jishushell 0.0.1 → 0.4.2

package/dist/services/setup-manager.js

@@ -0,0 +1,1922 @@
+import { execFileSync, execSync, spawn as nodeSpawn } from "child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, symlinkSync, unlinkSync, writeFileSync } from "fs";
+import { userInfo, homedir } from "node:os";
+import { randomBytes } from "node:crypto";
+import { tmpdir } from "node:os";
+import { dirname, join } from "path";
+import { StringDecoder } from "string_decoder";
+import { fileURLToPath } from "url";
+import { JISHUSHELL_HOME, getPanelConfig, savePanelConfig, setOpenclawDockerImage, getOpenclawDockerImage, isOfficialImage, CUSTOM_IMAGE_PREFIX, DEFAULT_OPENCLAW_DOCKER_IMAGE } from "../config.js";
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+// ── Paths ──────────────────────────────────────────────────────────
+const BIN_DIR = join(JISHUSHELL_HOME, "bin");
+const PACKAGES_DIR = join(JISHUSHELL_HOME, "packages");
+const OPENCLAW_PKG_DIR = join(PACKAGES_DIR, "openclaw");
+/** npm global-prefix layout: lib/node_modules/<pkg>, bin/<cmd> */
+const OPENCLAW_MODULES = join(OPENCLAW_PKG_DIR, "lib", "node_modules");
+const OPENCLAW_BIN_DIR = join(OPENCLAW_PKG_DIR, "bin");
+const NOMAD_BIN = join(BIN_DIR, "nomad");
+const NOMAD_CONFIG_DIR = join(JISHUSHELL_HOME, "nomad");
+const NOMAD_DATA_DIR = join(JISHUSHELL_HOME, "nomad", "data");
+const NOMAD_ALLOC_DIR = join(JISHUSHELL_HOME, "nomad", "data", "alloc");
+const NOMAD_VERSION = "1.11.3";
+let _serverPort = 8090;
+export function setServerPort(port) { _serverPort = port; }
+// ── Resolve non-root service user (board-agnostic) ─────────────────
+/**
+ * Determine which user the systemd service should run as.
+ *
+ * Strategy (in order):
+ *  1. If current process is NOT root, return the real username directly.
+ *  2. Under sudo, trust the kernel-set SUDO_UID (numeric, hard to spoof)
+ *     and reverse-lookup via `getent passwd <uid>`.
+ *  3. Fallback: scan /etc/passwd for the first user with UID >= 1000
+ *     (works on any board — pi, orangepi, rock, nvidia, etc.).
+ *  4. Throw instead of guessing — running as the wrong user is worse
+ *     than a visible installation error.
+ */
+function resolveServiceUser() {
+    const current = userInfo();
+    if (current.uid !== 0)
+        return current.username;
+    // Under sudo: SUDO_UID is set by the kernel and is numeric
+    const sudoUid = parseInt(process.env.SUDO_UID || "", 10);
+    if (Number.isFinite(sudoUid) && sudoUid >= 1000) {
+        try {
+            const entry = execFileSync("getent", ["passwd", String(sudoUid)], {
+                encoding: "utf8",
+                timeout: 3000,
+            }).trim();
+            const name = entry.split(":")[0];
+            if (name)
+                return name;
+        }
+        catch { /* getent failed, continue */ }
+    }
+    // Board-agnostic fallback: first real user (UID >= 1000, exclude nobody)
+    try {
+        const firstUser = execFileSync("getent", ["passwd"], {
+            encoding: "utf8",
+            timeout: 3000,
+        })
+            .split("\n")
+            .map((line) => line.split(":"))
+            .find((cols) => {
+            const uid = parseInt(cols[2], 10);
+            return uid >= 1000 && uid < 65534;
+        });
+        if (firstUser?.[0])
+            return firstUser[0];
+    }
+    catch { /* /etc/passwd unreadable */ }
+    throw new Error("Cannot determine service user. Run with a non-root user or set SUDO_UID.");
+}
+const tasks = new Map();
+const TASK_MAX_AGE = 600000; // 10 minutes
+// Periodically clean up completed tasks to prevent memory accumulation
+setInterval(() => {
+    const now = Date.now();
+    for (const [id, task] of tasks) {
+        if (task.status !== "running" && now - parseInt(id.split("-").pop() || "0") > TASK_MAX_AGE) {
+            tasks.delete(id);
+        }
+    }
+}, 60000).unref();
+function createTask(name) {
+    const id = `${name}-${Date.now()}`;
+    const task = { id, name, status: "running", events: [], listeners: new Set() };
+    tasks.set(id, task);
+    return task;
+}
+const MAX_TASK_EVENTS = 500;
+function emitTask(task, event) {
+    task.events.push(event);
+    // Cap events to prevent unbounded memory growth on long-running tasks
+    // (e.g., Docker pull/build can produce thousands of progress lines)
+    if (task.events.length > MAX_TASK_EVENTS) {
+        task.events.splice(0, task.events.length - MAX_TASK_EVENTS);
+    }
+    for (const listener of task.listeners) {
+        listener(event);
+    }
+}
+export function getTask(id) {
+    return tasks.get(id);
+}
+export function getTaskSnapshot(id) {
+    const task = tasks.get(id);
+    if (!task)
+        return undefined;
+    return {
+        id: task.id,
+        name: task.name,
+        status: task.status,
+        events: [...task.events],
+    };
+}
+/** Find running tasks, optionally filtered by name prefix */
+export function getRunningTasks(namePrefix) {
+    const result = [];
+    for (const [id, task] of tasks) {
+        if (task.status !== "running")
+            continue;
+        if (namePrefix && !task.name.startsWith(namePrefix))
+            continue;
+        result.push({ id, name: task.name });
+    }
+    return result;
+}
+export function subscribeTask(id, listener) {
+    const task = tasks.get(id);
+    if (!task)
+        return null;
+    task.listeners.add(listener);
+    // Send existing events
+    for (const event of task.events) {
+        listener(event);
+    }
+    return () => task.listeners.delete(listener);
+}
+const ANSI_ESCAPE_RE = /\u001B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g;
+function sanitizeTaskLine(line) {
+    return line
+        .replace(ANSI_ESCAPE_RE, "")
+        .replace(/[\u0000-\u0008\u000B-\u001F\u007F]/g, "")
+        .trimEnd();
+}
+/** Run a shell command as a spawned process, streaming output to a task */
+function spawnWithTask(task, cmd, args, options = {}) {
+    return new Promise((resolve) => {
+        const env = { ...process.env, ...options.env };
+        const child = nodeSpawn(cmd, args, {
+            env,
+            cwd: options.cwd,
+            timeout: options.timeout || 600000,
+        });
+        let output = "";
+        const stdoutDecoder = new StringDecoder("utf8");
+        const stderrDecoder = new StringDecoder("utf8");
+        let stdoutPending = "";
+        let stderrPending = "";
+        const emitLine = (rawLine) => {
+            const line = sanitizeTaskLine(rawLine);
+            if (!line.trim())
+                return;
+            // Try to parse progress
+            if (options.progressParser) {
+                const pct = options.progressParser(line);
+                if (pct !== null) {
+                    emitTask(task, { type: "progress", message: line, progress: pct });
+                    return;
+                }
+            }
+            emitTask(task, { type: "log", message: line });
+        };
+        const handleDecodedText = (text, stream) => {
+            if (!text)
+                return;
+            output += text;
+            const normalized = `${stream === "stdout" ? stdoutPending : stderrPending}${text}`
+                .replace(/\r\n/g, "\n")
+                .replace(/\r/g, "\n");
+            const lines = normalized.split("\n");
+            const pending = lines.pop() ?? "";
+            if (stream === "stdout")
+                stdoutPending = pending;
+            else
+                stderrPending = pending;
+            for (const line of lines) {
+                emitLine(line);
+            }
+        };
+        child.stdout?.on("data", (data) => {
+            handleDecodedText(stdoutDecoder.write(data), "stdout");
+        });
+        child.stderr?.on("data", (data) => {
+            handleDecodedText(stderrDecoder.write(data), "stderr");
+        });
+        child.on("close", (code) => {
+            handleDecodedText(stdoutDecoder.end(), "stdout");
+            handleDecodedText(stderrDecoder.end(), "stderr");
+            emitLine(stdoutPending);
+            emitLine(stderrPending);
+            resolve({ ok: code === 0, output });
+        });
+        child.on("error", (err) => {
+            emitTask(task, { type: "log", message: `Error: ${err.message}` });
+            resolve({ ok: false, output: err.message });
+        });
+    });
+}
+// ── Progress parsers ───────────────────────────────────────────────
+function npmProgressParser(line) {
+    // npm shows "added X packages" at the end
+    if (line.includes("added") && line.includes("packages"))
+        return 100;
+    // npm progress: "reify:packagename: timing"
+    if (line.includes("reify:"))
+        return null; // just a log line
+    return null;
+}
+function dockerBuildProgressParser(line) {
+    // Docker build steps: "Step 1/6", "Step 2/6", etc.
+    const legacyMatch = line.match(/Step\s+(\d+)\/(\d+)/);
+    if (legacyMatch) {
+        return Math.round((parseInt(legacyMatch[1], 10) / parseInt(legacyMatch[2], 10)) * 100);
+    }
+    // BuildKit plain output: "#5 [2/4] COPY node_modules ..."
+    const buildkitMatch = line.match(/\[(\d+)\/(\d+)\]/);
+    if (buildkitMatch) {
+        return Math.round((parseInt(buildkitMatch[1], 10) / parseInt(buildkitMatch[2], 10)) * 100);
+    }
+    if (/exporting to image/i.test(line))
+        return 95;
+    if (/naming to /i.test(line))
+        return 98;
+    return null;
+}
+function curlProgressParser(line) {
+    // curl with -# shows progress
+    const match = line.match(/(\d+\.?\d*)%/);
+    if (match)
+        return Math.round(parseFloat(match[1]));
+    return null;
+}
+// ── Dir size tracker for npm installs ──────────────────────────────
+function getDirSizeMB(dir) {
+    try {
+        const result = execFileSync("du", ["-sm", dir], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+        return parseInt(result.split("\t")[0]) || 0;
+    }
+    catch {
+        return 0;
+    }
+}
+function checkCommand(cmd, versionFlag = "--version") {
+    try {
+        const version = execFileSync(cmd, [versionFlag], { encoding: "utf-8", timeout: 10000, stdio: ["pipe", "pipe", "pipe"] }).trim();
+        let cmdPath = "";
+        try {
+            cmdPath = execFileSync("which", [cmd], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] }).trim();
+        }
+        catch { }
+        return { ok: true, version, path: cmdPath };
+    }
+    catch {
+        return { ok: false, version: "", path: "" };
+    }
+}
+function isProcessRunning(name) {
+    try {
+        const result = execFileSync("pgrep", ["-f", name], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+        return result.trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+function isPortListening(port) {
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        return false;
+    const p = String(port);
+    try {
+        if (process.platform === "darwin") {
+            const result = execFileSync("lsof", ["-iTCP:" + p, "-sTCP:LISTEN", "-t"], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+            return result.trim().length > 0;
+        }
+        else {
+            // Linux: prefer ss, fall back to netstat
+            try {
+                const result = execFileSync("ss", ["-tlnp"], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+                return new RegExp(`:${p}\\s`).test(result);
+            }
+            catch {
+                const result = execFileSync("netstat", ["-tlnp"], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+                return new RegExp(`:${p}\\s`).test(result);
+            }
+        }
+    }
+    catch {
+        return false;
+    }
+}
+function checkSudo() {
+    try {
+        execSync("sudo -n true 2>/dev/null", { timeout: 3000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Check if kernel memory cgroup is enabled (required for Docker memory stats on RPi) */
+function isCgroupMemoryEnabled() {
+    try {
+        const cgroups = readFileSync("/proc/cgroups", "utf-8");
+        const memLine = cgroups.split("\n").find(l => l.startsWith("memory\t"));
+        if (!memLine)
+            return false;
+        // Format: name hierarchy num_cgroups enabled
+        return memLine.trim().endsWith("1");
+    }
+    catch {
+        return true; /* non-Linux or unreadable — assume ok */
+    }
+}
+/** Enable cgroup memory in boot cmdline if not already enabled. Returns true if a reboot is needed. */
+export function ensureCgroupMemory() {
+    if (isCgroupMemoryEnabled())
+        return false;
+    const candidates = ["/boot/firmware/cmdline.txt", "/boot/cmdline.txt"];
+    for (const f of candidates) {
+        if (!existsSync(f))
+            continue;
+        try {
+            const content = readFileSync(f, "utf-8").trim();
+            if (content.includes("cgroup_memory=1"))
+                return false; // already in cmdline, just needs reboot
+            const patched = `${content} cgroup_memory=1 cgroup_enable=memory`;
+            execFileSync("sudo", ["cp", f, f + ".bak"], { timeout: 5000 });
+            // Write to tmp file then sudo cp to avoid shell interpolation of file content
+            const tmpPath = join(dirname(f), ".cmdline.tmp");
+            writeFileSync(tmpPath, patched + "\n");
+            execFileSync("sudo", ["cp", tmpPath, f], { timeout: 5000 });
+            try {
+                unlinkSync(tmpPath);
+            }
+            catch { }
+            console.log(`[setup] enabled cgroup memory in ${f} (reboot required)`);
+            return true;
+        }
+        catch (e) {
+            console.warn(`[setup] failed to patch ${f}:`, e.message);
+        }
+    }
+    return false;
+}
+function canAccessDockerDaemon(timeout = 10000) {
+    try {
+        execFileSync("docker", ["info"], { timeout, stdio: "ignore" });
+        return true;
+    }
+    catch { }
+    try {
+        execFileSync("sudo", ["-n", "docker", "info"], { timeout, stdio: "ignore" });
+        return true;
+    }
+    catch { }
+    return false;
+}
+function getDockerVersionLine(timeout = 10000) {
+    try {
+        return execFileSync("docker", ["--version"], { encoding: "utf-8", timeout }).trim();
+    }
+    catch { }
+    try {
+        return execFileSync("sudo", ["-n", "docker", "--version"], { encoding: "utf-8", timeout }).trim();
+    }
+    catch { }
+    return "installed";
+}
+export function getSetupStatus() {
+    // Fast path: if setup is already complete, do lightweight checks before returning cached result
+    const config = getPanelConfig();
+    if (config.service_manager) {
+        const localBin = join(OPENCLAW_BIN_DIR, "openclaw");
+        const localBinOk = existsSync(localBin);
+        const fastDockerImageReady = checkDockerImageExists();
+        const baseTag = resolveDockerImageTag();
+        const official = isOfficialImage(baseTag);
+        // Official image: Docker image alone is sufficient. Slim base: also needs npm package.
+        const openclawOk = official ? fastDockerImageReady : (localBinOk || fastDockerImageReady);
+        // Lightweight validation: verify critical services are actually available
+        const dockerOk = canAccessDockerDaemon(5000);
+        const nomadOk = isPortListening(4646);
+        const hasSudo = checkSudo();
+        // If any critical check fails, fall through to the slow full check path
+        if (!openclawOk || !dockerOk || !nomadOk || !hasSudo) {
+            // Fall through to full check below
+        }
+        else {
+            // Fetch real versions (cheap execs, no fallback to slow path)
+            let dockerVer = "installed";
+            try {
+                dockerVer = execFileSync("docker", ["--version"], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] }).trim().split("\n")[0];
+            }
+            catch { }
+            let nomadVer = "installed";
+            try {
+                nomadVer = execFileSync(NOMAD_BIN, ["--version"], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] }).trim().split("\n")[0];
+            }
+            catch { }
+            let openclawVer = "installed";
+            let openclawPath = localBin;
+            if (official && fastDockerImageReady) {
+                // Official image: extract version from Docker image tag
+                openclawVer = baseTag.split(":").pop() || "local";
+                openclawPath = baseTag;
+            }
+            else {
+                // Prefer npm package.json for accurate OpenClaw version.
+                try {
+                    const pkg = join(OPENCLAW_MODULES, "openclaw", "package.json");
+                    if (existsSync(pkg))
+                        openclawVer = JSON.parse(readFileSync(pkg, "utf-8")).version || openclawVer;
+                }
+                catch { }
+                // Fallback: extract version from old-style openclaw:* image tag (legacy migration path).
+                if (openclawVer === "installed" && fastDockerImageReady) {
+                    const imageTag = resolveDockerImageTag();
+                    if (/^openclaw:/i.test(imageTag)) {
+                        openclawVer = imageTag.replace(/^openclaw:/i, "");
+                        openclawPath = imageTag;
+                    }
+                }
+            }
+            // Official image: only Docker image needed.
+            // Slim base (jishushell-base:*): both npm package and Docker image required.
+            const needsNpmForMount = /^jishushell-base:/i.test(baseTag);
+            const ready = official
+                ? fastDockerImageReady
+                : (openclawOk && fastDockerImageReady && (!needsNpmForMount || localBinOk));
+            return {
+                node: { name: "Node.js", installed: true, running: true, version: process.version, path: process.execPath },
+                docker: { name: "Docker", installed: true, running: true, version: dockerVer, path: "" },
+                nomad: { name: "Nomad", installed: true, running: true, version: nomadVer, path: NOMAD_BIN },
+                openclaw: { name: "OpenClaw", installed: openclawOk, running: false, version: openclawVer, path: openclawPath },
+                dockerImageReady: fastDockerImageReady,
+                ready,
+                providerConfigured: !!config.default_provider,
+                hasSudo: true,
+            };
+        }
+    }
+    const NODE_MINIMUM_MAJOR = 22;
+    // Use the currently-running Node binary (process.execPath) as the ground
+    // truth — avoids false-negative when PATH doesn't include nvm's bin dir
+    // (e.g. when started via systemd with a minimal environment).
+    const nodeVersion = process.version;
+    const nodeMajor = parseInt(nodeVersion.replace("v", "").split(".")[0], 10);
+    const nodeStatus = {
+        name: "Node.js",
+        installed: true,
+        running: true,
+        version: nodeVersion,
+        path: process.execPath,
+        needsUpgrade: nodeMajor < NODE_MINIMUM_MAJOR,
+    };
+    const docker = checkCommand("docker");
+    // Use docker info to verify daemon accessibility (not just process existence)
+    // Also try sudo in case the user hasn't logged out since being added to the docker group
+    const dockerRunning = canAccessDockerDaemon(10000);
+    const dockerStatus = {
+        name: "Docker",
+        installed: docker.ok,
+        running: dockerRunning,
+        version: docker.version.split("\n")[0],
+        path: docker.path,
+    };
+    let nomad = checkCommand("nomad");
+    if (!nomad.ok && existsSync(NOMAD_BIN)) {
+        nomad = checkCommand(NOMAD_BIN);
+    }
+    const nomadRunning = isPortListening(4646);
+    const nomadStatus = {
+        name: "Nomad",
+        installed: nomad.ok,
+        running: nomadRunning,
+        version: nomad.version.split("\n")[0],
+        path: nomad.path || NOMAD_BIN,
+    };
+    let openclaw = checkCommand("openclaw");
+    if (!openclaw.ok) {
+        const localBin = join(OPENCLAW_BIN_DIR, "openclaw");
+        if (existsSync(localBin)) {
+            let ver = "installed";
+            try {
+                const pkg = join(OPENCLAW_MODULES, "openclaw", "package.json");
+                if (existsSync(pkg)) {
+                    const pkgJson = JSON.parse(readFileSync(pkg, "utf-8"));
+                    ver = pkgJson.version || "installed";
+                }
+            }
+            catch { }
+            openclaw = { ok: true, version: ver, path: localBin };
+        }
+    }
+    const dockerImageReady = checkDockerImageExists();
+    // If the Docker image already exists, treat openclaw as installed even when
+    // the local npm package is absent — the image is all that's needed to run instances.
+    if (!openclaw.ok && dockerImageReady) {
+        const imageTag = resolveDockerImageTag();
+        // Official image: extract version from tag (e.g. ghcr.io/openclaw/openclaw:2026.3.31 → 2026.3.31)
+        // Legacy image: strip openclaw: prefix
+        const tagVersion = isOfficialImage(imageTag)
+            ? (imageTag.split(":").pop() || "local")
+            : imageTag.replace(/^openclaw:/i, "");
+        openclaw = { ok: true, version: tagVersion, path: imageTag };
+    }
+    const openclawStatus = {
+        name: "OpenClaw",
+        installed: openclaw.ok,
+        running: false,
+        version: openclaw.version.split("\n")[0],
+        path: openclaw.path,
+    };
+    const ready = nodeStatus.installed && !nodeStatus.needsUpgrade && dockerStatus.installed && dockerStatus.running && nomadStatus.installed && nomadStatus.running && openclawStatus.installed && dockerImageReady;
+    const providerConfigured = !!getPanelConfig().default_provider;
+    // Read-only check: report whether cgroup memory needs fixing (actual fix is in POST install routes)
+    let needsReboot;
+    if (dockerStatus.installed && !isCgroupMemoryEnabled()) {
+        needsReboot = true;
+    }
+    const runningTasks = getRunningTasks();
+    return { node: nodeStatus, docker: dockerStatus, nomad: nomadStatus, openclaw: openclawStatus, ready, providerConfigured, dockerImageReady, hasSudo: checkSudo(), needsReboot, runningTasks: runningTasks.length ? runningTasks : undefined };
+}
+// ── Upgrade Node.js ────────────────────────────────────────────────
+export async function upgradeNode(targetMajor = 22) {
+    try {
+        const current = process.version; // e.g. "v20.20.1"
+        const currentMajor = parseInt(current.replace("v", "").split(".")[0]);
+        if (currentMajor >= targetMajor) {
+            return { ok: true, message: `Node.js ${current} already meets requirement (>= ${targetMajor})` };
+        }
+        const task = createTask("node-upgrade");
+        emitTask(task, { type: "progress", message: `升级 Node.js: ${current} → v${targetMajor}`, progress: 0 });
+        if (process.platform === "darwin") {
+            try {
+                execSync("brew --version", { timeout: 5000 });
+            }
+            catch {
+                emitTask(task, { type: "error", message: "未找到 Homebrew" });
+                task.status = "error";
+                return { ok: false, message: "Homebrew not found", error: "Install Homebrew first: https://brew.sh", taskId: task.id };
+            }
+            emitTask(task, { type: "progress", message: `安装 Node.js ${targetMajor} (brew)...`, progress: 20 });
+            const installResult = await spawnWithTask(task, "brew", ["install", `node@${targetMajor}`], { timeout: 300000 });
+            if (!installResult.ok) {
+                emitTask(task, { type: "error", message: "Node.js 安装失败" });
+                task.status = "error";
+                return { ok: false, message: "Node.js install failed", error: installResult.output, taskId: task.id };
+            }
+            emitTask(task, { type: "progress", message: "链接 Node.js...", progress: 80 });
+            try {
+                execSync(`brew link --overwrite --force node@${targetMajor}`, { timeout: 30000 });
+            }
+            catch { }
+        }
+        else {
+            // Use NodeSource setup script
+            emitTask(task, { type: "log", message: "下载 NodeSource 安装脚本..." });
+            emitTask(task, { type: "progress", message: "配置软件源...", progress: 10 });
+            // Use a unique temp path to prevent TOCTOU race: a fixed name like
+            // /tmp/nodesource_setup_22.sh could be replaced by another process
+            // between download (curl) and execution (sudo bash).
+            const nsScriptPath = join(tmpdir(), `nodesource_setup_${targetMajor}_${randomBytes(8).toString("hex")}.sh`);
+            const dlResult = await spawnWithTask(task, "curl", ["-fsSL", `https://deb.nodesource.com/setup_${targetMajor}.x`, "-o", nsScriptPath], { timeout: 60000 });
+            if (!dlResult.ok) {
+                emitTask(task, { type: "error", message: "NodeSource 脚本下载失败" });
+                task.status = "error";
+                return { ok: false, message: "NodeSource script download failed", error: dlResult.output, taskId: task.id };
+            }
+            const setupResult = await spawnWithTask(task, "sudo", ["-E", "bash", nsScriptPath], { timeout: 120000 });
+            if (!setupResult.ok) {
+                emitTask(task, { type: "error", message: "NodeSource 配置失败" });
+                task.status = "error";
+                return { ok: false, message: "Node.js source setup failed", error: setupResult.output, taskId: task.id };
+            }
+            emitTask(task, { type: "progress", message: "安装 Node.js...", progress: 50 });
+            const installResult = await spawnWithTask(task, "sudo", ["apt-get", "install", "-y", "nodejs"], { timeout: 300000 });
+            if (!installResult.ok) {
+                emitTask(task, { type: "error", message: "Node.js 安装失败" });
+                task.status = "error";
+                return { ok: false, message: "Node.js install failed", error: installResult.output, taskId: task.id };
+            }
+        }
+        const newVersion = execSync("node --version", { encoding: "utf-8", timeout: 5000 }).trim();
+        emitTask(task, { type: "done", message: `Node.js 升级完成: ${newVersion}`, progress: 100 });
+        task.status = "done";
+        return { ok: true, message: `Node.js upgraded to ${newVersion}. 请重启 JishuShell 以使用新版本。`, taskId: task.id };
+    }
+    catch (e) {
+        return { ok: false, message: "Node.js upgrade failed", error: e.message };
+    }
+}
+// ── Install Docker (async with progress) ───────────────────────────
+async function installDockerWithTask(task) {
+    try {
+        emitTask(task, { type: "progress", message: "开始安装 Docker...", progress: 0 });
+        const user = execSync("whoami", { encoding: "utf-8", timeout: 5000 }).trim();
+        // ── 尝试 get.docker.com 便捷脚本 ──────────────────────────────
+        emitTask(task, { type: "log", message: "下载 Docker 安装脚本..." });
+        emitTask(task, { type: "progress", message: "下载中...", progress: 5 });
+        // Unique temp path prevents TOCTOU: another user can't swap a fixed /tmp/get-docker.sh
+        // between our download and the sudo sh invocation.
+        const dockerScriptPath = join(tmpdir(), `get-docker_${randomBytes(8).toString("hex")}.sh`);
+        const dlResult = await spawnWithTask(task, "curl", ["-fsSL", "https://get.docker.com", "-o", dockerScriptPath], {
+            timeout: 60000,
+        });
+        let scriptOk = false;
+        if (dlResult.ok) {
+            emitTask(task, { type: "log", message: "运行 Docker 安装脚本..." });
+            const scriptResult = await spawnWithTask(task, "sudo", ["sh", dockerScriptPath], {
+                timeout: 600000,
+                progressParser: (line) => {
+                    if (line.includes("Executing docker install script"))
+                        return 10;
+                    if (line.includes("apt-get update"))
+                        return 20;
+                    if (line.includes("Installing packages"))
+                        return 40;
+                    if (line.includes("docker-ce"))
+                        return 60;
+                    if (line.includes("containerd"))
+                        return 70;
+                    if (line.includes("Created symlink"))
+                        return 85;
+                    return null;
+                },
+            });
+            scriptOk = scriptResult.ok;
+            if (!scriptOk) {
+                emitTask(task, { type: "log", message: "便捷脚本安装失败，尝试 apt 仓库方式..." });
+            }
+        }
+        else {
+            emitTask(task, { type: "log", message: "下载便捷脚本失败，尝试 apt 仓库方式..." });
+        }
+        // ── 回退: apt 仓库手动安装 (兼容 Debian trixie 等预发行版) ────
+        if (!scriptOk) {
+            emitTask(task, { type: "progress", message: "通过 apt 仓库安装 Docker...", progress: 15 });
+            // 检测系统 ID 和版本代号，对 trixie/sid 等降级至 bookworm
+            let codename = "bookworm";
+            let repoOs = "debian";
+            try {
+                const osRelease = readFileSync("/etc/os-release", "utf-8");
+                const codenameMatch = osRelease.match(/^VERSION_CODENAME=(.+)$/m);
+                const distroId = (osRelease.match(/^ID=(.+)$/m)?.[1] || "debian").trim();
+                const raw = (codenameMatch?.[1] || "").trim();
+                repoOs = (distroId === "ubuntu") ? "ubuntu" : "debian";
+                // Debian testing/unstable: trixie, sid → 使用上一个稳定版仓库
+                const unstableCodenames = new Set(["trixie", "forky", "sid", "unstable", "testing"]);
+                const ubuntuFallback = "noble";
+                if (distroId === "ubuntu" && unstableCodenames.has(raw)) {
+                    codename = ubuntuFallback;
+                }
+                else if (unstableCodenames.has(raw)) {
+                    codename = "bookworm";
+                }
+                else {
+                    codename = raw || "bookworm";
+                }
+            }
+            catch { }
+            emitTask(task, { type: "log", message: `使用仓库 codename: ${codename} (OS: ${repoOs})` });
+            const aptSteps = [
+                ["sudo", ["apt-get", "update", "-qq"]],
+                ["sudo", ["apt-get", "install", "-y", "-qq", "ca-certificates", "curl", "gnupg"]],
+                ["sudo", ["install", "-m", "0755", "-d", "/etc/apt/keyrings"]],
+                ["sudo", ["bash", "-c",
+                        `curl -fsSL https://download.docker.com/linux/${repoOs}/gpg | gpg --dearmor --yes -o /etc/apt/keyrings/docker.gpg && chmod a+r /etc/apt/keyrings/docker.gpg`
+                    ]],
+                ["sudo", ["bash", "-c",
+                        `echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/${repoOs} ${codename} stable" > /etc/apt/sources.list.d/docker.list`
+                    ]],
+                ["sudo", ["apt-get", "update", "-qq"]],
+                ["sudo", ["apt-get", "install", "-y", "-qq",
+                        "docker-ce", "docker-ce-cli", "containerd.io", "docker-buildx-plugin", "docker-compose-plugin"
+                    ]],
+            ];
+            const progressSteps = [5, 15, 20, 30, 35, 45, 80];
+            for (let i = 0; i < aptSteps.length; i++) {
+                const [cmd, args] = aptSteps[i];
+                emitTask(task, { type: "progress", message: `${cmd} ${args[0]}...`, progress: progressSteps[i] });
+                const r = await spawnWithTask(task, cmd, args, { timeout: 300000 });
+                if (!r.ok) {
+                    emitTask(task, { type: "error", message: `apt 安装失败 (步骤 ${i + 1}): ${args.join(" ")}` });
+                    task.status = "error";
+                    return { ok: false, message: "Docker apt installation failed", error: r.output, taskId: task.id };
+                }
+            }
+        }
+        // ── 收尾 ───────────────────────────────────────────────────────
+        emitTask(task, { type: "progress", message: "配置用户权限...", progress: 90 });
+        try {
+            execFileSync("sudo", ["groupadd", "docker"], { timeout: 10000 });
+        }
+        catch { }
+        try {
+            execFileSync("sudo", ["usermod", "-aG", "docker", user], { timeout: 10000 });
+        }
+        catch { }
+        emitTask(task, { type: "log", message: "注意: Docker 用户组变更可能需要重新登录才能生效" });
+        emitTask(task, { type: "progress", message: "启动 Docker 服务...", progress: 93 });
+        try {
+            execSync("sudo systemctl enable --now docker", { timeout: 30000 });
+        }
+        catch { }
+        // Enable cgroup memory for Docker stats (RPi default has it disabled)
+        const needsReboot = ensureCgroupMemory();
+        if (needsReboot) {
+            emitTask(task, { type: "log", message: "已启用内存 cgroup（需要重启生效，Docker 内存统计才会正常）" });
+        }
+        const version = getDockerVersionLine(10000);
+        // 用 sudo docker 验证 daemon（当前用户还未加入 docker 组时需要 sudo）
+        const daemonOk = canAccessDockerDaemon(10000);
+        if (daemonOk) {
+            const doneMsg = needsReboot
+                ? `Docker 安装完成: ${version}（需要重启以启用内存统计）`
+                : `Docker 安装完成: ${version}`;
+            emitTask(task, { type: "done", message: doneMsg, progress: 100 });
+            task.status = "done";
+            return { ok: true, message: `Docker installed: ${version}`, needsReboot, taskId: task.id };
+        }
+        else {
+            emitTask(task, { type: "error", message: `Docker 已安装但 daemon 未运行: ${version}` });
+            task.status = "error";
+            return { ok: false, message: `Docker installed but daemon not accessible`, error: "Try: sudo systemctl start docker", taskId: task.id };
+        }
+    }
+    catch (e) {
+        return { ok: false, message: "Docker installation failed", error: e.message };
+    }
+}
+/** Ensure current user is in docker group and service is enabled (idempotent) */
+function ensureDockerPostInstall() {
+    try {
+        const user = execSync("whoami", { encoding: "utf-8", timeout: 5000 }).trim();
+        try {
+            execFileSync("sudo", ["groupadd", "docker"], { timeout: 5000, stdio: "pipe" });
+        }
+        catch { }
+        try {
+            execFileSync("sudo", ["usermod", "-aG", "docker", user], { timeout: 5000 });
+        }
+        catch { }
+        try {
+            execFileSync("sudo", ["systemctl", "enable", "--now", "docker"], { timeout: 10000 });
+        }
+        catch { }
+    }
+    catch { }
+}
+export async function installDocker() {
+    if (canAccessDockerDaemon(5000)) {
+        ensureDockerPostInstall();
+        const needsReboot = ensureCgroupMemory();
+        return { ok: true, message: "Docker already installed", needsReboot };
+    }
+    const task = createTask("docker");
+    return installDockerWithTask(task);
+}
+export function startInstallDocker() {
+    if (canAccessDockerDaemon(5000)) {
+        ensureDockerPostInstall();
+        ensureCgroupMemory();
+        return { ok: true, message: "Docker already installed" };
+    }
+    const task = createTask("docker");
+    void installDockerWithTask(task).catch((err) => {
+        emitTask(task, { type: "error", message: `Docker 安装失败: ${err?.message || err}` });
+        task.status = "error";
+    });
+    return { ok: true, message: "Docker install started", taskId: task.id };
+}
+// ── Install Nomad (async with progress) ────────────────────────────
+function getNomadDownloadUrl() {
+    const arch = process.arch === "arm64" ? "arm64" : "amd64";
+    const os = process.platform === "linux" ? "linux" : "darwin";
+    return `https://releases.hashicorp.com/nomad/${NOMAD_VERSION}/nomad_${NOMAD_VERSION}_${os}_${arch}.zip`;
+}
+export async function installNomad() {
+    try {
+        if (existsSync(NOMAD_BIN)) {
+            // Boundary check 1: is it a regular file?
+            try {
+                const stat = (await import("fs")).statSync(NOMAD_BIN);
+                if (!stat.isFile()) {
+                    try {
+                        unlinkSync(NOMAD_BIN);
+                    }
+                    catch { }
+                }
+            }
+            catch { }
+            if (existsSync(NOMAD_BIN)) {
+                // Boundary check 2: is it executable?
+                try {
+                    chmodSync(NOMAD_BIN, 0o755);
+                }
+                catch { }
+                // Boundary check 3: does it actually run?
+                try {
+                    const version = execSync(`"${NOMAD_BIN}" version`, { encoding: "utf-8", timeout: 5000 }).trim();
+                    // Ensure Nomad is started even if already installed
+                    if (!isPortListening(4646)) {
+                        try {
+                            installNomadSystemd();
+                        }
+                        catch { }
+                        if (!isPortListening(4646)) {
+                            await startNomad();
+                        }
+                    }
+                    return { ok: true, message: `Nomad already installed: ${version.split("\n")[0]}` };
+                }
+                catch {
+                    // Binary is corrupt or wrong arch — remove and reinstall
+                    try {
+                        unlinkSync(NOMAD_BIN);
+                    }
+                    catch { }
+                }
+            }
+        }
+        // Fallback: if NOMAD_BIN still doesn't exist, check for a system-installed Nomad
+        // (e.g. installed via apt/dnf) and create a symlink so the systemd service path resolves.
+        if (!existsSync(NOMAD_BIN)) {
+            try {
+                const systemNomad = execSync("which nomad 2>/dev/null", { encoding: "utf-8" }).trim();
+                if (systemNomad && existsSync(systemNomad)) {
+                    mkdirSync(BIN_DIR, { recursive: true });
+                    symlinkSync(systemNomad, NOMAD_BIN);
+                    const version = execSync(`${NOMAD_BIN} version`, { encoding: "utf-8", timeout: 5000 }).trim();
+                    console.log(`[nomad] Linked system nomad ${systemNomad} → ${NOMAD_BIN}`);
+                    return { ok: true, message: `Nomad linked from system: ${version.split("\n")[0]}` };
+                }
+            }
+            catch { /* system nomad not found — proceed to download */ }
+        }
+        const task = createTask("nomad");
+        mkdirSync(BIN_DIR, { recursive: true });
+        const url = getNomadDownloadUrl();
+        const zipPath = join(BIN_DIR, "nomad.zip");
+        emitTask(task, { type: "progress", message: "下载 Nomad...", progress: 0 });
+        const result = await spawnWithTask(task, "curl", ["-fL", "--progress-bar", url, "-o", zipPath], {
+            timeout: 300000,
+            progressParser: curlProgressParser,
+        });
+        if (!result.ok) {
+            emitTask(task, { type: "error", message: "Nomad 下载失败" });
+            task.status = "error";
+            return { ok: false, message: "Nomad download failed", error: result.output, taskId: task.id };
+        }
+        emitTask(task, { type: "progress", message: "解压 Nomad...", progress: 80 });
+        try {
+            execSync("which unzip", { stdio: "ignore" });
+        }
+        catch {
+            emitTask(task, { type: "log", message: "未找到 unzip，尝试安装..." });
+            try {
+                if (process.platform === "linux") {
+                    execSync("sudo apt-get update -qq && sudo apt-get install -y -qq unzip", { timeout: 60000 });
+                }
+                else if (process.platform === "darwin") {
+                    execSync("brew install unzip", { timeout: 60000 });
+                }
+            }
+            catch (e) {
+                emitTask(task, { type: "error", message: "安装 unzip 失败，请手动安装后重试" });
+                throw e;
+            }
+        }
+        execFileSync("unzip", ["-o", zipPath, "-d", BIN_DIR], { timeout: 30000 });
+        chmodSync(NOMAD_BIN, 0o755);
+        try {
+            unlinkSync(zipPath);
+        }
+        catch { }
+        const version = execFileSync(NOMAD_BIN, ["version"], { encoding: "utf-8", timeout: 5000 }).trim();
+        emitTask(task, { type: "done", message: `Nomad 安装完成: ${version}`, progress: 100 });
+        task.status = "done";
+        return { ok: true, message: `Nomad installed: ${version}`, taskId: task.id };
+    }
+    catch (e) {
+        return { ok: false, message: "Nomad installation failed", error: e.message };
+    }
+}
+// ── Configure & start Nomad ────────────────────────────────────────
+/** Fix ~/.jishushell dirs if they were accidentally created as root (e.g. from an old sudo install). */
+function fixNomadDirOwnership() {
+    try {
+        const { statSync } = require("fs");
+        const stat = statSync(NOMAD_CONFIG_DIR);
+        if (stat.uid === 0) {
+            // Directory is owned by root — try to repair with sudo -n (non-interactive)
+            const currentUser = process.env.USER || process.env.LOGNAME || "";
+            if (currentUser) {
+                try {
+                    execFileSync("sudo", ["-n", "chown", "-R", `${currentUser}:${currentUser}`, JISHUSHELL_HOME], { timeout: 10000, stdio: "pipe" });
+                }
+                catch { /* sudo not available or no NOPASSWD — ignore */ }
+            }
+        }
+    }
+    catch { /* stat failed — dir doesn't exist yet, no action needed */ }
+}
+function writeNomadConfig() {
+    fixNomadDirOwnership();
+    mkdirSync(NOMAD_CONFIG_DIR, { recursive: true, mode: 0o755 });
+    chmodSync(NOMAD_CONFIG_DIR, 0o755);
+    mkdirSync(NOMAD_DATA_DIR, { recursive: true, mode: 0o755 });
+    chmodSync(NOMAD_DATA_DIR, 0o755);
+    mkdirSync(NOMAD_ALLOC_DIR, { recursive: true, mode: 0o755 });
+    chmodSync(NOMAD_ALLOC_DIR, 0o755);
+    const config = `
+data_dir = "${NOMAD_DATA_DIR}"
+
+bind_addr = "127.0.0.1"
+
+leave_on_terminate = false
+
+advertise {
+  http = "127.0.0.1"
+  rpc  = "127.0.0.1"
+  serf = "127.0.0.1"
+}
+
+server {
+  enabled = true
+  bootstrap_expect = 1
+}
+
+client {
+  enabled = true
+  servers = ["127.0.0.1:4647"]
+  alloc_dir = "${NOMAD_ALLOC_DIR}"
+
+  drain_on_shutdown {
+    deadline           = "30s"
+    force              = true
+    ignore_system_jobs = true
+  }
+}
+
+plugin "docker" {
+  config {
+    disable_log_collection = true
+    volumes {
+      enabled = true
+    }
+  }
+}
+
+acl {
+  enabled = true
+}
+`;
+    writeFileSync(join(NOMAD_CONFIG_DIR, "nomad.hcl"), config);
+}
+export function loadNomadToken() {
+    if (process.env.NOMAD_TOKEN)
+        return;
+    const candidates = [
+        join(JISHUSHELL_HOME, "nomad.env"),
+        "/etc/jishushell/nomad.env",
+    ];
+    for (const envFile of candidates) {
+        if (!existsSync(envFile))
+            continue;
+        try {
+            const match = readFileSync(envFile, "utf-8").match(/^NOMAD_TOKEN=(.+)$/m);
+            if (match) {
+                process.env.NOMAD_TOKEN = match[1].trim();
+                return;
+            }
+        }
+        catch {
+            // no read permission, try next candidate
+        }
+    }
+    const legacy = getPanelConfig().nomad_token;
+    if (legacy)
+        process.env.NOMAD_TOKEN = legacy;
+}
+/** Verify the current NOMAD_TOKEN is accepted by the Nomad API. Returns false if it is missing or rejected (HTTP 403/401). */
+async function isNomadTokenValid() {
+    const token = process.env.NOMAD_TOKEN || getPanelConfig().nomad_token;
+    if (!token)
+        return false;
+    try {
+        const resp = await fetch("http://127.0.0.1:4646/v1/acl/token/self", {
+            headers: { "X-Nomad-Token": token },
+            signal: AbortSignal.timeout(5000),
+        });
+        return resp.status === 200;
+    }
+    catch {
+        return false;
+    }
+}
+function nomadApiHeaders(extra = {}) {
+    const token = process.env.NOMAD_TOKEN || getPanelConfig().nomad_token;
+    return token ? { "X-Nomad-Token": token, ...extra } : extra;
+}
+export async function ensureNomadMemoryOversubscriptionEnabled() {
+    try {
+        const resp = await fetch("http://127.0.0.1:4646/v1/operator/scheduler/configuration", {
+            headers: nomadApiHeaders(),
+            signal: AbortSignal.timeout(5000),
+        });
+        if (resp.status !== 200)
+            return;
+        const payload = await resp.json();
+        const scheduler = payload?.SchedulerConfig;
+        if (!scheduler || typeof scheduler !== "object")
+            return;
+        if (scheduler.MemoryOversubscriptionEnabled === true)
+            return;
+        const putResp = await fetch("http://127.0.0.1:4646/v1/operator/scheduler/configuration", {
+            method: "PUT",
+            headers: nomadApiHeaders({ "Content-Type": "application/json" }),
+            body: JSON.stringify({ ...scheduler, MemoryOversubscriptionEnabled: true }),
+            signal: AbortSignal.timeout(5000),
+        });
+        if (putResp.status === 200) {
+            console.log("[nomad] Enabled memory oversubscription so MemoryMaxMB becomes an actual task limit.");
+        }
+        else {
+            console.warn(`[nomad] Failed to enable memory oversubscription: HTTP ${putResp.status}`);
+        }
+    }
+    catch (e) {
+        console.warn("[nomad] Failed to enable memory oversubscription:", e.message);
+    }
+}
+/** Shared post-start sequence: load token, bootstrap ACL, enable oversubscription, enable node. */
+async function finalizeNomadStartup() {
+    loadNomadToken();
+    await bootstrapNomadACL();
+    await ensureNomadMemoryOversubscriptionEnabled();
+    enableNomadNodeEligibility();
+}
+async function bootstrapNomadACL() {
+    // If a token is already loaded, verify it's still valid before trusting it.
+    if (process.env.NOMAD_TOKEN || getPanelConfig().nomad_token) {
+        if (await isNomadTokenValid())
+            return;
+        console.log("[nomad] Stored ACL token is invalid — re-bootstrapping...");
+        delete process.env.NOMAD_TOKEN;
+    }
+    const nomadPath = existsSync(NOMAD_BIN) ? NOMAD_BIN : "nomad";
+    const doBootstrap = async () => {
+        try {
+            const raw = execFileSync(nomadPath, ["acl", "bootstrap", "-json"], {
+                timeout: 10000,
+                encoding: "utf-8",
+                env: { ...process.env, NOMAD_ADDR: "http://127.0.0.1:4646" },
+            });
+            return JSON.parse(raw).SecretID ?? null;
+        }
+        catch (e) {
+            // Return the raw stderr/stdout so caller can inspect it
+            throw e;
+        }
+    };
+    const saveToken = (token) => {
+        const envFile = join(JISHUSHELL_HOME, "nomad.env");
+        const envContent = `NOMAD_TOKEN=${token}\n`;
+        writeFileSync(envFile, envContent, { mode: 0o600 });
+        try {
+            execFileSync("sudo", ["-n", "mkdir", "-p", "/etc/jishushell"], { timeout: 5000, stdio: "pipe" });
+            writeFileSync("/tmp/.nomad-env-tmp", envContent, { mode: 0o600 });
+            execFileSync("sudo", ["-n", "cp", "/tmp/.nomad-env-tmp", "/etc/jishushell/nomad.env"], { timeout: 5000, stdio: "pipe" });
+            execFileSync("sudo", ["-n", "chmod", "600", "/etc/jishushell/nomad.env"], { timeout: 5000, stdio: "pipe" });
+            try {
+                unlinkSync("/tmp/.nomad-env-tmp");
+            }
+            catch { }
+        }
+        catch (copyErr) {
+            console.warn("[nomad] Could not sync token to /etc/jishushell/nomad.env:", copyErr.message);
+        }
+        process.env.NOMAD_TOKEN = token;
+        console.log("[nomad] ACL token saved to", envFile);
+    };
+    try {
+        const token = await doBootstrap();
+        if (token)
+            saveToken(token);
+        return;
+    }
+    catch (e) {
+        const msg = (e.stderr || e.stdout || e.message || "").toString();
+        // "ACL bootstrap already done" — extract reset index and perform a reset
+        const resetMatch = msg.match(/reset index[:\s]+(\d+)/i);
+        if (!resetMatch) {
+            if (!msg.includes("bootstrap"))
+                console.warn("[nomad] ACL bootstrap warning:", msg);
+            return;
+        }
+        const resetIndex = resetMatch[1];
+        console.log(`[nomad] Bootstrap already done (reset index: ${resetIndex}). Performing ACL bootstrap reset...`);
+        // Write the reset trigger file (Nomad reads this on startup to allow re-bootstrap)
+        const resetFile = join(NOMAD_DATA_DIR, "server", "acl-bootstrap-reset");
+        try {
+            writeFileSync(resetFile, resetIndex, { encoding: "utf-8" });
+        }
+        catch (writeErr) {
+            console.warn("[nomad] Could not write acl-bootstrap-reset file:", writeErr.message);
+            return;
+        }
+        // Restart Nomad so it picks up the reset file
+        try {
+            execFileSync("sudo", ["-n", "systemctl", "restart", "nomad"], { timeout: 15000, stdio: "pipe" });
+        }
+        catch {
+            // No passwordless sudo — try pkill/re-spawn path (best effort)
+            try {
+                execFileSync("pkill", ["-TERM", "-f", "nomad agent"], { stdio: "pipe" });
+            }
+            catch { }
+        }
+        // Wait for Nomad to come back
+        for (let i = 0; i < 20; i++) {
+            await new Promise(r => setTimeout(r, 1000));
+            if (isPortListening(4646))
+                break;
+        }
+        // Bootstrap again — reset file is consumed by Nomad on first start after restart
+        try {
+            const token = await doBootstrap();
+            if (token)
+                saveToken(token);
+        }
+        catch (e2) {
+            console.warn("[nomad] ACL bootstrap after reset failed:", (e2.stderr || e2.message || "").toString().split("\n")[0]);
+        }
+    }
+}
+function enableNomadNodeEligibility() {
+    const nomadPath = existsSync(NOMAD_BIN) ? NOMAD_BIN : "nomad";
+    try {
+        const raw = execSync(`${nomadPath} node status -self -json`, {
+            timeout: 5000,
+            encoding: "utf-8",
+            env: { ...process.env, NOMAD_ADDR: "http://127.0.0.1:4646" },
+        });
+        const nodeId = JSON.parse(raw).ID;
+        if (!nodeId)
+            return;
+        execSync(`${nomadPath} node eligibility -enable ${nodeId}`, {
+            timeout: 5000,
+            env: { ...process.env, NOMAD_ADDR: "http://127.0.0.1:4646" },
+        });
+    }
+    catch {
+    }
+}
+export async function startNomad() {
+    try {
+        writeNomadConfig();
+        if (isPortListening(4646)) {
+            await finalizeNomadStartup();
+            return { ok: true, message: "Nomad already running" };
+        }
+        // If systemd manages nomad, delegate to systemctl to avoid spawning a competing process
+        const isSystemdManaged = (() => {
+            try {
+                const result = execFileSync("systemctl", ["is-enabled", "nomad"], { stdio: "pipe", timeout: 3000 });
+                return result.toString().trim() === "enabled";
+            }
+            catch {
+                return false;
+            }
+        })();
+        if (isSystemdManaged) {
+            try {
+                execFileSync("sudo", ["-n", "systemctl", "start", "nomad"], { stdio: "pipe", timeout: 10000 });
+            }
+            catch {
+                // sudo -n failed (no passwordless sudo); service may start on its own
+            }
+            for (let i = 0; i < 15; i++) {
+                await new Promise(r => setTimeout(r, 1000));
+                if (isPortListening(4646)) {
+                    await finalizeNomadStartup();
+                    return { ok: true, message: "Nomad started via systemd" };
+                }
+            }
+            return { ok: false, message: "Nomad start timed out", error: "Port 4646 not listening after 15s" };
+        }
+        if (process.platform === "darwin") {
+            const launchdPlist = join(process.env.HOME || dirname(JISHUSHELL_HOME), "Library/LaunchAgents/com.jishushell.nomad.plist");
+            if (existsSync(launchdPlist)) {
+                for (let i = 0; i < 30; i++) {
+                    await new Promise(r => setTimeout(r, 1000));
+                    if (isPortListening(4646)) {
+                        await finalizeNomadStartup();
+                        return { ok: true, message: "Nomad started" };
+                    }
+                }
+                return { ok: false, message: "Nomad start timed out", error: "Port 4646 not listening after 30s" };
+            }
+        }
+        const nomadPath = existsSync(NOMAD_BIN) ? NOMAD_BIN : "nomad";
+        try {
+            execFileSync(nomadPath, ["version"], { timeout: 5000, stdio: "pipe" });
+        }
+        catch {
+            return { ok: false, message: "Nomad not installed", error: "Install Nomad first" };
+        }
+        const configPath = join(NOMAD_CONFIG_DIR, "nomad.hcl");
+        const logPath = join(NOMAD_CONFIG_DIR, "nomad.log");
+        // Use spawn with detached to avoid execSync shell injection and ensure proper daemonization
+        try {
+            const { openSync, closeSync } = await import("fs");
+            const logFd = openSync(logPath, "a");
+            // Run as current (non-root) user — Nomad only binds to 127.0.0.1:4646/4647/4648
+            // (non-privileged ports) and all data dirs live under ~/.jishushell/, so sudo is not needed.
+            const cmd = nomadPath;
+            const args = ["agent", `-config=${configPath}`];
+            const child = nodeSpawn(cmd, args, {
+                detached: true,
+                stdio: ["ignore", logFd, logFd],
+            });
+            child.unref();
+            closeSync(logFd);
+        }
+        catch (e) {
+            return { ok: false, message: "Failed to start Nomad", error: `launch failed: ${e.message}. Check sudo/permissions.` };
+        }
+        for (let i = 0; i < 15; i++) {
+            await new Promise(r => setTimeout(r, 1000));
+            if (isPortListening(4646)) {
+                await finalizeNomadStartup();
+                return { ok: true, message: "Nomad started" };
+            }
+        }
+        return { ok: false, message: "Nomad start timed out", error: "Port 4646 not listening after 15s" };
+    }
+    catch (e) {
+        return { ok: false, message: "Failed to start Nomad", error: e.message };
+    }
+}
+export async function stopNomad() {
+    try {
+        if (!isPortListening(4646))
+            return { ok: true, message: "Nomad not running" };
+        // SIGTERM: graceful shutdown — Nomad flushes state, drains allocs (force=true in HCL)
+        // Nomad runs as the current user; no sudo needed to send SIGTERM
+        try {
+            execSync("pkill -TERM -f 'nomad agent'", { timeout: 5000 });
+        }
+        catch { }
+        // Wait up to 35s for process to exit (drain_on_shutdown deadline + grace)
+        for (let i = 0; i < 35; i++) {
+            await new Promise(r => setTimeout(r, 1000));
+            if (!isPortListening(4646))
+                return { ok: true, message: "Nomad stopped" };
+        }
+        return { ok: true, message: "Nomad stop requested" };
+    }
+    catch (e) {
+        return { ok: false, message: "Failed to stop Nomad", error: e.message };
+    }
+}
+// ── Install Nomad as systemd service ───────────────────────────────
+export function installNomadSystemd() {
+    try {
+        let nomadPath = NOMAD_BIN;
+        if (!existsSync(NOMAD_BIN)) {
+            try {
+                nomadPath = execFileSync("which", ["nomad"], { encoding: "utf-8", timeout: 5000 }).trim();
+            }
+            catch {
+                nomadPath = "nomad";
+            }
+        }
+        const configPath = join(NOMAD_CONFIG_DIR, "nomad.hcl");
+        writeNomadConfig();
+        if (process.platform === "darwin") {
+            const plistLabel = "com.jishushell.nomad";
+            const logPath = join(NOMAD_CONFIG_DIR, "nomad.log");
+            const primarySocket = join(homedir(), ".docker", "run", "docker.sock");
+            const dockerSock = existsSync(primarySocket) ? primarySocket : "/var/run/docker.sock";
+            const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${plistLabel}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${nomadPath}</string>
+    <string>agent</string>
+    <string>-config=${configPath}</string>
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>DOCKER_HOST</key><string>unix://${dockerSock}</string>
+    <key>PATH</key><string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+  </dict>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${logPath}</string>
+  <key>StandardErrorPath</key><string>${logPath}</string>
+</dict>
+</plist>`;
+            const plistPath = join(process.env.HOME || dirname(JISHUSHELL_HOME), `Library/LaunchAgents/${plistLabel}.plist`);
+            mkdirSync(dirname(plistPath), { recursive: true });
+            writeFileSync(plistPath, plistContent);
+            try {
+                execSync(`launchctl unload "${plistPath}" 2>/dev/null`);
+            }
+            catch { }
+            execSync(`launchctl load -w "${plistPath}"`, { timeout: 15000 });
+            return { ok: true, message: "Nomad launchd agent installed and started" };
+        }
+        // Nomad runs as the current (non-root) user so all ~/.jishushell/ files remain accessible.
+        // Group=docker gives the process access to /var/run/docker.sock for the Docker driver.
+        const currentUser = process.env.USER || process.env.LOGNAME || process.env.SUDO_USER || "jishu";
+        const serviceContent = `[Unit]
+Description=Nomad Agent
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+User=${currentUser}
+SupplementaryGroups=docker
+Type=simple
+EnvironmentFile=-/etc/jishushell/nomad.env
+ExecStart=${nomadPath} agent -config=${configPath}
+Restart=on-failure
+RestartSec=3
+
+[Install]
+WantedBy=multi-user.target
+`;
+        const servicePath = "/etc/systemd/system/nomad.service";
+        execFileSync("sudo", ["mkdir", "-p", "/etc/jishushell"], { timeout: 5000 });
+        writeFileSync("/tmp/nomad.service", serviceContent);
+        execFileSync("sudo", ["cp", "/tmp/nomad.service", servicePath], { timeout: 5000 });
+        execFileSync("sudo", ["systemctl", "daemon-reload"], { timeout: 5000 });
+        execFileSync("sudo", ["systemctl", "enable", "--now", "nomad"], { timeout: 15000 });
+        // Also restart if already running so it picks up the new User= directive
+        try {
+            execFileSync("sudo", ["systemctl", "restart", "nomad"], { timeout: 15000 });
+        }
+        catch { }
+        return { ok: true, message: "Nomad systemd service installed and started" };
+    }
+    catch (e) {
+        return { ok: false, message: "Failed to install Nomad systemd service", error: e.message };
+    }
+}
+// ── Install JishuShell as systemd service ─────────────────────────
+export function installJishushellSystemd(port) {
+    try {
+        const resolvedPort = port || _serverPort;
+        // Use the node binary that is currently running this process — avoids
+        // "which node" failing when PATH doesn't include nvm's bin dir.
+        const nodeBin = process.execPath;
+        // dist/cli.js lives next to this file (dist/services/setup-manager.js → dist/cli.js)
+        const cliBin = join(__dirname, "..", "cli.js");
+        // The real owner home: prefer JISHUSHELL_HOME's parent so we don't rely on $HOME.
+        const realHome = dirname(JISHUSHELL_HOME);
+        if (process.platform === "darwin") {
+            const plistLabel = "com.jishushell.panel";
+            const logPath = join(JISHUSHELL_HOME, "panel.log");
+            const wrapperPath = join(JISHUSHELL_HOME, "bin", "jishushell-panel-start");
+            const nomadEnvPath = join(JISHUSHELL_HOME, "nomad.env");
+            const wrapperContent = `#!/bin/sh
+[ -f "${nomadEnvPath}" ] && . "${nomadEnvPath}"
+export JISHUSHELL_HOME="${JISHUSHELL_HOME}"
+export HOME="${realHome}"
+export NODE_ENV=production
+export PATH="/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin:/Applications/Docker.app/Contents/Resources/bin:${dirname(nodeBin)}:\${PATH}"
+exec "${nodeBin}" "${cliBin}" serve --port ${resolvedPort}
+`;
+            mkdirSync(dirname(wrapperPath), { recursive: true });
+            writeFileSync(wrapperPath, wrapperContent, { mode: 0o755 });
+            const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${plistLabel}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/sh</string>
+    <string>${wrapperPath}</string>
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${logPath}</string>
+  <key>StandardErrorPath</key><string>${logPath}</string>
+</dict>
+</plist>`;
+            const plistPath = join(process.env.HOME || realHome, `Library/LaunchAgents/${plistLabel}.plist`);
+            mkdirSync(dirname(plistPath), { recursive: true });
+            writeFileSync(plistPath, plistContent);
+            const panelAlreadyRunning = isPortListening(resolvedPort);
+            if (!panelAlreadyRunning) {
+                try {
+                    execSync(`launchctl unload "${plistPath}" 2>/dev/null`);
+                }
+                catch { }
+                execSync(`launchctl load -w "${plistPath}"`, { timeout: 15000 });
+            }
+            return { ok: true, message: "JishuShell launchd agent installed and enabled (port " + resolvedPort + ")" };
+        }
+        const currentUser = resolveServiceUser();
+        const serviceContent = `[Unit]
+Description=JishuShell Panel
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=${currentUser}
+SupplementaryGroups=docker
+Environment=HOME=${realHome}
+Environment=JISHUSHELL_HOME=${JISHUSHELL_HOME}
+EnvironmentFile=-/etc/jishushell/jishushell.env
+EnvironmentFile=-/etc/jishushell/nomad.env
+ExecStart=${nodeBin} ${cliBin} serve --port ${resolvedPort}
+Restart=on-failure
+RestartSec=5
+Environment=NODE_ENV=production
+
+[Install]
+WantedBy=multi-user.target
+`;
+        execFileSync("sudo", ["mkdir", "-p", "/etc/jishushell"], { timeout: 5000 });
+        writeFileSync("/tmp/jishushell.service", serviceContent);
+        execFileSync("sudo", ["cp", "/tmp/jishushell.service", "/etc/systemd/system/jishushell.service"], { timeout: 5000 });
+        execFileSync("sudo", ["systemctl", "daemon-reload"], { timeout: 5000 });
+        execFileSync("sudo", ["systemctl", "enable", "jishushell"], { timeout: 15000 });
+        // Don't start now — the current process is already running on this port.
+        // The service will auto-start on next reboot.
+        return { ok: true, message: "JishuShell systemd service installed and enabled (port " + resolvedPort + ")" };
+    }
+    catch (e) {
+        return { ok: false, message: "Failed to install JishuShell systemd service", error: e.message };
+    }
+}
+// ── Install OpenClaw (async with progress) ─────────────────────────
+const OPENCLAW_EXPECTED_SIZE_MB = 700;
+export async function installOpenclaw(version = "latest") {
+    try {
+        const openclawPkgDir = join(OPENCLAW_MODULES, "openclaw");
+        if (existsSync(openclawPkgDir)) {
+            const ver = getLocalOpenclawVersion() || "unknown";
+            return { ok: true, message: `OpenClaw already installed: ${ver}` };
+        }
+        const task = createTask("openclaw");
+        mkdirSync(OPENCLAW_PKG_DIR, { recursive: true });
+        emitTask(task, { type: "progress", message: "开始安装 OpenClaw...", progress: 0 });
+        // Monitor directory size for progress estimation
+        const sizeTracker = setInterval(() => {
+            const sizeMB = getDirSizeMB(OPENCLAW_PKG_DIR);
+            const pct = Math.min(95, Math.round((sizeMB / OPENCLAW_EXPECTED_SIZE_MB) * 95));
+            if (pct > 0) {
+                emitTask(task, { type: "progress", message: `下载安装中... ${sizeMB}MB / ~${OPENCLAW_EXPECTED_SIZE_MB}MB`, progress: pct });
+            }
+        }, 3000);
+        // Use npm install -g with --prefix so npm uses global-install semantics:
+        // packages go to <prefix>/lib/node_modules/, bins to <prefix>/bin/
+        // This makes postinstall scripts run naturally (no manual workarounds needed).
+        const result = await spawnWithTask(task, "npm", ["install", "-g", "--prefix", OPENCLAW_PKG_DIR, `openclaw@${version}`], { timeout: 600000, progressParser: npmProgressParser });
+        clearInterval(sizeTracker);
+        if (!result.ok) {
+            emitTask(task, { type: "error", message: "OpenClaw 安装失败" });
+            task.status = "error";
+            return { ok: false, message: "OpenClaw installation failed", error: result.output, taskId: task.id };
+        }
+        // Read version from package.json since openclaw --version needs Node 22+
+        let ver = "installed";
+        try {
+            const pkg = join(OPENCLAW_MODULES, "openclaw", "package.json");
+            if (existsSync(pkg)) {
+                const pkgJson = JSON.parse(readFileSync(pkg, "utf-8"));
+                ver = pkgJson.version || "installed";
+            }
+        }
+        catch { }
+        emitTask(task, { type: "done", message: `OpenClaw 安装完成: ${ver}`, progress: 100 });
+        task.status = "done";
+        return { ok: true, message: `OpenClaw installed: ${ver}`, taskId: task.id };
+    }
+    catch (e) {
+        return { ok: false, message: "OpenClaw installation failed", error: e.message };
+    }
+}
+// ── Helpers ──────────────────────────────────────────────────────
+function getLocalOpenclawVersion() {
+    try {
+        const pkg = join(OPENCLAW_MODULES, "openclaw", "package.json");
+        if (existsSync(pkg))
+            return JSON.parse(readFileSync(pkg, "utf-8")).version || "";
+    }
+    catch { }
+    return "";
+}
+function resolveDockerInvocation() {
+    try {
+        execFileSync("docker", ["info"], { timeout: 5000, stdio: "ignore" });
+        return { cmd: "docker", argsPrefix: [] };
+    }
+    catch { }
+    try {
+        execFileSync("sudo", ["-n", "docker", "info"], { timeout: 5000, stdio: "ignore" });
+        return { cmd: "sudo", argsPrefix: ["-n", "docker"] };
+    }
+    catch { }
+    return { cmd: "docker", argsPrefix: [] };
+}
+function checkDockerImageExists() {
+    const tag = resolveDockerImageTag();
+    try {
+        const invocation = resolveDockerInvocation();
+        execFileSync(invocation.cmd, [...invocation.argsPrefix, "image", "inspect", tag], { timeout: 5000, stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// The stable tag for the JishuShell base image (slim — no OpenClaw binary baked in).
+// This tag does NOT change when OpenClaw is upgraded; the binary is bind-mounted from
+// the host at runtime. Rebuild this image only when system packages (Node.js, python3…)
+// need to change.
+export const BASE_IMAGE_TAG = "jishushell-base:v1";
+function resolveDockerImageTag() {
+    // 1. Environment variable takes precedence (same as runtime getOpenclawDockerImage)
+    if (process.env.OPENCLAW_DOCKER_IMAGE)
+        return process.env.OPENCLAW_DOCKER_IMAGE;
+    // 2. Stored in panel.json — honours custom images and pre-existing openclaw:*
+    //    images that haven't been migrated yet (backward compatibility).
+    const stored = getPanelConfig().openclaw_image;
+    if (typeof stored === "string" && stored.trim())
+        return stored;
+    // 3. Scan local daemon — prefer official ghcr.io image, fall back to legacy jishushell-base.
+    try {
+        const invocation = resolveDockerInvocation();
+        const output = execFileSync(invocation.cmd, [...invocation.argsPrefix, "images", "--format", "{{.Repository}}:{{.Tag}}"], { encoding: "utf-8", timeout: 5000 });
+        const lines = output.split("\n").map(l => l.trim());
+        // Prefer custom image (built with Python), then official, then legacy
+        const custom = lines.find(l => l.startsWith(CUSTOM_IMAGE_PREFIX + ":"));
+        if (custom)
+            return custom;
+        const official = lines.find(l => l.startsWith("ghcr.io/openclaw/openclaw:"));
+        if (official)
+            return official;
+        const legacy = lines.find(l => /^jishushell-base:/i.test(l));
+        if (legacy)
+            return legacy;
+    }
+    catch { }
+    return getOpenclawDockerImage();
+}
+// Base image and mirror list for the OpenClaw Docker build.
+// Mirrors are tried in order when docker.io is unreachable (e.g. behind GFW or rate-limited).
+const DOCKER_BASE_IMAGE = "node:22-slim";
+const DOCKER_BASE_MIRRORS = [
+    "node:22-slim",
+    "hub-mirror.c.163.com/library/node:22-slim",
+    "mirrors.tencent.com/library/node:22-slim",
+    "registry.cn-hangzhou.aliyuncs.com/library/node:22-slim",
+];
+// Pull DOCKER_BASE_IMAGE from mirrors if not already cached locally.
+// Returns the image content digest (sha256:…) so that the subsequent
+// docker build can use `FROM <digest>`, which BuildKit resolves from
+// the local daemon without any outbound registry metadata request.
+async function ensureDockerBaseImage(invocation, task) {
+    // Fast path: already in local daemon cache — return image name (not digest) for Dockerfile FROM
+    try {
+        execFileSync(invocation.cmd, [...invocation.argsPrefix, "image", "inspect", DOCKER_BASE_IMAGE], {
+            timeout: 5000,
+            stdio: "ignore",
+        });
+        emitTask(task, { type: "log", message: `基础镜像已缓存: ${DOCKER_BASE_IMAGE}` });
+        return DOCKER_BASE_IMAGE;
+    }
+    catch { /* not cached, fall through */ }
+    for (const mirror of DOCKER_BASE_MIRRORS) {
+        emitTask(task, { type: "log", message: `拉取基础镜像: ${mirror} ...` });
+        const result = await spawnWithTask(task, invocation.cmd, [...invocation.argsPrefix, "pull", mirror], { timeout: 300000 });
+        if (result.ok) {
+            if (mirror !== DOCKER_BASE_IMAGE) {
+                try {
+                    execFileSync(invocation.cmd, [...invocation.argsPrefix, "tag", mirror, DOCKER_BASE_IMAGE], { timeout: 10000 });
+                }
+                catch { /* tag failure is non-fatal */ }
+            }
+            emitTask(task, { type: "log", message: `基础镜像就绪: ${DOCKER_BASE_IMAGE}` });
+            return DOCKER_BASE_IMAGE;
+        }
+        emitTask(task, { type: "log", message: `  → ${mirror} 不可达，尝试下一个镜像源...` });
+    }
+    throw new Error(`无法获取基础镜像 ${DOCKER_BASE_IMAGE}。请检查网络或手动执行: docker pull ${DOCKER_BASE_MIRRORS[1]}`);
+}
+function resolveVersionedBuildTag() {
+    try {
+        const pkg = join(OPENCLAW_MODULES, "openclaw", "package.json");
+        if (existsSync(pkg)) {
+            const ver = JSON.parse(readFileSync(pkg, "utf-8")).version;
+            if (ver)
+                return `${CUSTOM_IMAGE_PREFIX}:${ver}`;
+        }
+    }
+    catch { }
+    return resolveDockerImageTag();
+}
+async function buildOpenclawDockerImageWithTask(task, tag) {
+    const targetTag = tag || resolveVersionedBuildTag();
+    try {
+        const invocation = resolveDockerInvocation();
+        // Fast check: if image with this exact tag exists, skip build (tag encodes version)
+        try {
+            execFileSync(invocation.cmd, [...invocation.argsPrefix, "image", "inspect", targetTag], {
+                timeout: 10000,
+                stdio: "ignore",
+            });
+            setOpenclawDockerImage(targetTag);
+            emitTask(task, { type: "done", message: `Docker 镜像已存在: ${targetTag}`, progress: 100 });
+            task.status = "done";
+            return { ok: true, message: `Docker image ${targetTag} already exists`, taskId: task.id };
+        }
+        catch { /* image not found, proceed to build */ }
+        // Clean up old openclaw:* images that predate the new slim-base architecture.
+        // Skip if the stored tag matches targetTag or is a remote registry image.
+        const oldTag = getPanelConfig().openclaw_image;
+        if (oldTag && oldTag !== targetTag && !oldTag.includes("/") && /^openclaw:/i.test(oldTag)) {
+            try {
+                execFileSync(invocation.cmd, [...invocation.argsPrefix, "rmi", oldTag], { timeout: 15000, stdio: "ignore" });
+            }
+            catch { }
+        }
+        // Ensure node:22-slim base image is in the local daemon cache before building.
+        emitTask(task, { type: "progress", message: "准备基础镜像...", progress: 5 });
+        const baseImageId = await ensureDockerBaseImage(invocation, task);
+        // Slim Dockerfile: no COPY of openclaw node_modules — the binary is bind-mounted
+        // from the host at runtime, so this image needs no OpenClaw-specific layers.
+        // Build context is an empty temp directory (no files to COPY).
+        const dockerfile = `FROM ${baseImageId}
+RUN apt-get update && apt-get install -y --no-install-recommends \\
+    ca-certificates curl \\
+    python3 python3-pip python3-venv python3-dev && \\
+    ln -sf /usr/bin/python3 /usr/local/bin/python && \\
+    rm -rf /var/lib/apt/lists/*
+WORKDIR /data
+USER node
+ENTRYPOINT ["node", "/usr/lib/node_modules/openclaw/openclaw.mjs"]
+CMD ["gateway", "run", "--port", "18789", "--allow-unconfigured"]
+`;
+        // Use a temp dir as build context — no files to COPY means no large transfer.
+        const buildDir = join(tmpdir(), `jishushell-base-build-${Date.now()}`);
+        mkdirSync(buildDir, { recursive: true });
+        const dockerfilePath = join(buildDir, "Dockerfile");
+        writeFileSync(dockerfilePath, dockerfile);
+        emitTask(task, { type: "progress", message: `构建基础镜像 ${targetTag}（无需拷贝二进制，速度极快）...`, progress: 10 });
+        let result;
+        try {
+            result = await spawnWithTask(task, invocation.cmd, [...invocation.argsPrefix, "build", "--network=host", "-t", targetTag, buildDir], {
+                timeout: 1800000,
+                progressParser: dockerBuildProgressParser,
+                env: {},
+            });
+        }
+        finally {
+            // Always clean up temp build dir
+            try {
+                execSync(`rm -rf "${buildDir}"`, { timeout: 5000 });
+            }
+            catch { }
+        }
+        if (!result.ok) {
+            // Clean up dangling images from failed build
+            try {
+                execFileSync(invocation.cmd, [...invocation.argsPrefix, "image", "prune", "-f"], { timeout: 15000, stdio: "ignore" });
+            }
+            catch { }
+            emitTask(task, { type: "error", message: "Docker 镜像构建失败" });
+            task.status = "error";
+            return { ok: false, message: "Docker image build failed", error: result.output, taskId: task.id };
+        }
+        const localTag = `${CUSTOM_IMAGE_PREFIX}:local`;
+        if (targetTag !== localTag) {
+            try {
+                execFileSync(invocation.cmd, [...invocation.argsPrefix, "tag", targetTag, localTag], { timeout: 10000, stdio: "ignore" });
+            }
+            catch { }
+        }
+        setOpenclawDockerImage(localTag);
+        emitTask(task, { type: "done", message: `Docker 镜像构建完成: ${targetTag}`, progress: 100 });
+        task.status = "done";
+        return { ok: true, message: `Docker image ${targetTag} built`, taskId: task.id };
+    }
+    catch (e) {
+        // Clean up build artifacts on unexpected errors
+        try {
+            execSync("docker image prune -f", { timeout: 15000, stdio: "ignore" });
+        }
+        catch { }
+        emitTask(task, { type: "error", message: `Docker 镜像构建失败: ${e.message}` });
+        task.status = "error";
+        return { ok: false, message: "Docker image build failed", error: e.message, taskId: task.id };
+    }
+}
+export async function buildOpenclawDockerImage(tag) {
+    const task = createTask("openclaw-docker");
+    return buildOpenclawDockerImageWithTask(task, tag);
+}
+export function startBuildOpenclawDockerImage(tag) {
+    const task = createTask("openclaw-docker");
+    void buildOpenclawDockerImageWithTask(task, tag).catch((err) => {
+        emitTask(task, { type: "error", message: `Docker 镜像构建失败: ${err?.message || err}` });
+        task.status = "error";
+    });
+    return { ok: true, message: "Docker image build started", taskId: task.id };
+}
+// ── Build OpenClaw Docker image from npm package + Python ─────────
+async function buildCustomOpenclawImageWithTask(task, tag) {
+    const targetTag = tag || DEFAULT_OPENCLAW_DOCKER_IMAGE;
+    try {
+        const invocation = resolveDockerInvocation();
+        // Fast check: if image already exists locally, skip
+        try {
+            execFileSync(invocation.cmd, [...invocation.argsPrefix, "image", "inspect", targetTag], {
+                timeout: 10000,
+                stdio: "ignore",
+            });
+            setOpenclawDockerImage(targetTag);
+            emitTask(task, { type: "done", message: `Docker 镜像已存在: ${targetTag}`, progress: 100 });
+            task.status = "done";
+            return { ok: true, message: `Docker image ${targetTag} already exists`, taskId: task.id };
+        }
+        catch { /* image not found, proceed */ }
+        // Clean up old legacy images
+        const oldTag = getPanelConfig().openclaw_image;
+        if (oldTag && oldTag !== targetTag && /^jishushell-base:/i.test(oldTag)) {
+            try {
+                execFileSync(invocation.cmd, [...invocation.argsPrefix, "rmi", oldTag], { timeout: 15000, stdio: "ignore" });
+            }
+            catch { }
+        }
+        // Step 1: Ensure OpenClaw npm package is installed (used as build context)
+        const openclawPkgDir = join(OPENCLAW_MODULES, "openclaw");
+        if (!existsSync(openclawPkgDir)) {
+            emitTask(task, { type: "progress", message: "安装 OpenClaw npm 包...", progress: 5 });
+            const installResult = await installOpenclaw();
+            if (!installResult.ok) {
+                emitTask(task, { type: "error", message: "OpenClaw 安装失败" });
+                task.status = "error";
+                return { ok: false, message: "OpenClaw npm install failed", error: installResult.error, taskId: task.id };
+            }
+        }
+        // Step 2: Ensure base image is available
+        emitTask(task, { type: "progress", message: "准备基础镜像...", progress: 10 });
+        const baseImageId = await ensureDockerBaseImage(invocation, task);
+        // Step 3: Build image — COPY node_modules + Python
+        emitTask(task, { type: "progress", message: `构建 OpenClaw 镜像（含 Python）: ${targetTag} ...`, progress: 30 });
+        const dockerfile = `FROM ${baseImageId}
+USER root
+RUN apt-get update && apt-get install -y --no-install-recommends \\
+    procps hostname curl git lsof openssl \\
+    python3 python3-pip python3-venv python3-dev && \\
+    ln -sf /usr/bin/python3 /usr/local/bin/python && \\
+    rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY --chown=node:node lib/node_modules/ ./node_modules/
+RUN ln -sf /app/node_modules/openclaw/openclaw.mjs /app/openclaw.mjs && \\
+    ln -sf /app/node_modules/openclaw/openclaw.mjs /usr/local/bin/openclaw && \\
+    cp /app/node_modules/openclaw/package.json /app/package.json 2>/dev/null || true
+USER node
+CMD ["node", "openclaw.mjs", "gateway", "--allow-unconfigured"]
+`;
+        // Write Dockerfile into the npm package directory (build context)
+        const dockerfilePath = join(OPENCLAW_PKG_DIR, "Dockerfile");
+        writeFileSync(dockerfilePath, dockerfile);
+        let buildResult;
+        try {
+            buildResult = await spawnWithTask(task, invocation.cmd, [...invocation.argsPrefix, "build", "--network=host", "-t", targetTag, OPENCLAW_PKG_DIR], { timeout: 1800000, progressParser: dockerBuildProgressParser });
+        }
+        finally {
+            try {
+                unlinkSync(dockerfilePath);
+            }
+            catch { }
+        }
+        if (!buildResult.ok) {
+            try {
+                execFileSync(invocation.cmd, [...invocation.argsPrefix, "image", "prune", "-f"], { timeout: 15000, stdio: "ignore" });
+            }
+            catch { }
+            emitTask(task, { type: "error", message: "Docker 镜像构建失败" });
+            task.status = "error";
+            return { ok: false, message: "Docker image build failed", error: buildResult.output, taskId: task.id };
+        }
+        setOpenclawDockerImage(targetTag);
+        emitTask(task, { type: "done", message: `OpenClaw 镜像就绪: ${targetTag}（含 Python）`, progress: 100 });
+        task.status = "done";
+        return { ok: true, message: `Docker image ${targetTag} built`, taskId: task.id };
+    }
+    catch (e) {
+        emitTask(task, { type: "error", message: `镜像构建失败: ${e.message}` });
+        task.status = "error";
+        return { ok: false, message: "Docker image build failed", error: e.message, taskId: task.id };
+    }
+}
+export async function buildCustomOpenclawImage(tag) {
+    const task = createTask("openclaw-docker-build");
+    return buildCustomOpenclawImageWithTask(task, tag);
+}
+export function startBuildCustomOpenclawImage(tag) {
+    const task = createTask("openclaw-docker-build");
+    void buildCustomOpenclawImageWithTask(task, tag).catch((err) => {
+        emitTask(task, { type: "error", message: `镜像构建失败: ${err?.message || err}` });
+        task.status = "error";
+    });
+    return { ok: true, message: "Docker image build started", taskId: task.id };
+}
+export async function runFullSetup(options = {}) {
+    const steps = [];
+    let allOk = true;
+    const defaults = {
+        installNomad: true,
+        installOpenclaw: true,
+        buildDockerImage: true,
+        ...options,
+    };
+    // Check Docker by daemon accessibility (docker info), not just binary existence
+    const dockerReady = canAccessDockerDaemon(10000);
+    if (!dockerReady) {
+        steps.push({ step: "docker", status: "running", message: "Installing Docker..." });
+        const result = await installDocker();
+        steps[steps.length - 1].status = result.ok ? "done" : "error";
+        steps[steps.length - 1].message = result.message;
+        if (!result.ok)
+            allOk = false;
+    }
+    if (defaults.installNomad) {
+        steps.push({ step: "nomad", status: "running", message: "Installing Nomad..." });
+        const result = await installNomad();
+        steps[steps.length - 1].status = result.ok ? "done" : "error";
+        steps[steps.length - 1].message = result.message;
+        if (!result.ok)
+            allOk = false;
+        if (result.ok) {
+            steps.push({ step: "nomad-systemd", status: "running", message: "Configuring Nomad auto-start..." });
+            const sysResult = installNomadSystemd();
+            steps[steps.length - 1].status = sysResult.ok ? "done" : "error";
+            steps[steps.length - 1].message = sysResult.message;
+            if (!sysResult.ok) {
+                // Fallback to manual start if systemd fails
+                steps.push({ step: "nomad-start", status: "running", message: "Starting Nomad..." });
+                const startResult = await startNomad();
+                steps[steps.length - 1].status = startResult.ok ? "done" : "error";
+                steps[steps.length - 1].message = startResult.message;
+                if (!startResult.ok)
+                    allOk = false;
+            }
+        }
+    }
+    if (defaults.installOpenclaw) {
+        steps.push({ step: "openclaw", status: "running", message: "Installing OpenClaw..." });
+        const result = await installOpenclaw();
+        steps[steps.length - 1].status = result.ok ? "done" : "error";
+        steps[steps.length - 1].message = result.message;
+        if (!result.ok)
+            allOk = false;
+    }
+    // Prepare Docker image: pull official image or build slim base (legacy).
+    if (defaults.buildDockerImage) {
+        // Restart Nomad so it re-detects Docker driver after Docker was installed
+        try {
+            execSync("sudo systemctl restart nomad 2>/dev/null || true", { timeout: 15000 });
+            for (let i = 0; i < 10; i++) {
+                await new Promise(r => setTimeout(r, 2000));
+                if (isPortListening(4646))
+                    break;
+            }
+        }
+        catch { }
+        steps.push({ step: "docker-image", status: "running", message: "Building OpenClaw Docker image..." });
+        const imgResult = isOfficialImage()
+            ? await buildCustomOpenclawImage()
+            : await buildOpenclawDockerImage();
+        steps[steps.length - 1].status = imgResult.ok ? "done" : "error";
+        steps[steps.length - 1].message = imgResult.message;
+        if (!imgResult.ok)
+            allOk = false;
+    }
+    if (isPortListening(4646)) {
+        await finalizeNomadStartup();
+    }
+    // Only mark setup as complete if all critical steps succeeded
+    if (!allOk) {
+        return { ok: false, steps };
+    }
+    const config = getPanelConfig();
+    config.service_manager = "nomad";
+    config.nomad_driver = "docker";
+    savePanelConfig(config);
+    // Install jishushell systemd service (best-effort — does not block setup completion)
+    steps.push({ step: "jishushell-systemd", status: "running", message: "Configuring JishuShell auto-start..." });
+    const jsResult = installJishushellSystemd();
+    steps[steps.length - 1].status = jsResult.ok ? "done" : "error";
+    steps[steps.length - 1].message = jsResult.message;
+    return { ok: allOk, steps };
+}
+//# sourceMappingURL=setup-manager.js.map