccount: string;
+  workerProvisioningKubernetesWorkspacePersistentVolumeClaim: string;
   workerProvisioningKubernetesLabels: Record<string, string>;
   workerProvisioningKubernetesAnnotations: Record<string, string>;
 };
@@ -257,6 +287,7 @@ export type TeamState = {
   teamName: string;
   workers: Record<string, WorkerInfo>;
   tasks: Record<string, TaskInfo>;
+  controllerRuns: Record<string, ControllerRunInfo>;
   messages: TeamMessage[];
   clarifications: Record<string, ClarificationRequest>;
   repo?: GitRepoState;
@@ -356,15 +387,25 @@ export function parsePluginConfig(raw: Record<string, unknown> = {}): PluginConf
     typeof raw.workerProvisioningStartupTimeoutMs === "number" && raw.workerProvisioningStartupTimeoutMs >= 1000
       ? raw.workerProvisioningStartupTimeoutMs
       : 120_000;
-  const workerProvisioningImage = typeof raw.workerProvisioningImage === "string"
+  const rawWorkerProvisioningImage = typeof raw.workerProvisioningImage === "string"
     ? raw.workerProvisioningImage.trim()
     : "";
+  const workerProvisioningImage = rawWorkerProvisioningImage ||
+    (workerProvisioningType === "docker" || workerProvisioningType === "kubernetes"
+      ? TEAMCLAW_PUBLISHED_RUNTIME_IMAGE
+      : "");
   const workerProvisioningPassEnv = parseStringArray(raw.workerProvisioningPassEnv);
   const workerProvisioningExtraEnv = parseStringRecord(raw.workerProvisioningExtraEnv);
   const workerProvisioningDockerNetwork = typeof raw.workerProvisioningDockerNetwork === "string"
     ? raw.workerProvisioningDockerNetwork.trim()
     : "";
   const workerProvisioningDockerMounts = parseStringArray(raw.workerProvisioningDockerMounts);
+  const rawWorkerProvisioningWorkspaceRoot = typeof raw.workerProvisioningWorkspaceRoot === "string"
+    ? raw.workerProvisioningWorkspaceRoot.trim()
+    : "";
+  const workerProvisioningDockerWorkspaceVolume = typeof raw.workerProvisioningDockerWorkspaceVolume === "string"
+    ? raw.workerProvisioningDockerWorkspaceVolume.trim()
+    : "";
   const workerProvisioningKubernetesNamespace = typeof raw.workerProvisioningKubernetesNamespace === "string" &&
       raw.workerProvisioningKubernetesNamespace.trim()
     ? raw.workerProvisioningKubernetesNamespace.trim()
@@ -375,6 +416,14 @@ export function parsePluginConfig(raw: Record<string, unknown> = {}): PluginConf
   const workerProvisioningKubernetesServiceAccount = typeof raw.workerProvisioningKubernetesServiceAccount === "string"
     ? raw.workerProvisioningKubernetesServiceAccount.trim()
     : "";
+  const workerProvisioningKubernetesWorkspacePersistentVolumeClaim =
+    typeof raw.workerProvisioningKubernetesWorkspacePersistentVolumeClaim === "string"
+      ? raw.workerProvisioningKubernetesWorkspacePersistentVolumeClaim.trim()
+      : "";
+  const workerProvisioningWorkspaceRoot = rawWorkerProvisioningWorkspaceRoot ||
+    (workerProvisioningDockerWorkspaceVolume || workerProvisioningKubernetesWorkspacePersistentVolumeClaim
+      ? "/workspace-root"
+      : "");
   const workerProvisioningKubernetesLabels = parseStringRecord(raw.workerProvisioningKubernetesLabels);
   const workerProvisioningKubernetesAnnotations = parseStringRecord(raw.workerProvisioningKubernetesAnnotations);
 
@@ -404,9 +453,12 @@ export function parsePluginConfig(raw: Record<string, unknown> = {}): PluginConf
     workerProvisioningExtraEnv,
     workerProvisioningDockerNetwork,
     workerProvisioningDockerMounts,
+    workerProvisioningWorkspaceRoot,
+    workerProvisioningDockerWorkspaceVolume,
     workerProvisioningKubernetesNamespace,
     workerProvisioningKubernetesContext,
     workerProvisioningKubernetesServiceAccount,
+    workerProvisioningKubernetesWorkspacePersistentVolumeClaim,
     workerProvisioningKubernetesLabels,
     workerProvisioningKubernetesAnnotations,
   };