jishushell 0.4.10 → 0.4.24

package/Dockerfile.hermes-slim

@@ -0,0 +1,193 @@
+# syntax=docker/dockerfile:1.7
+
+ARG BASE_IMAGE=node:22-bookworm-slim
+
+FROM ${BASE_IMAGE} AS builder
+
+ARG HERMES_REPO=https://github.com/NousResearch/hermes-agent.git
+ARG HERMES_REF=main
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    UV_LINK_MODE=copy
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    bash \
+    build-essential \
+    ca-certificates \
+    curl \
+    ffmpeg \
+    git \
+    pkg-config \
+    python3 \
+    python3-dev \
+    python3-venv \
+    ripgrep && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh
+
+ENV PATH=/root/.local/bin:${PATH}
+
+WORKDIR /opt
+RUN git clone --recurse-submodules "${HERMES_REPO}" hermes && \
+    cd /opt/hermes && \
+    git checkout "${HERMES_REF}" && \
+    git submodule update --init --recursive
+
+#
+# Skip the `tinker-atropos` submodule install. It brings in the RL
+# training stack (transformers, datasets, wandb, gymnasium, polars,
+# pyarrow, safetensors, …) — ~300 MB of deps used only by
+# `tools/rl_training_tool.py` and `environments/*.py`, both of which
+# are lazy-imported and only exercised during model training runs.
+# JishuShell targets inference on edge devices (Pi / RK3588 / CIX), no
+# RL training happens here, so we match the upstream
+# `nousresearch/hermes-agent` image's choice to omit it.
+#
+WORKDIR /opt/hermes
+RUN uv venv .venv --python 3.11 && \
+    uv pip install --python .venv/bin/python -e ".[all]"
+
+#
+# Small extras the upstream image bundles but `[all]` doesn't pull.
+# Both are tiny (~0.3 MB each) so we match the upstream image rather
+# than leave users `pip install`-ing them by hand.
+#   - apscheduler: cron-style scheduler used by the agent's job tools
+#   - qrcode + pypng: QR image generation using pure-Python PNG
+#     backend (avoids dragging Pillow in)
+#
+RUN uv pip install --python .venv/bin/python apscheduler qrcode pypng
+
+#
+# Three things happen here:
+#
+#   1. `npm install --omit=dev` vendors agent-browser + its transitive
+#      deps (playwright-core, better-sqlite3, impit, zod, lodash, …)
+#      into /opt/hermes/node_modules (~171 MB). This is what
+#      `hermes's browser_tool.py` resolves when it runs `npx
+#      agent-browser` — without pre-installing we'd pay a ~15 s npm
+#      download on the first browser_navigate call of every fresh
+#      container.
+#
+#   2. `playwright install chromium --only-shell` drops the headless
+#      Chromium renderer (~330 MB) under $PLAYWRIGHT_BROWSERS_PATH.
+#      agent-browser auto-discovers it via that env var, so we don't
+#      need an apt `chromium` in the final image — just the shared
+#      libs headless_shell links against (installed in the final
+#      stage).  `--package=playwright` borrows the Playwright CLI
+#      without persisting its own node_modules.
+#
+#   3. The native web UI (`hermes web`, served on port 9119) is built
+#      and its build-time node_modules removed; only the ~8 MB dist
+#      bundle ships.
+#
+ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
+RUN if [ -f package.json ]; then \
+      npm install --omit=dev --prefer-offline --no-audit --no-fund ; \
+    fi && \
+    npx --yes --package=playwright playwright install chromium --only-shell && \
+    if [ -f web/package.json ]; then \
+      (cd web && npm install --prefer-offline --no-audit --no-fund && npm run build) && \
+      rm -rf web/node_modules ; \
+    fi && \
+    npm cache clean --force
+
+RUN rm -rf /root/.cache /tmp/* .git .github website tests .pytest_cache .mypy_cache .ruff_cache && \
+    find /opt/hermes -type d -name "__pycache__" -prune -exec rm -rf {} + && \
+    find /opt/hermes -type f \( -name "*.pyc" -o -name "*.pyo" \) -delete
+
+FROM ${BASE_IMAGE}
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    HERMES_HOME=/opt/data \
+    PATH=/opt/hermes/.venv/bin:${PATH} \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright \
+    PYTHONDONTWRITEBYTECODE=1
+
+#
+# The headless Chromium binary itself rides in from the builder stage
+# (see PLAYWRIGHT_BROWSERS_PATH above). What the final stage adds is:
+#
+#   • Chromium runtime libs: the 17 .so dependencies headless_shell
+#     dynamically links against. Same set that
+#     `playwright install --with-deps chromium` would pull in on
+#     Debian 12 — explicit here so the diff is auditable.
+#   • curl: `hermes auth login` device-code OAuth flow + ad-hoc HTTP.
+#   • poppler-utils: pdftotext / pdfinfo back Hermes's PDF readers.
+#
+# Note: capability-specific Python packages (python-pptx, weasyprint,
+# pillow, xlsxwriter, qrcode, dingtalk SDK, …) are NOT baked in —
+# users `pip install --user` them on demand via the `terminal` tool.
+# Same for `whatsapp-bridge`, which our panel's channel plugins don't
+# rely on.
+#
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    bash \
+    ca-certificates \
+    curl \
+    ffmpeg \
+    fonts-liberation \
+    git \
+    gosu \
+    libasound2 \
+    libatk1.0-0 \
+    libatk-bridge2.0-0 \
+    libatspi2.0-0 \
+    libcairo2 \
+    libcups2 \
+    libdbus-1-3 \
+    libdrm2 \
+    libgbm1 \
+    libnspr4 \
+    libnss3 \
+    libpango-1.0-0 \
+    libx11-6 \
+    libxcb1 \
+    libxcomposite1 \
+    libxdamage1 \
+    libxext6 \
+    libxfixes3 \
+    libxkbcommon0 \
+    libxrandr2 \
+    poppler-utils \
+    procps \
+    python3 \
+    python3-venv \
+    ripgrep && \
+    ln -sf /usr/bin/python3 /usr/local/bin/python && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN usermod -l hermes -d /home/hermes -m node && \
+    groupmod -n hermes node
+
+COPY --chown=hermes:hermes --from=builder /opt/hermes /opt/hermes
+
+WORKDIR /opt/hermes
+
+RUN mkdir -p /opt/data && \
+    chown -R hermes:hermes /opt/data /home/hermes
+
+# Bake the jishushell orchestration shim into the image. The panel used
+# to bind-mount this from ~/.jishushell/runtimes/hermes/ but that coupled
+# instance startup to a host file outside the instance dir. Baking it in
+# keeps all runtime-critical assets inside the image, and the LABEL below
+# lets the panel detect whether a pulled image actually has it.
+COPY templates/hermes-entrypoint.sh /usr/local/bin/jishushell-hermes-entry.sh
+RUN chmod 0755 /usr/local/bin/jishushell-hermes-entry.sh
+
+# Advertise the protocol contract this image satisfies. The panel reads
+# this label via `docker inspect` before launching an instance; a panel
+# that only knows protocol version N refuses to start an image that
+# declares N+1, which is how we gate rolling upgrades without silent
+# behavioral drift.
+LABEL runtime.protocol.version="1"
+
+# Zombie reaping is handled by Nomad's `init: true` flag (docker-init
+# becomes PID 1 regardless of this image's entrypoint — see the hermes
+# adapter's docker Config). We deliberately leave ENTRYPOINT unset so
+# anyone running this image directly with `docker run --init` gets the
+# same guarantee without surprise.
+CMD ["hermes", "--help"]

package/INSTALL-NOTICE

@@ -32,16 +32,14 @@ software bundled with or installed by this product.
               https://github.com/abiosoft/colima/blob/main/LICENSE
     Author  : Abiola Ibrahim
 
-  Nomad v1.11.3+ (>= 1.7.0)
-    URL     : https://github.com/hashicorp/nomad
-    License : Business Source License 1.1 (BSL 1.1)
-              https://github.com/hashicorp/nomad/blob/main/LICENSE
-    Licensor: International Business Machines Corporation (IBM)
-    Work    : Nomad Version 1.7.0 or later. (c) 2024 IBM Corp.
-
-    You, as the operator deploying this software, are the end user of
-    Nomad and are solely responsible for ensuring your use complies with
-    the BSL 1.1 terms, including any restrictions on competitive or
-    commercial use. For licensing details and FAQ, see:
-    https://www.hashicorp.com/license-faq
+  Nomad v1.6.5 (last MPL 2.0 release in the 1.6.x line)
+    URL     : https://github.com/hashicorp/nomad/tree/v1.6.5
+    License : Mozilla Public License 2.0
+              https://github.com/hashicorp/nomad/blob/v1.6.5/LICENSE
+    Author  : HashiCorp, Inc.
+
+    JishuShell pins Nomad to v1.6.5, the final release in the 1.6.x series
+    distributed under MPL 2.0. Nomad 1.6.6 and later (including 1.7.0+) are
+    licensed under the Business Source License 1.1 (BSL 1.1) and are not
+    used by JishuShell.
 

package/apps/hermes-container.yaml

@@ -0,0 +1,35 @@
+id: hermes-container
+name: Hermes Agent
+version: "1.0.0"
+jishushell:
+  min_version: "0.4.24"
+agentType: hermes
+description: "Hermes Agent 容器运行时，使用 apps 目录作为统一安装根"
+singleInstance: false
+
+tasks:
+  - name: gateway
+    role: service
+    runtime: container
+    image: "ghcr.io/x-aijishu/hermes-runtime:latest"
+    command: "/bin/bash"
+    args: ["/usr/local/bin/jishushell-hermes-entry.sh", "gateway", "run"]
+    env:
+      API_SERVER_ENABLED: "true"
+      API_SERVER_HOST: "0.0.0.0"
+      API_SERVER_PORT: "8642"
+    resources:
+      cpu: "1000m"
+      memory: "1024Mi"
+    ports:
+      - name: gateway
+        port: 8642
+        visibility: external
+    health:
+      http:
+        path: /health
+        port: 8642
+      interval: "15s"
+      timeout: "5s"
+      retries: 3
+      start_period: "30s"

package/apps/ollama-binary.yaml

@@ -0,0 +1,200 @@
+id: ollama-binary
+name: Ollama
+version: "1.0.0"
+jishushell:
+  min_version: "0.4.24"
+description: "通过官方脚本，安装并运行Ollama"
+singleInstance: true
+
+tasks:
+  - name: gateway
+    role: service
+    runtime: process
+    command: /usr/local/bin/ollama
+    args: ["serve"]
+    env:
+      OLLAMA_HOST: "0.0.0.0:11434"
+    resources:
+      cpu: "2000m"
+      memory: "4096Mi"
+    ports:
+      - name: gateway
+        port: 11434
+        visibility: external
+    health:
+      http:
+        path: /api/version
+        port: 11434
+      interval: "15s"
+      timeout: "5s"
+      retries: 3
+      start_period: "30s"
+
+provides:
+  - capability: "ollama-terminal"
+    protocol: "terminal"
+    description: "Ollama快速终端，可直接执行 ollama 命令"
+    terminal:
+      command: ["ollama"]
+      task: "gateway"
+      prompt: "ollama"
+      welcome: "输入 list / ps / pull / run 等命令开始；终端会自动补齐前缀 ollama。"
+      commands:
+        recommend:
+          - "pull qwen3.5:0.8b"
+          - "pull qwen3.6:35b"
+          - "pull gemma4:26b"
+          - "pull gemma4:e4b"
+          - "pull gemma4:e2b"
+        others:
+          - cmd: "show"
+            description: "Show information for a model"
+          - cmd: "stop"
+            description: "Stop a running model"
+          - cmd: "pull"
+            description: "Pull a model from a registry"
+          - cmd: "list"
+            description: "List models"
+          - cmd: "ps"
+            description: "List running models"
+          - cmd: "rm"
+            description: "Remove a model"
+          - cmd: "help"
+            description: "Help about any command"
+  - capability: "ollama-api"
+    port: 11434
+    description: "Ollama HTTP API，兼容 OpenAI /v1/chat/completions 端点"
+
+lifecycle:
+  pre_install:
+    - run: >-
+        if ! command -v ollama >/dev/null 2>&1; then
+          echo "未检测到 ollama 命令，将通过官方脚本安装 Ollama..." >&2;
+        else
+          echo "检测到系统中已安装 ollama，跳过安装步骤，直接使用系统版本。" >&2;
+        fi;
+  install:
+    - run: >-
+        if ! command -v ollama >/dev/null 2>&1; then
+          echo "未检测到 ollama，开始安装..." >&2;
+          if [ "$(id -u)" -ne 0 ]; then
+            if ! command -v sudo >/dev/null 2>&1; then
+              echo "未检测到 sudo，当前环境无法自动安装 Ollama。请以 root 身份重试。" >&2;
+              exit 1;
+            fi;
+            if [ -n "${JISHUSHELL_SUDO_ASKPASS:-}" ]; then
+              sudo_probe_output="$(sudo -k -A true 2>&1)" || {
+                if printf '%s\n' "$sudo_probe_output" | grep -qi "no new privileges"; then
+                  echo "当前运行环境禁止 sudo 提权（no new privileges），无法自动安装 Ollama。请在系统终端手动安装，或调整容器/服务配置后重试。" >&2;
+                else
+                  echo "提供的 sudo 密码无效，无法安装 Ollama。" >&2;
+                fi;
+                exit 1;
+              };
+              run_as_root() { sudo -A "$@"; };
+            else
+              sudo_probe_output="$(sudo -n true 2>&1)" || {
+                if printf '%s\n' "$sudo_probe_output" | grep -qi "no new privileges"; then
+                  echo "当前运行环境禁止 sudo 提权（no new privileges），无法自动安装 Ollama。请在系统终端手动安装，或调整容器/服务配置后重试。" >&2;
+                else
+                  echo "安装 Ollama 需要 sudo 密码；请在页面弹窗中输入后重试。" >&2;
+                fi;
+                exit 1;
+              };
+              run_as_root() { sudo -n "$@"; };
+            fi;
+          else
+            run_as_root() { "$@"; };
+          fi;
+          for BINDIR in /usr/local/bin /usr/bin /bin; do
+            echo "$PATH" | grep -q "$BINDIR" && break || continue;
+          done;
+          OLLAMA_INSTALL_DIR="$(dirname "${BINDIR:-/usr/local/bin}")";
+          if [ -d "$OLLAMA_INSTALL_DIR/lib/ollama" ]; then
+            old_dir="$OLLAMA_INSTALL_DIR/lib/ollama.jishushell-old-$(date +%s)";
+            echo "检测到旧版 Ollama 目录，先移动到 $old_dir 以避免长时间卡在清理步骤..." >&2;
+            run_as_root mv "$OLLAMA_INSTALL_DIR/lib/ollama" "$old_dir";
+            ( run_as_root rm -rf "$old_dir" >/dev/null 2>&1 || true ) &
+          fi;
+          curl -fsSL https://ollama.com/install.sh | run_as_root sh;
+        else
+          echo "检测到系统中已安装 ollama，跳过二进制安装。" >&2;
+        fi
+      timeout_ms: 900000
+      successIfCommandExists: "ollama"
+    - run: >-
+        case "$(uname -s)" in
+          Linux)
+            if command -v systemctl >/dev/null 2>&1 && systemctl list-unit-files ollama.service >/dev/null 2>&1; then
+              echo "停止并禁用 ollama.service，后续交由 Nomad 管理..." >&2;
+              if [ "$(id -u)" -eq 0 ]; then
+                run_as_root() { "$@"; };
+              elif [ -n "${JISHUSHELL_SUDO_ASKPASS:-}" ]; then
+                sudo_probe_output="$(sudo -k -A true 2>&1)" || {
+                  if printf '%s\n' "$sudo_probe_output" | grep -qi "no new privileges"; then
+                    echo "当前运行环境禁止 sudo 提权（no new privileges），无法清理 ollama.service。请在系统终端手动执行后重试。" >&2;
+                  else
+                    echo "提供的 sudo 密码无效，无法清理 ollama.service。" >&2;
+                  fi;
+                  exit 1;
+                };
+                run_as_root() { sudo -A "$@"; };
+              elif command -v sudo >/dev/null 2>&1; then
+                run_as_root() { sudo -n "$@"; };
+              else
+                run_as_root() { "$@"; };
+              fi;
+              run_as_root systemctl disable --now ollama;
+            else
+              echo "Linux 环境未检测到 ollama.service，跳过 systemd 清理。" >&2;
+            fi
+            ;;
+          Darwin)
+            echo "macOS 环境尝试关闭 Ollama 自启与正在运行的进程..." >&2;
+            if command -v launchctl >/dev/null 2>&1; then
+              launchctl bootout "gui/$(id -u)"/com.ollama.ollama 2>/dev/null || true;
+              launchctl disable "gui/$(id -u)/com.ollama.ollama" 2>/dev/null || true;
+            fi;
+            osascript -e 'tell application "Ollama" to quit' >/dev/null 2>&1 || true;
+            pkill -TERM -x ollama 2>/dev/null || true;
+            pkill -TERM -x Ollama 2>/dev/null || true
+            ;;
+          *)
+            echo "当前平台不支持自动清理 Ollama 自启，跳过。" >&2
+            ;;
+        esac
+
+  uninstall:
+    - run: >-
+        if [ "$(id -u)" -ne 0 ]; then
+          if ! command -v sudo >/dev/null 2>&1; then
+            echo "当前环境未检测到 sudo，无法卸载 Ollama。请以 root 身份重试。" >&2;
+            exit 1;
+          fi;
+          if [ -n "${JISHUSHELL_SUDO_ASKPASS:-}" ]; then
+            sudo_probe_output="$(sudo -k -A true 2>&1)" || {
+              if printf '%s\n' "$sudo_probe_output" | grep -qi "no new privileges"; then
+                echo "当前运行环境禁止 sudo 提权（no new privileges），无法卸载 Ollama。请在系统终端手动执行，或调整容器/服务配置后重试。" >&2;
+              else
+                echo "提供的 sudo 密码无效，无法卸载 Ollama。" >&2;
+              fi;
+              exit 1;
+            };
+            run_as_root() { sudo -A "$@"; };
+          else
+            sudo_probe_output="$(sudo -n true 2>&1)" || {
+              if printf '%s\n' "$sudo_probe_output" | grep -qi "no new privileges"; then
+                echo "当前运行环境禁止 sudo 提权（no new privileges），无法卸载 Ollama。请在系统终端手动执行，或调整容器/服务配置后重试。" >&2;
+              else
+                echo "卸载 Ollama 需要 sudo 密码；请在页面弹窗中输入后重试。" >&2;
+              fi;
+              exit 1;
+            };
+            run_as_root() { sudo -n "$@"; };
+          fi;
+        else
+          run_as_root() { "$@"; };
+        fi;
+        run_as_root rm -f /usr/local/bin/ollama /usr/bin/ollama /bin/ollama;
+        run_as_root rm -rf /usr/local/lib/ollama /usr/lib/ollama /usr/share/ollama 2>/dev/null || true
+

package/apps/ollama-cpu-container.yaml

@@ -0,0 +1,37 @@
+id: ollama-cpu-docker
+name: Ollama CPU(Docker)
+version: "1.0.0"
+jishushell:
+  min_version: "0.4.24"
+description: "使用 alpine/ollama 镜像运行的纯 CPU 版 Ollama"
+singleInstance: true
+
+tasks:
+  - name: gateway
+    role: service
+    runtime: container
+    image: "alpine/ollama:latest"
+    env:
+      OLLAMA_HOST: "0.0.0.0:11434"
+    volumes:
+      - source: "~/.ollama"
+        target: "/root/.ollama"
+    resources:
+      cpu: "2000m"
+      memory: "4096Mi"
+    ports:
+      - name: gateway
+        port: 11434
+    health:
+      http:
+        path: /api/version
+        port: 11434
+      interval: "15s"
+      timeout: "5s"
+      retries: 3
+      start_period: "30s"
+
+provides:
+  - capability: "ollama-api"
+    port: 11434
+    description: "Ollama HTTP API，兼容 OpenAI /v1/chat/completions 端点"