@teamclaws/teamclaw 2026.3.26-2 → 2026.4.2-1

package/src/controller/worker-provisioning.ts

@@ -12,14 +12,22 @@ import type { PluginLogger } from "../../api.js";
 import { generateId } from "../protocol.js";
 import {
   resolveDefaultOpenClawConfigPath,
+  resolveDefaultOpenClawStateDir,
   resolveDefaultTeamClawRuntimeRootDir,
+  resolveDefaultAgentDir,
+  resolveTeamClawAgentDir,
+  resolveTeamClawAgentWorkspaceRootDir,
+  resolveTeamClawWorkspaceDir,
+  TEAMCLAW_AGENT_ID,
 } from "../openclaw-workspace.js";
 import { ROLES } from "../roles.js";
+import { inferTaskRole } from "./role-inference.js";
 import type {
   PluginConfig,
   ProvisionedWorkerRecord,
   ProvisionedWorkerStatus,
   RoleId,
+  StartupProvisioningReadiness,
   TaskInfo,
   TeamProvisioningState,
   TeamState,
@@ -33,6 +41,8 @@ const DEFAULT_DOCKER_BUNDLED_TEAMCLAW_PLUGIN_DIR = "/app/extensions/teamclaw";
 const PROVISIONING_RECORD_RETENTION_MS = 6 * 60 * 60 * 1000;
 const PROVISIONING_FAILURE_COOLDOWN_MS = 30_000;
 const PROCESS_TERMINATION_TIMEOUT_MS = 10_000;
+const STARTUP_READINESS_POLL_INTERVAL_MS = 1_000;
+const STARTUP_READINESS_RETRY_INTERVAL_MS = 5_000;
 const DOCKER_API_VERSION = resolveDockerApiVersion();
 
 export type WorkerProvisioningManagerDeps = {
@@ -40,6 +50,8 @@ export type WorkerProvisioningManagerDeps = {
   logger: PluginLogger;
   getTeamState: () => TeamState | null;
   updateTeamState: (updater: (state: TeamState) => void) => TeamState;
+  /** Actual HTTP port once the controller server has bound (may differ from config.port). */
+  actualControllerPort?: number;
 };
 
 type LaunchSpec = {
@@ -49,6 +61,7 @@ type LaunchSpec = {
   controllerUrl: string;
   workerPort: number;
   gatewayPort: number;
+  publishedHostPort?: number;
   workspaceDir?: string;
   env: Record<string, string>;
   configJson: string;
@@ -68,7 +81,7 @@ interface WorkerProvisionerBackend {
 }
 
 export class WorkerProvisioningManager {
-  private readonly deps: WorkerProvisioningManagerDeps;
+  private deps: WorkerProvisioningManagerDeps;
   private readonly backend: WorkerProvisionerBackend | null;
   private baseConfigPromise: Promise<Record<string, unknown>> | null = null;
   private reconcilePromise: Promise<void> | null = null;
@@ -80,6 +93,11 @@ export class WorkerProvisioningManager {
     this.backend = createProvisionerBackend(deps.config, deps.logger);
   }
 
+  /** Update the actual controller port after the HTTP server binds. */
+  setActualPort(port: number): void {
+    this.deps = { ...this.deps, actualControllerPort: port };
+  }
+
   isEnabled(): boolean {
     return this.backend !== null;
   }
@@ -88,6 +106,12 @@ export class WorkerProvisioningManager {
     return Boolean(this.deps.getTeamState()?.provisioning?.workers?.[workerId]);
   }
 
+  /** Returns true when the worker was provisioned as a local process (shared filesystem). */
+  isSharedWorkspaceWorker(workerId: string): boolean {
+    const record = this.deps.getTeamState()?.provisioning?.workers?.[workerId];
+    return Boolean(record && record.provider === "process");
+  }
+
   syncState(state: TeamState): boolean {
     if (!this.backend) {
       return false;
@@ -95,6 +119,23 @@ export class WorkerProvisioningManager {
     return this.refreshProvisioningState(state, Date.now());
   }
 
+  primeStartupReadiness(): void {
+    if (!this.backend || this.stopped) {
+      return;
+    }
+    const now = Date.now();
+    const previousAttempts = this.deps.getTeamState()?.provisioning?.startupReadiness?.attempts ?? 0;
+    this.updateStartupReadiness({
+      status: "checking",
+      startedAt: now,
+      checkedAt: now,
+      attempts: previousAttempts,
+      requiredRoles: this.determineStartupReadinessRoles(),
+      readyWorkerIds: [],
+      message: "Controller started; waiting for startup provisioning warm-up.",
+    });
+  }
+
   validateRegistration(
     workerId: string,
     role: RoleId,
@@ -207,6 +248,82 @@ export class WorkerProvisioningManager {
     return this.reconcilePromise;
   }
 
+  async runStartupReadinessCheck(): Promise<void> {
+    if (!this.backend || this.stopped) {
+      return;
+    }
+
+    const requiredRoles = this.determineStartupReadinessRoles();
+    const previousAttempts = this.deps.getTeamState()?.provisioning?.startupReadiness?.attempts ?? 0;
+    const startedAt = Date.now();
+    this.updateStartupReadiness({
+      status: "checking",
+      startedAt,
+      checkedAt: startedAt,
+      attempts: previousAttempts + 1,
+      requiredRoles,
+      readyWorkerIds: [],
+      message: `Warming startup workers for ${requiredRoles.join(", ")}.`,
+    });
+
+    try {
+      await this.ensureStartupProvisioningPrerequisites();
+      await this.ensureWarmWorkersForRoles(requiredRoles, "startup readiness warmup");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.updateStartupReadiness({
+        status: "degraded",
+        startedAt,
+        checkedAt: Date.now(),
+        attempts: previousAttempts + 1,
+        requiredRoles,
+        readyWorkerIds: [],
+        message,
+      });
+      this.deps.logger.warn(`Provisioner: startup readiness prerequisites failed: ${message}`);
+      return;
+    }
+
+    const deadline = Date.now() + this.deps.config.workerProvisioningStartupTimeoutMs;
+    let lastRetryAt = 0;
+    while (!this.stopped && Date.now() < deadline) {
+      const readiness = this.collectRoleReadiness(requiredRoles);
+      if (readiness.missingRoles.length === 0) {
+        this.updateStartupReadiness({
+          status: "ready",
+          startedAt,
+          checkedAt: Date.now(),
+          attempts: previousAttempts + 1,
+          requiredRoles,
+          readyWorkerIds: readiness.readyWorkerIds,
+          message: `Startup provisioning ready with ${readiness.readyWorkerIds.length} warm worker(s).`,
+        });
+        return;
+      }
+
+      if (Date.now() - lastRetryAt >= STARTUP_READINESS_RETRY_INTERVAL_MS) {
+        lastRetryAt = Date.now();
+        await this.ensureWarmWorkersForRoles(readiness.missingRoles, "startup readiness retry");
+        await this.requestReconcile("startup readiness poll");
+      }
+
+      await sleep(STARTUP_READINESS_POLL_INTERVAL_MS);
+    }
+
+    const finalReadiness = this.collectRoleReadiness(requiredRoles);
+    const failureDetails = this.describeStartupReadinessFailure(finalReadiness.missingRoles);
+    this.updateStartupReadiness({
+      status: "degraded",
+      startedAt,
+      checkedAt: Date.now(),
+      attempts: previousAttempts + 1,
+      requiredRoles,
+      readyWorkerIds: finalReadiness.readyWorkerIds,
+      message: failureDetails,
+    });
+    this.deps.logger.warn(`Provisioner: startup readiness degraded: ${failureDetails}`);
+  }
+
   async stop(): Promise<void> {
     if (!this.backend) {
       return;
@@ -286,6 +403,38 @@ export class WorkerProvisioningManager {
     await this.scaleDownIdleWorkers(now);
   }
 
+  private determineStartupReadinessRoles(): RoleId[] {
+    const configured = this.deps.config.workerProvisioningRoles;
+    if (configured.length > 0) {
+      return [...new Set(configured)];
+    }
+    return ["developer"];
+  }
+
+  private async ensureStartupProvisioningPrerequisites(): Promise<void> {
+    await ensureWritableDirectory(resolveTeamClawAgentWorkspaceRootDir());
+    await ensureWritableDirectory(resolveTeamClawWorkspaceDir());
+    await ensureWritableDirectory(resolveDefaultTeamClawRuntimeRootDir());
+    if (this.deps.config.workerProvisioningType === "process") {
+      await ensureWritableDirectory(resolveTeamClawAgentDir());
+    }
+  }
+
+  private async ensureWarmWorkersForRoles(roles: RoleId[], reason: string): Promise<void> {
+    const state = this.deps.getTeamState();
+    for (const role of roles) {
+      if (this.hasActiveOrLaunchingWorkerForRole(state, role)) {
+        continue;
+      }
+      if (this.hasRecentProvisioningFailure(role)) {
+        this.deps.logger.warn(`Provisioner: startup warmup skipped ${role} due to recent failure`);
+        continue;
+      }
+      this.deps.logger.info(`Provisioner: warming ${role} worker (${reason})`);
+      await this.launchWorker(role);
+    }
+  }
+
   private async expireStalledLaunches(now: number): Promise<void> {
     const state = this.deps.getTeamState();
     if (!state?.provisioning) {
@@ -355,6 +504,54 @@ export class WorkerProvisioningManager {
     );
   }
 
+  private hasActiveOrLaunchingWorkerForRole(state: TeamState | null, role: RoleId): boolean {
+    if (!state) {
+      return false;
+    }
+    const activeWorker = Object.values(state.workers).some((worker) =>
+      worker.role === role && worker.status !== "offline"
+    );
+    if (activeWorker) {
+      return true;
+    }
+    return Object.values(state.provisioning?.workers ?? {}).some((record) =>
+      record.role === role && (record.status === "launching" || record.status === "registered")
+    );
+  }
+
+  private collectRoleReadiness(roles: RoleId[]): { readyWorkerIds: string[]; missingRoles: RoleId[] } {
+    const state = this.deps.getTeamState();
+    const readyWorkerIds: string[] = [];
+    const missingRoles: RoleId[] = [];
+    for (const role of roles) {
+      const worker = Object.values(state?.workers ?? {}).find((candidate) =>
+        candidate.role === role && (candidate.status === "idle" || candidate.status === "busy")
+      );
+      if (worker) {
+        readyWorkerIds.push(worker.id);
+      } else {
+        missingRoles.push(role);
+      }
+    }
+    return { readyWorkerIds, missingRoles };
+  }
+
+  private describeStartupReadinessFailure(missingRoles: RoleId[]): string {
+    const records = Object.values(this.deps.getTeamState()?.provisioning?.workers ?? {});
+    const relevant = records.filter((record) => missingRoles.includes(record.role));
+    const detail = relevant
+      .map((record) => `${record.role}:${record.status}${record.lastError ? ` (${record.lastError})` : ""}`)
+      .join(", ");
+    const suffix = detail ? ` Latest records: ${detail}` : "";
+    return `Startup worker readiness failed for roles: ${missingRoles.join(", ")}.${suffix}`;
+  }
+
+  private updateStartupReadiness(readiness: StartupProvisioningReadiness): void {
+    this.deps.updateTeamState((state) => {
+      ensureProvisioningState(state).startupReadiness = readiness;
+    });
+  }
+
   private async launchWorker(role: RoleId): Promise<void> {
     if (!this.backend) {
       return;
@@ -373,6 +570,12 @@ export class WorkerProvisioningManager {
     const gatewayPort = requiresDedicatedHostPorts
       ? await reserveEphemeralPort()
       : DEFAULT_CONTAINER_GATEWAY_PORT;
+    // Docker bridge networks need a host port to publish so the controller
+    // (running on the host) can reach the worker container.
+    const needsPublishedPort =
+      this.backend.type === "docker" &&
+      !isDockerHostNetwork(this.deps.config.workerProvisioningDockerNetwork);
+    const publishedHostPort = needsPublishedPort ? await reserveEphemeralPort() : undefined;
     const now = Date.now();
 
     this.deps.updateTeamState((state) => {
@@ -403,6 +606,7 @@ export class WorkerProvisioningManager {
         controllerUrl,
         workerPort,
         gatewayPort,
+        publishedHostPort,
         workspaceDir: getConfiguredWorkerWorkspaceDir(workerConfig),
         env: this.buildForwardedEnv(controllerUrl),
         configJson: `${JSON.stringify(workerConfig, null, 2)}\n`,
@@ -539,29 +743,7 @@ export class WorkerProvisioningManager {
   }
 
   private inferTaskRole(task: TaskInfo): RoleId | null {
-    if (task.assignedRole) {
-      return task.assignedRole;
-    }
-
-    const text = `${task.title} ${task.description}`.toLowerCase();
-    let bestRole: RoleId | null = null;
-    let bestScore = 0;
-
-    for (const role of ROLES) {
-      const roleTokens = [
-        role.id,
-        role.label,
-        ...role.capabilities,
-      ].flatMap((entry) => entry.toLowerCase().split(/[^a-z0-9]+/).filter((token) => token.length > 2));
-      const uniqueTokens = [...new Set(roleTokens)];
-      const score = uniqueTokens.reduce((count, token) => count + (text.includes(token) ? 1 : 0), 0);
-      if (score > bestScore) {
-        bestScore = score;
-        bestRole = role.id;
-      }
-    }
-
-    return bestScore > 0 ? bestRole : null;
+    return inferTaskRole(task);
   }
 
   private computeRoleDemand(state: TeamState, role: RoleId): number {
@@ -588,12 +770,15 @@ export class WorkerProvisioningManager {
   }
 
   private resolveControllerUrl(): string {
+    if (this.backend?.type === "process") {
+      // Process workers run on the same host — always use loopback regardless
+      // of workerProvisioningControllerUrl (which may target Docker DNS).
+      const port = this.deps.actualControllerPort ?? this.deps.config.port;
+      return `http://127.0.0.1:${port}`;
+    }
     if (this.deps.config.workerProvisioningControllerUrl) {
       return this.deps.config.workerProvisioningControllerUrl;
     }
-    if (this.backend?.type === "process") {
-      return `http://127.0.0.1:${this.deps.config.port}`;
-    }
     throw new Error(
       `workerProvisioningControllerUrl is required when workerProvisioningType=${this.backend?.type}`,
     );
@@ -702,6 +887,7 @@ class ProcessProvisioner implements WorkerProvisionerBackend {
         OPENCLAW_SKIP_CANVAS_HOST: "1",
         TEAMCLAW_WORKER_ID: spec.workerId,
         TEAMCLAW_LAUNCH_TOKEN: spec.launchToken,
+        ...(spec.workspaceDir ? { TEAMCLAW_WORKSPACE_DIR: spec.workspaceDir } : {}),
       },
       stdio: ["ignore", "pipe", "pipe"],
     });
@@ -773,7 +959,7 @@ class DockerProvisioner implements WorkerProvisionerBackend {
     }
 
     const instanceName = buildManagedInstanceName(this.config.teamName, spec.role, spec.workerId);
-    const env = {
+    const env: Record<string, string> = {
       ...spec.env,
       HOME: "/home/node",
       OPENCLAW_HOME: "/home/node",
@@ -786,25 +972,52 @@ class DockerProvisioner implements WorkerProvisionerBackend {
       ...(spec.workspaceDir ? { TEAMCLAW_WORKSPACE_DIR: spec.workspaceDir } : {}),
     };
 
-    const script = buildContainerBootstrapScript();
+    // When workers share a Docker network with the controller container, advertise
+    // the container name and internal worker port so sibling containers can reach it
+    // directly. When the controller runs on the host, fall back to publishing a host
+    // port and advertising localhost for host-side callbacks.
+    const usePortPublishing = spec.publishedHostPort !== undefined;
+    if (this.config.workerProvisioningDockerNetwork) {
+      env.TEAMCLAW_ADVERTISE_HOST = instanceName;
+      env.TEAMCLAW_ADVERTISE_PORT = String(spec.workerPort);
+    } else if (usePortPublishing) {
+      env.TEAMCLAW_ADVERTISE_HOST = "localhost";
+      env.TEAMCLAW_ADVERTISE_PORT = String(spec.publishedHostPort);
+    }
+
+    const hostConfig: Record<string, unknown> = {
+      Binds: buildDockerBinds(this.config),
+      NetworkMode: this.config.workerProvisioningDockerNetwork || undefined,
+    };
+
+    if (usePortPublishing) {
+      hostConfig.PortBindings = {
+        [`${spec.workerPort}/tcp`]: [{ HostPort: String(spec.publishedHostPort) }],
+      };
+    }
+
+    const containerConfig: Record<string, unknown> = {
+      Image: this.config.workerProvisioningImage,
+      Cmd: ["sh", "-lc", buildContainerBootstrapScript()],
+      Env: Object.entries(env).map(([key, value]) => `${key}=${value}`),
+      User: "root",
+      Labels: {
+        "teamclaw.managed": "true",
+        "teamclaw.team": this.config.teamName,
+        "teamclaw.role": spec.role,
+        "teamclaw.worker_id": spec.workerId,
+      },
+      HostConfig: hostConfig,
+    };
+
+    if (usePortPublishing) {
+      containerConfig.ExposedPorts = { [`${spec.workerPort}/tcp`]: {} };
+    }
+
     const response = await this.client.requestJson<{ Id?: string }>(
       "POST",
       `/containers/create?name=${encodeURIComponent(instanceName)}`,
-      {
-        Image: this.config.workerProvisioningImage,
-        Cmd: ["sh", "-lc", script],
-        Env: Object.entries(env).map(([key, value]) => `${key}=${value}`),
-        Labels: {
-          "teamclaw.managed": "true",
-          "teamclaw.team": this.config.teamName,
-          "teamclaw.role": spec.role,
-          "teamclaw.worker_id": spec.workerId,
-        },
-        HostConfig: {
-          Binds: buildDockerBinds(this.config),
-          NetworkMode: this.config.workerProvisioningDockerNetwork || undefined,
-        },
-      },
+      containerConfig,
       [201],
     );
 
@@ -831,14 +1044,109 @@ class DockerProvisioner implements WorkerProvisionerBackend {
   }
 }
 
+/**
+ * Lightweight Kubernetes API client using in-cluster service account or
+ * kubeconfig for out-of-cluster (via kubectl proxy or direct API).
+ * Avoids requiring kubectl binary in the container image.
+ */
+class K8sApiClient {
+  private token: string | undefined;
+  private caCert: Buffer | undefined;
+  private apiServer: string;
+  private contextArgs: string;
+
+  constructor(context: string, private readonly logger: PluginLogger) {
+    this.contextArgs = context;
+    // In-cluster detection: K8s injects these env vars and mounts SA token
+    const host = process.env.KUBERNETES_SERVICE_HOST;
+    const port = process.env.KUBERNETES_SERVICE_PORT;
+    if (host && port) {
+      this.apiServer = `https://${host}:${port}`;
+      try {
+        const fs = require("node:fs");
+        this.token = fs.readFileSync("/var/run/secrets/kubernetes.io/serviceaccount/token", "utf8").trim();
+        this.caCert = fs.readFileSync("/var/run/secrets/kubernetes.io/serviceaccount/ca.crt");
+      } catch {
+        logger.warn("K8sApiClient: in-cluster but cannot read service account token — falling back to kubectl");
+      }
+    } else {
+      // Out-of-cluster: delegate to kubectl
+      this.apiServer = "";
+    }
+  }
+
+  private get inCluster(): boolean {
+    return Boolean(this.apiServer && this.token);
+  }
+
+  async createPod(namespace: string, manifest: unknown): Promise<void> {
+    if (this.inCluster) {
+      await this.apiRequest("POST", `/api/v1/namespaces/${namespace}/pods`, manifest, [200, 201]);
+    } else {
+      await runCommand("kubectl", [
+        ...buildKubectlContextArgs(this.contextArgs),
+        "apply", "-f", "-",
+      ], JSON.stringify(manifest));
+    }
+  }
+
+  async deletePod(namespace: string, podName: string): Promise<void> {
+    if (this.inCluster) {
+      await this.apiRequest("DELETE", `/api/v1/namespaces/${namespace}/pods/${podName}?gracePeriodSeconds=0`, undefined, [200, 202, 404]);
+    } else {
+      await runCommand("kubectl", [
+        ...buildKubectlContextArgs(this.contextArgs),
+        "-n", namespace,
+        "delete", "pod", podName,
+        "--ignore-not-found=true", "--grace-period=0", "--force",
+      ]);
+    }
+  }
+
+  private async apiRequest(method: string, apiPath: string, body: unknown, okStatuses: number[]): Promise<string> {
+    const payload = body !== undefined ? JSON.stringify(body) : undefined;
+    return new Promise<string>((resolve, reject) => {
+      const url = new URL(apiPath, this.apiServer);
+      const options: https.RequestOptions = {
+        method,
+        hostname: url.hostname,
+        port: url.port,
+        path: url.pathname + url.search,
+        headers: {
+          "Authorization": `Bearer ${this.token}`,
+          ...(payload ? { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(payload) } : {}),
+        },
+        ...(this.caCert ? { ca: this.caCert } : { rejectUnauthorized: false }),
+      };
+
+      const req = https.request(options, (res) => {
+        let data = "";
+        res.on("data", (chunk: string) => { data += chunk; });
+        res.on("end", () => {
+          if (okStatuses.includes(res.statusCode ?? 0)) {
+            resolve(data);
+          } else {
+            reject(new Error(`K8s API ${method} ${apiPath} returned ${res.statusCode}: ${data.slice(0, 500)}`));
+          }
+        });
+      });
+      req.on("error", reject);
+      if (payload) req.write(payload);
+      req.end();
+    });
+  }
+}
+
 class KubernetesProvisioner implements WorkerProvisionerBackend {
   readonly type = "kubernetes" as const;
   private readonly config: PluginConfig;
   private readonly logger: PluginLogger;
+  private readonly k8sApi: K8sApiClient;
 
   constructor(config: PluginConfig, logger: PluginLogger) {
     this.config = config;
     this.logger = logger;
+    this.k8sApi = new K8sApiClient(config.workerProvisioningKubernetesContext, logger);
   }
 
   async launch(spec: LaunchSpec): Promise<LaunchResult> {
@@ -847,6 +1155,7 @@ class KubernetesProvisioner implements WorkerProvisionerBackend {
     }
 
     const instanceName = buildManagedInstanceName(this.config.teamName, spec.role, spec.workerId);
+    const ns = this.config.workerProvisioningKubernetesNamespace;
     const env = {
       ...spec.env,
       HOME: "/home/node",
@@ -863,13 +1172,17 @@ class KubernetesProvisioner implements WorkerProvisionerBackend {
     const hasPersistentWorkspace = Boolean(
       workspaceRoot && this.config.workerProvisioningKubernetesWorkspacePersistentVolumeClaim,
     );
+    const imagePullSecrets = this.config.workerProvisioningKubernetesImagePullSecrets
+      .map((name) => name.trim())
+      .filter((name) => name.length > 0)
+      .map((name) => ({ name }));
 
     const manifest = {
       apiVersion: "v1",
       kind: "Pod",
       metadata: {
         name: instanceName,
-        namespace: this.config.workerProvisioningKubernetesNamespace,
+        namespace: ns,
         labels: {
           app: "teamclaw-worker",
           "teamclaw.managed": "true",
@@ -885,6 +1198,7 @@ class KubernetesProvisioner implements WorkerProvisionerBackend {
         restartPolicy: "Never",
         hostname: buildManagedHostname(this.config.teamName, spec.role, spec.workerId),
         serviceAccountName: this.config.workerProvisioningKubernetesServiceAccount || undefined,
+        imagePullSecrets: imagePullSecrets.length > 0 ? imagePullSecrets : undefined,
         securityContext: hasPersistentWorkspace
           ? {
               runAsUser: 1000,
@@ -922,16 +1236,7 @@ class KubernetesProvisioner implements WorkerProvisionerBackend {
       },
     };
 
-    await runCommand(
-      "kubectl",
-      [
-        ...buildKubectlContextArgs(this.config.workerProvisioningKubernetesContext),
-        "apply",
-        "-f",
-        "-",
-      ],
-      JSON.stringify(manifest),
-    );
+    await this.k8sApi.createPod(ns, manifest);
     this.logger.info(`Provisioner: applied kubernetes pod ${instanceName}`);
 
     return {
@@ -945,18 +1250,8 @@ class KubernetesProvisioner implements WorkerProvisionerBackend {
     if (!podName) {
       return;
     }
-
-    await runCommand("kubectl", [
-      ...buildKubectlContextArgs(this.config.workerProvisioningKubernetesContext),
-      "-n",
-      this.config.workerProvisioningKubernetesNamespace,
-      "delete",
-      "pod",
-      podName,
-      "--ignore-not-found=true",
-      "--grace-period=0",
-      "--force",
-    ]);
+    const ns = this.config.workerProvisioningKubernetesNamespace;
+    await this.k8sApi.deletePod(ns, podName);
   }
 }
 
@@ -1084,7 +1379,13 @@ function buildProvisionedWorkerConfig(
 
   const gateway = ensureRecord(config.gateway);
   gateway.mode = "local";
-  gateway.bind = "loopback";
+  // Workers running inside Docker/K8s containers must bind on all
+  // interfaces so the controller (in a sibling container) can reach them.
+  gateway.bind =
+    controllerConfig.workerProvisioningType === "docker" ||
+    controllerConfig.workerProvisioningType === "kubernetes"
+      ? "lan"
+      : "loopback";
   gateway.port = spec.gatewayPort;
   delete gateway.remote;
   config.gateway = gateway;
@@ -1099,6 +1400,7 @@ function buildProvisionedWorkerConfig(
   teamclawEntry.enabled = true;
   const teamclawConfig = ensureRecord(teamclawEntry.config);
   teamclawConfig.mode = "worker";
+  teamclawConfig.processModel = "multi";
   teamclawConfig.role = spec.role;
   teamclawConfig.port = spec.workerPort;
   teamclawConfig.controllerUrl = spec.controllerUrl;
@@ -1110,7 +1412,6 @@ function buildProvisionedWorkerConfig(
   teamclawConfig.gitDefaultBranch = controllerConfig.gitDefaultBranch;
   teamclawConfig.gitAuthorName = controllerConfig.gitAuthorName;
   teamclawConfig.gitAuthorEmail = controllerConfig.gitAuthorEmail;
-  teamclawConfig.localRoles = [];
   teamclawConfig.workerProvisioningType = "none";
   teamclawConfig.workerProvisioningControllerUrl = "";
   teamclawConfig.workerProvisioningRoles = [];
@@ -1128,6 +1429,7 @@ function buildProvisionedWorkerConfig(
   teamclawConfig.workerProvisioningKubernetesNamespace = "default";
   teamclawConfig.workerProvisioningKubernetesContext = "";
   teamclawConfig.workerProvisioningKubernetesServiceAccount = "";
+  teamclawConfig.workerProvisioningKubernetesImagePullSecrets = [];
   teamclawConfig.workerProvisioningKubernetesWorkspacePersistentVolumeClaim = "";
   teamclawConfig.workerProvisioningKubernetesLabels = {};
   teamclawConfig.workerProvisioningKubernetesAnnotations = {};
@@ -1149,6 +1451,17 @@ function ensureProvisioningState(state: TeamState): TeamProvisioningState {
   return state.provisioning;
 }
 
+async function ensureWritableDirectory(dir: string): Promise<void> {
+  await fs.mkdir(dir, { recursive: true });
+  const probePath = path.join(dir, `.teamclaw-write-probe-${process.pid}-${Date.now()}`);
+  await fs.writeFile(probePath, "ok\n", "utf8");
+  await fs.rm(probePath, { force: true });
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
 async function loadOpenClawConfig(configPath: string): Promise<Record<string, unknown>> {
   const raw = await fs.readFile(configPath, "utf8");
   return parseLooseJsonObject(raw, configPath);
@@ -1159,11 +1472,45 @@ async function prepareProcessRuntimeExtensions(stateDir: string): Promise<void>
   const controllerExtensionsDir = path.join(path.dirname(resolveDefaultOpenClawConfigPath()), "extensions");
   if (await pathExists(controllerExtensionsDir)) {
     await fs.symlink(controllerExtensionsDir, runtimeExtensionsDir, "dir");
-    return;
+  } else {
+    await fs.mkdir(runtimeExtensionsDir, { recursive: true });
+    await fs.symlink(resolveCurrentTeamClawPluginRootDir(), path.join(runtimeExtensionsDir, "teamclaw"), "dir");
   }
 
-  await fs.mkdir(runtimeExtensionsDir, { recursive: true });
-  await fs.symlink(resolveCurrentTeamClawPluginRootDir(), path.join(runtimeExtensionsDir, "teamclaw"), "dir");
+  await copyControllerAuthProfiles(stateDir);
+}
+
+async function copyControllerAuthProfiles(stateDir: string): Promise<void> {
+  const candidateControllerStateDirs = [
+    path.dirname(resolveDefaultOpenClawConfigPath()),
+    resolveDefaultOpenClawStateDir(),
+  ];
+  const candidateAuthProfilePaths = [
+    path.join(resolveTeamClawAgentDir(), "auth-profiles.json"),
+    path.join(resolveDefaultAgentDir(), "auth-profiles.json"),
+    ...candidateControllerStateDirs.flatMap((controllerStateDir) => [
+      path.join(controllerStateDir, "agents", TEAMCLAW_AGENT_ID, "agent", "auth-profiles.json"),
+      path.join(controllerStateDir, "agents", "main", "agent", "auth-profiles.json"),
+    ]),
+  ].filter((value, index, values) => values.indexOf(value) === index);
+  let controllerAuthProfilesPath: string | undefined;
+  for (const candidatePath of candidateAuthProfilePaths) {
+    if (await pathExists(candidatePath)) {
+      controllerAuthProfilesPath = candidatePath;
+      break;
+    }
+  }
+  if (!controllerAuthProfilesPath) {
+    return;
+  }
+  const runtimeAuthProfilePaths = [
+    path.join(stateDir, "agents", TEAMCLAW_AGENT_ID, "agent", "auth-profiles.json"),
+    path.join(stateDir, "agents", "main", "agent", "auth-profiles.json"),
+  ];
+  for (const runtimeAuthProfilesPath of runtimeAuthProfilePaths) {
+    await fs.mkdir(path.dirname(runtimeAuthProfilesPath), { recursive: true });
+    await fs.copyFile(controllerAuthProfilesPath, runtimeAuthProfilesPath);
+  }
 }
 
 function cloneJson<T>(value: T): T {
@@ -1299,7 +1646,7 @@ function resolveGatewayEntrypoint(): string {
 }
 
 function resolveCurrentTeamClawPluginRootDir(): string {
-  return path.resolve(fileURLToPath(new URL("../../", import.meta.url)));
+  return process.env.TEAMCLAW_BAKED_IN === "true" ? "" : path.resolve(fileURLToPath(new URL("../../", import.meta.url)));
 }
 
 function attachChildLogs(child: ChildProcess, logger: PluginLogger, prefix: string): void {
@@ -1422,7 +1769,8 @@ function buildContainerBootstrapScript(): string {
 function buildDockerBinds(config: PluginConfig): string[] {
   const binds = [...config.workerProvisioningDockerMounts];
   if (!binds.some((bind) => extractDockerBindTarget(bind) === DEFAULT_DOCKER_BUNDLED_TEAMCLAW_PLUGIN_DIR)) {
-    binds.unshift(`${resolveCurrentTeamClawPluginRootDir()}:${DEFAULT_DOCKER_BUNDLED_TEAMCLAW_PLUGIN_DIR}:ro`);
+    const _pd = resolveCurrentTeamClawPluginRootDir();
+    if (_pd) binds.unshift(`${_pd}:${DEFAULT_DOCKER_BUNDLED_TEAMCLAW_PLUGIN_DIR}:ro`);
   }
   if (config.workerProvisioningDockerWorkspaceVolume && config.workerProvisioningWorkspaceRoot) {
     binds.unshift(`${config.workerProvisioningDockerWorkspaceVolume}:${config.workerProvisioningWorkspaceRoot}`);
@@ -1436,6 +1784,13 @@ function buildProvisionedWorkspaceDir(
   role: RoleId,
   workerId: string,
 ): string {
+  // Process-type workers run on the same host — share the controller's workspace
+  // so that file artifacts (previews, deliverables) are immediately visible to
+  // the controller without requiring git sync or file transfer.
+  if (provider === "process") {
+    return resolveTeamClawAgentWorkspaceRootDir();
+  }
+
   if (
     (provider !== "docker" && provider !== "kubernetes") ||
     !config.workerProvisioningWorkspaceRoot