jishushell 0.4.10 → 0.4.24-beta.2

package/dist/services/app/openclaw-manager.js

@@ -0,0 +1,1178 @@
+/**
+ * OpenClaw App-type Manager
+ *
+ * Encapsulates ALL logic specific to the "openclaw" app type:
+ *   - Instance directory layout  (openclaw-home/.openclaw/openclaw.json)
+ *   - defaultRuntime / starterConfig builders
+ *   - Config load / save  (openclaw.json + env files)
+ *   - IM channel plugin installation  (Feishu, WeChat, …)
+ *   - Feishu / WeChat credential persistence
+ *   - Pre-start validation and Docker config patching
+ *
+ * nomad-manager.ts owns the Nomad task/job spec builders; it imports
+ * getOpenclawHome / getOpenclawConfigPath etc. from here.
+ *
+ * Generic utilities (port allocation, listInstances, …) are imported
+ * from instance-manager.ts which is the public facade kept for backward
+ * compatibility with all existing callers.
+ */
+import { execFile, execFileSync } from "child_process";
+import { randomBytes } from "crypto";
+import { chmodSync, chownSync, copyFileSync, cpSync, existsSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, } from "fs";
+import { userInfo } from "os";
+import { dirname, join, resolve } from "path";
+import { INSTANCES_DIR, JISHUSHELL_HOME, getInstanceDir, getPanelConfig, instanceMetaPath, } from "../../config.js";
+import { LEGACY_PROVIDER_API_ALIASES } from "../../constants.js";
+import { safeReadJson, safeWriteJson } from "../../utils/safe-json.js";
+import { ensureDirContainer, writeConfigFile } from "../../utils/fs.js";
+import { compileTaskRuntime } from "./app-compiler.js";
+import { getInstance, listInstances, resolveServiceUser, chownToServiceUser, getRuntimeEnvFiles, getRuntimeEnv, updateEnvFile, defaultGatewayPort, releasePort, inferProviderApiKeyEnvName, notifyConfigChange, getGatewayPort, getInstanceRuntime, } from "../instance-manager.js";
+// ── OpenClaw-specific constants ──────────────────────────────────────────────
+export const INSTANCE_OPENCLAW_HOME_DIRNAME = "openclaw-home";
+export const INSTANCE_MODEL_ENV_FILENAME = "model.env";
+const OPENCLAW_STATE_DIRNAME = ".openclaw";
+const OPENCLAW_CONFIG_FILENAME = "openclaw.json";
+// ── Private utilities ────────────────────────────────────────────────────────
+function normalizePath(p) {
+    return resolve(p.replace(/^~/, userInfo().homedir));
+}
+function deepMerge(base, overlay) {
+    if (typeof base !== "object" || base === null ||
+        typeof overlay !== "object" || overlay === null ||
+        Array.isArray(base) || Array.isArray(overlay)) {
+        return structuredClone(overlay);
+    }
+    const merged = structuredClone(base);
+    for (const key of Object.keys(overlay)) {
+        merged[key] = key in merged ? deepMerge(merged[key], overlay[key]) : structuredClone(overlay[key]);
+    }
+    return merged;
+}
+function loadJson(path) {
+    try {
+        return JSON.parse(readFileSync(path, "utf-8"));
+    }
+    catch (e) {
+        console.warn(`[openclaw] Failed to parse ${path}: ${e.message}`);
+        return null;
+    }
+}
+// ── Path helpers ─────────────────────────────────────────────────────────────
+export function defaultOpenclawHome(instanceId) {
+    return join(getInstanceDir(instanceId), INSTANCE_OPENCLAW_HOME_DIRNAME);
+}
+export function defaultModelEnvFile(instanceId) {
+    return join(getInstanceDir(instanceId), INSTANCE_MODEL_ENV_FILENAME);
+}
+export function getOpenclawHome(instanceId) {
+    const meta = getInstance(instanceId);
+    return meta?.openclaw_home || defaultOpenclawHome(instanceId);
+}
+export function openclawStateDir(instanceId) {
+    return join(getOpenclawHome(instanceId), OPENCLAW_STATE_DIRNAME);
+}
+function legacyOpenclawConfigPath(instanceId) {
+    return join(getOpenclawHome(instanceId), OPENCLAW_CONFIG_FILENAME);
+}
+function openclawConfigPathInternal(instanceId) {
+    return join(openclawStateDir(instanceId), OPENCLAW_CONFIG_FILENAME);
+}
+export function getOpenclawConfigPath(instanceId) {
+    return openclawConfigPathInternal(instanceId);
+}
+export function getLegacyOpenclawConfigPath(instanceId) {
+    return legacyOpenclawConfigPath(instanceId);
+}
+function resolveExistingConfigPath(instanceId) {
+    const runtimePath = openclawConfigPathInternal(instanceId);
+    if (existsSync(runtimePath))
+        return runtimePath;
+    const legacyPath = legacyOpenclawConfigPath(instanceId);
+    if (existsSync(legacyPath))
+        return legacyPath;
+    return runtimePath;
+}
+export function getChannelExtensionsDir(instanceId) {
+    return join(getOpenclawHome(instanceId), OPENCLAW_STATE_DIRNAME, "extensions");
+}
+export function getStockExtensionsDir() {
+    return join(JISHUSHELL_HOME, "packages", "openclaw", "lib", "node_modules", "openclaw", "extensions");
+}
+// ── OpenClaw binary resolution ───────────────────────────────────────────────
+function resolveOpenclawBin() {
+    const candidates = [
+        join(JISHUSHELL_HOME, "packages", "openclaw", "bin", "openclaw"),
+        "/usr/local/bin/openclaw",
+        "/usr/bin/openclaw",
+    ];
+    for (const p of candidates) {
+        if (existsSync(p)) {
+            try {
+                execFileSync("chmod", ["+x", p], { timeout: 3000 });
+            }
+            catch { /* best effort */ }
+            try {
+                const real = realpathSync(p);
+                if (real !== p) {
+                    try {
+                        execFileSync("chmod", ["+x", real], { timeout: 3000 });
+                    }
+                    catch { /* best effort */ }
+                }
+            }
+            catch { /* best effort */ }
+            return p;
+        }
+    }
+    return candidates[0];
+}
+export function getResolvedOpenclawBin() {
+    return resolveOpenclawBin();
+}
+// ── Runtime / config builders ────────────────────────────────────────────────
+async function buildDefaultRuntime(instanceId, openclawHome) {
+    const port = await defaultGatewayPort(instanceId);
+    const svcUser = resolveServiceUser();
+    return {
+        runtime: {
+            command: resolveOpenclawBin(),
+            args: ["gateway", "run", "--port", String(port), "--allow-unconfigured"],
+            cwd: openclawHome,
+            user: svcUser?.username ?? userInfo().username,
+            env_files: [defaultModelEnvFile(instanceId)],
+            env: {
+                OPENCLAW_GATEWAY_PORT: String(port),
+                NODE_OPTIONS: "--max-old-space-size=2048",
+            },
+            resources: { CPU: 1000, MemoryMB: 2048 },
+        },
+        allocatedPort: port,
+    };
+}
+export function buildStarterConfig() {
+    const dp = getPanelConfig().default_provider;
+    let providerName = "minimax";
+    let providerConfig = {
+        baseUrl: "https://api.minimaxi.com/v1",
+        api: "openai-completions",
+        models: [{ id: "MiniMax-M2.7", name: "MiniMax M2.7", contextWindow: 204800 }],
+    };
+    let defaultModel = "minimax/MiniMax-M2.7";
+    if (dp?.providerId) {
+        providerName = dp.providerId;
+        providerConfig = {
+            baseUrl: dp.baseUrl,
+            api: dp.api,
+            ...(dp.authHeader ? { authHeader: true } : {}),
+            models: dp.models || [],
+        };
+        const modelId = dp.selectedModelId || dp.models?.[0]?.id || "";
+        defaultModel = `${providerName}/${modelId}`;
+    }
+    const config = {
+        models: { providers: { [providerName]: providerConfig } },
+        agents: { defaults: { model: defaultModel, models: { [defaultModel]: {} } } },
+        channels: {},
+        gateway: {
+            mode: "local",
+            auth: { mode: "token", token: randomBytes(24).toString("hex") },
+            controlUi: { dangerouslyDisableDeviceAuth: true },
+        },
+        plugins: { entries: { feishu: { enabled: false } } },
+    };
+    if (dp?.providerId) {
+        config["x-jishushell"] = {
+            proxy: {
+                upstream: {
+                    providerId: dp.providerId,
+                    baseUrl: dp.baseUrl,
+                    api: dp.api,
+                    authHeader: dp.authHeader || false,
+                    models: dp.models || [],
+                    selectedModelId: dp.selectedModelId || dp.models?.[0]?.id || "",
+                    hasApiKey: !!dp.apiKey,
+                },
+            },
+        };
+    }
+    return config;
+}
+// backward-compat alias used by existing callers
+export { buildStarterConfig as starterConfig };
+// ── Config loading ───────────────────────────────────────────────────────────
+function loadEffectiveConfig(instanceId) {
+    const runtimePath = openclawConfigPathInternal(instanceId);
+    const legacyPath = legacyOpenclawConfigPath(instanceId);
+    const rExists = existsSync(runtimePath);
+    const lExists = existsSync(legacyPath);
+    if (rExists && lExists) {
+        const legacy = loadJson(legacyPath);
+        const runtime = loadJson(runtimePath);
+        if (legacy && runtime)
+            return deepMerge(legacy, runtime);
+        return runtime || legacy || null;
+    }
+    if (rExists)
+        return loadJson(runtimePath);
+    if (lExists)
+        return loadJson(legacyPath);
+    return null;
+}
+// ── Provider key helpers ─────────────────────────────────────────────────────
+function hasConfiguredValue(value) {
+    if (typeof value === "string")
+        return value.trim().length > 0;
+    if (typeof value === "object" && value !== null)
+        return Object.keys(value).length > 0;
+    return value != null;
+}
+function injectProviderApiKeys(instanceId, config) {
+    const merged = structuredClone(config);
+    const runtimeEnv = getRuntimeEnv(instanceId);
+    const providers = merged.models?.providers || {};
+    for (const [providerId, provider] of Object.entries(providers)) {
+        if (typeof provider !== "object" || provider === null)
+            continue;
+        const p = provider;
+        const api = p.api;
+        if (typeof api === "string" && api in LEGACY_PROVIDER_API_ALIASES) {
+            p.api = LEGACY_PROVIDER_API_ALIASES[api];
+        }
+        const apiKey = runtimeEnv[inferProviderApiKeyEnvName(providerId)];
+        if (apiKey)
+            p.apiKey = apiKey;
+    }
+    return merged;
+}
+function applyFeishuDebugAccessDefaults(channel) {
+    if (channel.enabled === false)
+        return;
+    if (!hasConfiguredValue(channel.appId))
+        return;
+    if (!hasConfiguredValue(channel.appSecret))
+        return;
+    let dmPolicy = channel.dmPolicy;
+    if (typeof dmPolicy !== "string" || !dmPolicy.trim()) {
+        channel.dmPolicy = "open";
+        dmPolicy = "open";
+    }
+    if (dmPolicy !== "open")
+        return;
+    if (!("resolveSenderNames" in channel))
+        channel.resolveSenderNames = false;
+    let accounts = channel.accounts;
+    if (typeof accounts !== "object" || accounts === null) {
+        accounts = {};
+        channel.accounts = accounts;
+    }
+    let defaultAccount = accounts.default;
+    if (typeof defaultAccount !== "object" || defaultAccount === null) {
+        defaultAccount = {};
+        accounts.default = defaultAccount;
+    }
+    if (!("resolveSenderNames" in defaultAccount))
+        defaultAccount.resolveSenderNames = false;
+    const allowFrom = channel.allowFrom;
+    if (Array.isArray(allowFrom)) {
+        const normalized = allowFrom.map((e) => String(e).trim()).filter(Boolean);
+        if (!normalized.includes("*"))
+            normalized.push("*");
+        channel.allowFrom = normalized;
+        return;
+    }
+    channel.allowFrom = ["*"];
+}
+function prepareConfigForSave(instanceId, config) {
+    const configToWrite = structuredClone(config);
+    delete configToWrite["x-jishushell"];
+    const envUpdates = {};
+    const providers = configToWrite.models?.providers || {};
+    const envFiles = getRuntimeEnvFiles(instanceId);
+    const channels = configToWrite.channels || {};
+    const plugins = configToWrite.plugins ??= {};
+    const pluginEntries = plugins.entries ??= {};
+    for (const [providerId, provider] of Object.entries(providers)) {
+        if (typeof provider !== "object" || provider === null)
+            continue;
+        const p = provider;
+        if (typeof p.api === "string" && p.api in LEGACY_PROVIDER_API_ALIASES) {
+            p.api = LEGACY_PROVIDER_API_ALIASES[p.api];
+        }
+        if (!("apiKey" in p))
+            continue;
+        if (typeof p.baseUrl === "string" && p.baseUrl.includes("/proxy/"))
+            continue;
+        const apiKey = p.apiKey;
+        delete p.apiKey;
+        if (envFiles.length) {
+            envUpdates[inferProviderApiKeyEnvName(providerId)] = String(apiKey || "");
+        }
+        else {
+            p.apiKey = apiKey;
+        }
+    }
+    for (const [channelId, channel] of Object.entries(channels)) {
+        if (typeof channel !== "object" || channel === null)
+            continue;
+        const ch = channel;
+        if (channelId === "feishu" || channelId === "lark")
+            applyFeishuDebugAccessDefaults(ch);
+        let pluginEntry = pluginEntries[channelId];
+        if (pluginEntry == null) {
+            pluginEntry = {};
+            pluginEntries[channelId] = pluginEntry;
+        }
+        if (typeof pluginEntry === "object") {
+            pluginEntry.enabled = ch.enabled !== false;
+        }
+    }
+    return [configToWrite, envUpdates];
+}
+// ── IM channel plugin helpers ────────────────────────────────────────────────
+const CHANNEL_EXT_DIR_ALIAS = {
+    feishu: "openclaw-lark",
+    lark: "openclaw-lark",
+};
+export const CHANNEL_PLUGIN_MAP = {
+    feishu: "@larksuite/openclaw-lark",
+    lark: "@larksuite/openclaw-lark",
+    telegram: "@openclaw/telegram",
+    discord: "@openclaw/discord",
+    slack: "@openclaw/slack",
+    whatsapp: "@openclaw/whatsapp",
+    signal: "@openclaw/signal",
+    line: "@openclaw/line",
+    msteams: "@openclaw/msteams",
+    "openclaw-weixin": "@tencent-weixin/openclaw-weixin",
+};
+const IM_PLUGIN_ENTRY_IDS = new Set([
+    ...Object.keys(CHANNEL_PLUGIN_MAP),
+    ...Object.values(CHANNEL_EXT_DIR_ALIAS),
+]);
+export function stripImBindings(config) {
+    if (config?.channels)
+        delete config.channels;
+    const entries = config?.plugins?.entries;
+    if (entries && typeof entries === "object") {
+        for (const key of Object.keys(entries)) {
+            if (IM_PLUGIN_ENTRY_IDS.has(key))
+                delete entries[key];
+        }
+    }
+}
+export function isChannelPluginInstalled(instanceId, channelId) {
+    const extDirName = CHANNEL_EXT_DIR_ALIAS[channelId] || channelId;
+    const stockExtDir = getStockExtensionsDir();
+    return existsSync(join(getChannelExtensionsDir(instanceId), extDirName))
+        || existsSync(join(stockExtDir, extDirName))
+        || (extDirName !== channelId && existsSync(join(stockExtDir, channelId)));
+}
+export async function installChannelPlugin(instanceId, channelId) {
+    const pkg = CHANNEL_PLUGIN_MAP[channelId];
+    if (!pkg)
+        throw new Error(`Unknown channel: ${channelId}`);
+    if (isChannelPluginInstalled(instanceId, channelId))
+        return;
+    const openclawHome = getOpenclawHome(instanceId);
+    const extensionsDir = getChannelExtensionsDir(instanceId);
+    const { getNomadDriver } = await import("../../config.js");
+    if (getNomadDriver() === "docker") {
+        await installChannelPluginViaDocker(instanceId, channelId, pkg, extensionsDir);
+        return;
+    }
+    const openclawBin = resolveOpenclawBin();
+    const nodeBinDir = dirname(process.execPath);
+    const childPath = [nodeBinDir, process.env.PATH].filter(Boolean).join(":");
+    const proxyEnvKeys = [
+        "http_proxy", "HTTP_PROXY", "https_proxy", "HTTPS_PROXY",
+        "no_proxy", "NO_PROXY", "NODE_EXTRA_CA_CERTS", "NODE_TLS_REJECT_UNAUTHORIZED",
+    ];
+    const proxyEnv = {};
+    for (const key of proxyEnvKeys) {
+        if (process.env[key])
+            proxyEnv[key] = process.env[key];
+    }
+    const childEnv = {
+        PATH: childPath,
+        HOME: process.env.HOME,
+        LANG: process.env.LANG,
+        OPENCLAW_HOME: openclawHome,
+        ...proxyEnv,
+    };
+    const MAX_ATTEMPTS = 3;
+    const RETRY_DELAY_MS = 5_000;
+    const attemptInstall = () => new Promise((res, rej) => {
+        execFile(openclawBin, ["plugins", "install", pkg], { cwd: openclawHome, env: childEnv, timeout: 300_000 }, (err, stdout, stderr) => {
+            if (err && !isChannelPluginInstalled(instanceId, channelId)) {
+                const msg = [stderr?.trim(), stdout?.trim(), err.message].filter(Boolean).join(" | ");
+                console.error(`[openclaw-plugins] ${pkg} exit code ${err.code ?? "?"}`);
+                try {
+                    if (existsSync(extensionsDir)) {
+                        for (const entry of readdirSync(extensionsDir)) {
+                            if (entry.startsWith(".openclaw-install-stage-")) {
+                                rmSync(join(extensionsDir, entry), { recursive: true, force: true });
+                            }
+                        }
+                    }
+                }
+                catch { /* best effort */ }
+                rej(new Error(msg));
+            }
+            else {
+                res();
+            }
+        });
+    });
+    console.log(`[openclaw-plugins] Installing ${pkg} for ${channelId} (host)...`);
+    let lastErr;
+    for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+        try {
+            await attemptInstall();
+            const extDirName = CHANNEL_EXT_DIR_ALIAS[channelId] || channelId;
+            const installedExtDir = join(extensionsDir, extDirName);
+            if (existsSync(installedExtDir)) {
+                ensureDirContainer(installedExtDir);
+                try {
+                    for (const entry of readdirSync(installedExtDir, { withFileTypes: true })) {
+                        if (entry.isDirectory())
+                            ensureDirContainer(join(installedExtDir, entry.name));
+                    }
+                }
+                catch { /* best effort */ }
+            }
+            ensureDirContainer(extensionsDir);
+            return;
+        }
+        catch (err) {
+            lastErr = err;
+            const isFetchError = /fetch failed/i.test(err.message ?? "");
+            if (isFetchError && attempt < MAX_ATTEMPTS) {
+                console.warn(`[openclaw-plugins] ${pkg} install attempt ${attempt}/${MAX_ATTEMPTS} failed, retrying...`);
+                await new Promise(r => setTimeout(r, RETRY_DELAY_MS));
+                continue;
+            }
+            break;
+        }
+    }
+    throw lastErr;
+}
+async function installChannelPluginViaDocker(instanceId, channelId, pkg, extensionsDir) {
+    const { exec } = await import("../nomad-manager.js");
+    const MAX_ATTEMPTS = 3;
+    const RETRY_DELAY_MS = 5_000;
+    console.log(`[openclaw-plugins] Installing ${pkg} for ${channelId} via docker exec (${instanceId})...`);
+    let lastErr;
+    for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+        try {
+            const result = await exec(instanceId, ["openclaw", "plugins", "install", pkg], 300_000);
+            if (result.exitCode !== 0 && !isChannelPluginInstalled(instanceId, channelId)) {
+                const msg = [result.stderr?.trim(), result.stdout?.trim()].filter(Boolean).join(" | ");
+                throw new Error(msg || `openclaw plugins install exited with code ${result.exitCode}`);
+            }
+            console.log(`[openclaw-plugins] ${pkg} installed via docker`);
+            const extDirName = CHANNEL_EXT_DIR_ALIAS[channelId] || channelId;
+            const installedExtDir = join(extensionsDir, extDirName);
+            if (existsSync(installedExtDir)) {
+                ensureDirContainer(installedExtDir);
+                try {
+                    for (const entry of readdirSync(installedExtDir, { withFileTypes: true })) {
+                        if (entry.isDirectory())
+                            ensureDirContainer(join(installedExtDir, entry.name));
+                    }
+                }
+                catch { /* best effort */ }
+            }
+            ensureDirContainer(extensionsDir);
+            return;
+        }
+        catch (err) {
+            lastErr = err;
+            if (/not running/i.test(err.message ?? "")) {
+                throw new Error("请先启动实例后再安装插件（Docker 模式下插件需在容器内安装）");
+            }
+            const isTransient = /fetch failed|ECONNREFUSED/i.test(err.message ?? "");
+            if (isTransient && attempt < MAX_ATTEMPTS) {
+                await new Promise(r => setTimeout(r, RETRY_DELAY_MS));
+                continue;
+            }
+            break;
+        }
+    }
+    throw lastErr;
+}
+// ── Public config API ────────────────────────────────────────────────────────
+export function getConfig(instanceId) {
+    const config = loadEffectiveConfig(instanceId);
+    if (!config)
+        return null;
+    const meta = getInstance(instanceId);
+    if (meta?.["x-jishushell"])
+        config["x-jishushell"] = meta["x-jishushell"];
+    return injectProviderApiKeys(instanceId, config);
+}
+export function getStoredConfig(instanceId) {
+    const config = loadEffectiveConfig(instanceId);
+    if (!config)
+        return null;
+    const meta = getInstance(instanceId);
+    if (meta?.["x-jishushell"])
+        config["x-jishushell"] = meta["x-jishushell"];
+    return config;
+}
+export function saveConfig(instanceId, config) {
+    const configPath = openclawConfigPathInternal(instanceId);
+    if (!existsSync(getInstanceDir(instanceId)))
+        return false;
+    if (!existsSync(configPath)) {
+        const legacyPath = legacyOpenclawConfigPath(instanceId);
+        ensureDirContainer(dirname(configPath));
+        if (existsSync(legacyPath))
+            copyFileSync(legacyPath, configPath);
+    }
+    if (config["x-jishushell"]) {
+        const metaPath = instanceMetaPath(instanceId);
+        if (existsSync(metaPath)) {
+            const meta = JSON.parse(readFileSync(metaPath, "utf-8"));
+            meta["x-jishushell"] = config["x-jishushell"];
+            safeWriteJson(metaPath, meta);
+            chownToServiceUser(metaPath);
+        }
+    }
+    const [configToWrite, envUpdates] = prepareConfigForSave(instanceId, config);
+    if (configToWrite.plugins?.entries?.["openclaw-lark"]?.enabled) {
+        const stockExtDir = getStockExtensionsDir();
+        const stockFeishu = join(stockExtDir, "feishu");
+        const stockOcl = join(stockExtDir, "openclaw-lark");
+        const instanceOcl = join(getChannelExtensionsDir(instanceId), "openclaw-lark");
+        if (existsSync(stockFeishu) && !existsSync(stockOcl) && !existsSync(instanceOcl)) {
+            configToWrite.plugins.entries.feishu = { enabled: true };
+            delete configToWrite.plugins.entries["openclaw-lark"];
+        }
+        else if (existsSync(stockFeishu)) {
+            configToWrite.plugins.entries.feishu = { enabled: false };
+        }
+    }
+    if (existsSync(configPath)) {
+        try {
+            const existing = JSON.parse(readFileSync(configPath, "utf-8"));
+            if (existing.plugins?.installs) {
+                configToWrite.plugins ??= {};
+                configToWrite.plugins.installs = { ...existing.plugins.installs, ...configToWrite.plugins?.installs };
+            }
+            if (existing.plugins?.entries && configToWrite.plugins?.entries) {
+                for (const [key, val] of Object.entries(configToWrite.plugins.entries)) {
+                    const old = existing.plugins.entries[key];
+                    if (val && typeof val === "object" && !Array.isArray(val) && old && typeof old === "object") {
+                        configToWrite.plugins.entries[key] = { ...old, ...val };
+                    }
+                }
+            }
+            if (existing.channels && configToWrite.channels) {
+                for (const [key, val] of Object.entries(configToWrite.channels)) {
+                    const old = existing.channels[key];
+                    if (val && typeof val === "object" && !Array.isArray(val) && old && typeof old === "object") {
+                        configToWrite.channels[key] = { ...old, ...val };
+                    }
+                }
+            }
+        }
+        catch { /* best effort */ }
+    }
+    if (existsSync(configPath))
+        copyFileSync(configPath, configPath + ".bak");
+    const configJson = JSON.stringify(configToWrite, null, 2);
+    ensureDirContainer(dirname(configPath));
+    writeConfigFile(configPath + ".tmp", configJson);
+    JSON.parse(readFileSync(configPath + ".tmp", "utf-8"));
+    renameSync(configPath + ".tmp", configPath);
+    chownToServiceUser(configPath);
+    const legacyPath = legacyOpenclawConfigPath(instanceId);
+    if (existsSync(legacyPath))
+        copyFileSync(legacyPath, legacyPath + ".bak");
+    writeConfigFile(legacyPath + ".tmp", configJson);
+    JSON.parse(readFileSync(legacyPath + ".tmp", "utf-8"));
+    renameSync(legacyPath + ".tmp", legacyPath);
+    chownToServiceUser(legacyPath);
+    if (Object.keys(envUpdates).length) {
+        const envFiles = getRuntimeEnvFiles(instanceId);
+        if (envFiles.length)
+            updateEnvFile(envFiles[0], envUpdates);
+    }
+    notifyConfigChange(instanceId);
+    return true;
+}
+// ── Credential management ────────────────────────────────────────────────────
+const FEISHU_APP_ID_RE = /^cli_[a-zA-Z0-9]{8,64}$/;
+export function saveFeishuCredentials(instanceId, creds) {
+    if (!FEISHU_APP_ID_RE.test(creds.appId)) {
+        throw new Error(`Invalid Feishu appId format: expected cli_<alnum> (got "${creds.appId}")`);
+    }
+    if (!creds.appSecret || typeof creds.appSecret !== "string" || creds.appSecret.length < 4) {
+        throw new Error("Invalid Feishu appSecret: must be a non-empty string");
+    }
+    const configPath = openclawConfigPathInternal(instanceId);
+    const config = safeReadJson(configPath, "feishu-creds") || {};
+    config.plugins ??= {};
+    config.plugins.entries ??= {};
+    config.plugins.entries.feishu = { enabled: false };
+    config.plugins.entries["openclaw-lark"] = { enabled: true };
+    config.channels ??= {};
+    config.channels.feishu = {
+        ...config.channels.feishu,
+        enabled: true,
+        appId: creds.appId,
+        appSecret: creds.appSecret,
+        domain: creds.domain,
+        dmPolicy: "open",
+        allowFrom: ["*"],
+    };
+    safeWriteJson(configPath, config);
+    chownToServiceUser(configPath);
+    console.log(`[openclaw] Feishu credentials saved for ${instanceId}, domain=${creds.domain}`);
+}
+const SAFE_ACCOUNT_ID_RE = /^[a-zA-Z0-9@._-]{1,128}$/;
+export function saveWeixinCredentials(instanceId, creds) {
+    if (!creds.accountId || !SAFE_ACCOUNT_ID_RE.test(creds.accountId) || creds.accountId.includes("..")) {
+        throw new Error(`Invalid accountId: must be 1-128 chars of [a-zA-Z0-9@._-] without '..'`);
+    }
+    const home = getOpenclawHome(instanceId);
+    const stateDir = join(home, OPENCLAW_STATE_DIRNAME, "openclaw-weixin");
+    const accountsDir = join(stateDir, "accounts");
+    ensureDirContainer(accountsDir);
+    const credObj = {
+        token: creds.token,
+        baseUrl: creds.baseUrl,
+        userId: creds.userId,
+        savedAt: new Date().toISOString(),
+    };
+    safeWriteJson(join(accountsDir, `${creds.accountId}.json`), credObj);
+    safeWriteJson(join(accountsDir, "default.json"), credObj);
+    chownToServiceUser(join(accountsDir, `${creds.accountId}.json`), join(accountsDir, "default.json"));
+    const indexPath = join(stateDir, "accounts.json");
+    let index = [];
+    try {
+        index = JSON.parse(readFileSync(indexPath, "utf-8"));
+    }
+    catch { /* start fresh */ }
+    if (!Array.isArray(index))
+        index = [];
+    if (!index.includes(creds.accountId))
+        index.push(creds.accountId);
+    safeWriteJson(indexPath, index);
+    const configPath = openclawConfigPathInternal(instanceId);
+    const config = safeReadJson(configPath, "weixin-creds") || {};
+    config.plugins ??= {};
+    config.plugins.entries ??= {};
+    config.plugins.entries["openclaw-weixin"] ??= {};
+    config.plugins.entries["openclaw-weixin"].enabled = true;
+    config.channels ??= {};
+    config.channels["openclaw-weixin"] ??= {};
+    config.channels["openclaw-weixin"].enabled = true;
+    const normalizedId = creds.accountId.replace(/[@.]/g, "-");
+    const accounts = config.channels["openclaw-weixin"].accounts ??= {};
+    accounts[creds.accountId] = { enabled: true };
+    if (normalizedId !== creds.accountId)
+        accounts[normalizedId] = { enabled: true };
+    accounts["default"] = { enabled: true };
+    if (!config.channels["openclaw-weixin"].defaultAccount) {
+        config.channels["openclaw-weixin"].defaultAccount = "default";
+    }
+    safeWriteJson(configPath, config);
+    chownToServiceUser(configPath);
+    console.log(`[openclaw] WeChat credentials saved for ${instanceId}, account=${creds.accountId}`);
+}
+export function getWeixinAccounts(instanceId) {
+    const home = getOpenclawHome(instanceId);
+    const stateDir = join(home, OPENCLAW_STATE_DIRNAME, "openclaw-weixin");
+    const accountsDir = join(stateDir, "accounts");
+    if (!existsSync(accountsDir))
+        return [];
+    let indexedIds = [];
+    try {
+        indexedIds = JSON.parse(readFileSync(join(stateDir, "accounts.json"), "utf-8"));
+    }
+    catch { /* fallback */ }
+    const results = [];
+    for (const f of readdirSync(accountsDir)) {
+        if (!f.endsWith(".json"))
+            continue;
+        const id = f.replace(/\.json$/, "");
+        if (indexedIds.length > 0 && !indexedIds.includes(id))
+            continue;
+        if (id === "default")
+            continue;
+        try {
+            const data = JSON.parse(readFileSync(join(accountsDir, f), "utf-8"));
+            results.push({ accountId: id, userId: data.userId, savedAt: data.savedAt });
+        }
+        catch { /* skip */ }
+    }
+    return results;
+}
+// ── Docker config patching ───────────────────────────────────────────────────
+export function patchJsproxyBaseUrl(configPath) {
+    try {
+        const raw = readFileSync(configPath, "utf-8");
+        const patched = raw.replace(/http:\/\/127\.0\.0\.1:(\d+)\/proxy/g, `http://host.docker.internal:$1/proxy`);
+        if (patched !== raw) {
+            writeConfigFile(configPath, patched);
+            console.log(`[openclaw] Patched jsproxy baseUrl in ${configPath}`);
+        }
+    }
+    catch (e) {
+        console.warn(`[openclaw] Failed to patch jsproxy baseUrl in ${configPath}: ${e.message}`);
+    }
+}
+export function patchDockerBridgeGatewayBind(configPath) {
+    try {
+        const raw = readFileSync(configPath, "utf-8");
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return;
+        const gatewayRaw = parsed.gateway;
+        const gateway = gatewayRaw && typeof gatewayRaw === "object" && !Array.isArray(gatewayRaw)
+            ? gatewayRaw
+            : (parsed.gateway = {});
+        const bind = typeof gateway.bind === "string" ? gateway.bind.trim() : "";
+        if (bind && bind !== "loopback")
+            return;
+        gateway.bind = "lan";
+        const next = JSON.stringify(parsed, null, 2);
+        const output = raw.endsWith("\n") ? `${next}\n` : next;
+        if (output === raw)
+            return;
+        writeConfigFile(configPath, output);
+        console.log(`[openclaw] Normalized gateway.bind to "lan" in ${configPath}`);
+    }
+    catch (e) {
+        console.warn(`[openclaw] Failed to patch gateway.bind in ${configPath}: ${e.message}`);
+    }
+}
+// ── prepareStart ─────────────────────────────────────────────────────────────
+export async function prepareStartOpenClaw(instanceId) {
+    const { getNomadDriver, getOpenclawDockerImage } = await import("../../config.js");
+    const { DOCKER_IMAGE_RE, MAX_DOCKER_IMAGE_NAME_LEN } = await import("../nomad-manager.js");
+    const configPath = getOpenclawConfigPath(instanceId);
+    if (!existsSync(configPath)) {
+        return { ok: false, error: "Config file not found" };
+    }
+    if (getNomadDriver() === "docker") {
+        const stateDir = dirname(configPath);
+        ensureDirContainer(stateDir);
+        try {
+            for (const entry of readdirSync(stateDir, { withFileTypes: true })) {
+                if (entry.isDirectory()) {
+                    const sub = join(stateDir, entry.name);
+                    ensureDirContainer(sub);
+                    try {
+                        for (const child of readdirSync(sub, { withFileTypes: true })) {
+                            if (child.isDirectory())
+                                ensureDirContainer(join(sub, child.name));
+                        }
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+        }
+        catch { /* ignore */ }
+        if (existsSync(configPath))
+            chmodSync(configPath, 0o644);
+        patchDockerBridgeGatewayBind(configPath);
+        patchJsproxyBaseUrl(configPath);
+        const image = getOpenclawDockerImage();
+        if (!DOCKER_IMAGE_RE.test(image) || image.length > MAX_DOCKER_IMAGE_NAME_LEN) {
+            return { ok: false, error: `Invalid Docker image name: "${image}"` };
+        }
+        try {
+            execFileSync("docker", ["image", "inspect", image], { timeout: 10000, stdio: "ignore" });
+        }
+        catch {
+            console.log(`[openclaw] Docker image ${image} not found, starting background pull...`);
+            try {
+                const setupManager = await import("../setup-manager.js");
+                const result = setupManager.startBuildSlimOpenclawImage(image);
+                return {
+                    ok: false,
+                    error: `Docker image ${image} not found. Pull started in background.`,
+                    building: true,
+                    taskId: result.taskId,
+                };
+            }
+            catch (e) {
+                return { ok: false, error: `Docker image ${image} not available: ${e.message}` };
+            }
+        }
+    }
+    return { ok: true };
+}
+// ── createOpenclawInstance ────────────────────────────────────────────────────
+export async function createOpenclawInstance(instanceId, name, description, options) {
+    const { appSpec, cloneFrom, openclawHome: customHome, cloneOptions } = options;
+    const d = getInstanceDir(instanceId);
+    if (existsSync(d))
+        throw new Error(`Instance '${instanceId}' already exists`);
+    const home = customHome ? normalizePath(customHome) : defaultOpenclawHome(instanceId);
+    if (customHome) {
+        const resolved = resolve(home);
+        if (!resolved.startsWith(JISHUSHELL_HOME) && !resolved.startsWith("/home/")) {
+            throw new Error(`openclaw_home must be under ${JISHUSHELL_HOME} or /home/`);
+        }
+        const parentDir = dirname(resolved);
+        if (existsSync(parentDir)) {
+            const realParent = realpathSync(parentDir);
+            if (!realParent.startsWith(JISHUSHELL_HOME) && !realParent.startsWith("/home/")) {
+                throw new Error(`openclaw_home parent resolves outside allowed paths (symlink detected)`);
+            }
+        }
+        const shared = listInstances().filter((inst) => normalizePath(inst.openclaw_home || defaultOpenclawHome(inst.id)) === normalizePath(home));
+        if (shared.length) {
+            throw new Error(`OpenClaw home '${home}' is already used by instance(s): ${shared.map((i) => i.id).join(", ")}`);
+        }
+    }
+    if (existsSync(home)) {
+        try {
+            const entries = readdirSync(home);
+            if (entries.length > 0) {
+                throw new Error(`OpenClaw home directory '${home}' already exists and is not empty. Remove it manually or choose a different path.`);
+            }
+        }
+        catch (e) {
+            if (e.message.includes("not empty"))
+                throw e;
+        }
+    }
+    ensureDirContainer(d);
+    try {
+        const parentGid = statSync(INSTANCES_DIR).gid;
+        chownSync(d, -1, parentGid);
+    }
+    catch { /* non-root */ }
+    ensureDirContainer(home);
+    ensureDirContainer(join(home, OPENCLAW_STATE_DIRNAME));
+    const { runtime: baseRuntime, allocatedPort } = await buildDefaultRuntime(instanceId, home);
+    let runtime = baseRuntime;
+    if (appSpec) {
+        const serviceTask = appSpec.tasks.find((t) => t.role === "service");
+        if (serviceTask) {
+            const compiled = compileTaskRuntime(serviceTask, instanceId);
+            runtime = { ...baseRuntime, ...compiled };
+        }
+    }
+    try {
+        const meta = {
+            id: instanceId,
+            name,
+            description,
+            openclaw_home: home,
+            runtime,
+            created_at: new Date().toISOString(),
+            ...(appSpec ? { app_id: appSpec.app_id ?? appSpec.id } : {}),
+        };
+        safeWriteJson(instanceMetaPath(instanceId), meta);
+        const envFiles = (runtime.env_files || []).map((p) => normalizePath(p));
+        for (const ef of envFiles) {
+            if (!existsSync(ef))
+                writeConfigFile(ef, "");
+        }
+        try {
+            const runtimeUser = runtime.user;
+            if (runtimeUser && runtimeUser !== userInfo().username) {
+                for (const ef of envFiles) {
+                    execFileSync("chown", [runtimeUser, ef], { timeout: 5000 });
+                }
+            }
+        }
+        catch { /* ignore */ }
+        const configPath = openclawConfigPathInternal(instanceId);
+        ensureDirContainer(dirname(configPath));
+        if (cloneFrom && !existsSync(configPath)) {
+            const srcConfig = resolveExistingConfigPath(cloneFrom);
+            if (existsSync(srcConfig)) {
+                try {
+                    const cloned = JSON.parse(readFileSync(srcConfig, "utf-8"));
+                    const providers = cloned?.models?.providers;
+                    if (providers) {
+                        for (const [pid, prov] of Object.entries(providers)) {
+                            if (typeof prov?.baseUrl === "string" && prov.baseUrl.includes("/proxy/")) {
+                                delete providers[pid];
+                            }
+                        }
+                    }
+                    const dm = cloned?.agents?.defaults?.model;
+                    if (typeof dm === "string" && (dm.startsWith("jsproxy/") || dm.startsWith("js-"))) {
+                        delete cloned.agents.defaults.model;
+                    }
+                    stripImBindings(cloned);
+                    const subdirs = ["extensions", "workspace"];
+                    if (cloneOptions?.include_memory !== false) {
+                        const memDir = join(dirname(srcConfig), "memory");
+                        if (existsSync(memDir))
+                            subdirs.push("memory");
+                    }
+                    if (cloneOptions?.include_sessions) {
+                        const sessDir = join(dirname(srcConfig), "agents");
+                        if (existsSync(sessDir))
+                            subdirs.push("agents");
+                    }
+                    for (const subdir of subdirs) {
+                        const srcDir = join(dirname(srcConfig), subdir);
+                        const dstDir = join(dirname(configPath), subdir);
+                        if (existsSync(srcDir) && !existsSync(dstDir)) {
+                            try {
+                                cpSync(srcDir, dstDir, { recursive: true });
+                            }
+                            catch { /* best effort */ }
+                        }
+                    }
+                    writeConfigFile(configPath, JSON.stringify(cloned, null, 2));
+                    const srcMetaPath = join(getInstanceDir(cloneFrom), "instance.json");
+                    if (existsSync(srcMetaPath)) {
+                        try {
+                            const srcMeta = JSON.parse(readFileSync(srcMetaPath, "utf-8"));
+                            const srcXj = srcMeta?.["x-jishushell"];
+                            if (srcXj?.proxy?.upstream) {
+                                const dstXj = { proxy: { upstream: { ...srcXj.proxy.upstream } } };
+                                delete dstXj.proxy.upstream.apiKey;
+                                const metaPathDst = instanceMetaPath(instanceId);
+                                if (existsSync(metaPathDst)) {
+                                    const dstMeta = JSON.parse(readFileSync(metaPathDst, "utf-8"));
+                                    dstMeta["x-jishushell"] = dstXj;
+                                    writeConfigFile(metaPathDst, JSON.stringify(dstMeta, null, 2));
+                                }
+                            }
+                        }
+                        catch { /* ignore */ }
+                    }
+                }
+                catch {
+                    copyFileSync(srcConfig, configPath);
+                }
+            }
+        }
+        if (!existsSync(configPath)) {
+            writeConfigFile(configPath, JSON.stringify(buildStarterConfig(), null, 2));
+            const dp = getPanelConfig().default_provider;
+            if (dp?.apiKey && dp?.providerId && envFiles.length) {
+                const envKey = inferProviderApiKeyEnvName(dp.providerId);
+                updateEnvFile(envFiles[0], { [envKey]: dp.apiKey });
+                const providerEnv = join(dirname(envFiles[0]), "provider.env");
+                updateEnvFile(providerEnv, { UPSTREAM_API_KEY: dp.apiKey });
+            }
+        }
+        if (appSpec?.openclaw?.config_defaults && existsSync(configPath)) {
+            try {
+                const existing = JSON.parse(readFileSync(configPath, "utf-8"));
+                const defaults = appSpec.openclaw.config_defaults;
+                for (const [key, value] of Object.entries(defaults)) {
+                    if (typeof value === "object" && value !== null && !Array.isArray(value) && typeof existing[key] === "object" && existing[key] !== null) {
+                        existing[key] = { ...existing[key], ...value };
+                    }
+                    else {
+                        existing[key] = value;
+                    }
+                }
+                writeConfigFile(configPath, JSON.stringify(existing, null, 2));
+            }
+            catch { /* ignore */ }
+        }
+        if (appSpec?.openclaw?.skills && Array.isArray(appSpec.openclaw.skills)) {
+            try {
+                const skillsDir = join(dirname(configPath), "skills");
+                ensureDirContainer(skillsDir);
+                const skillMeta = join(skillsDir, ".app-skills.json");
+                safeWriteJson(skillMeta, { app_id: appSpec.app_id ?? appSpec.id, skills: appSpec.openclaw.skills });
+            }
+            catch { /* ignore */ }
+        }
+        if (cloneFrom && envFiles.length) {
+            const srcEnvFiles = getRuntimeEnvFiles(cloneFrom);
+            const srcEnvFile = srcEnvFiles[0];
+            const dstEnvFile = envFiles[0];
+            if (srcEnvFile) {
+                const srcProvider = join(dirname(srcEnvFile), "provider.env");
+                const dstProvider = join(dirname(dstEnvFile), "provider.env");
+                if (existsSync(srcProvider) && !existsSync(dstProvider)) {
+                    copyFileSync(srcProvider, dstProvider);
+                }
+            }
+        }
+        try {
+            const { bootstrapInstanceProxy } = await import("../llm-proxy/index.js");
+            await bootstrapInstanceProxy(instanceId);
+        }
+        catch (e) {
+            console.warn(`[openclaw] Proxy bootstrap for ${instanceId} deferred: ${e.message}`);
+        }
+        const svcUser = resolveServiceUser();
+        if (svcUser) {
+            try {
+                execFileSync("chown", ["-R", `${svcUser.uid}:${svcUser.gid}`, d], { timeout: 10_000 });
+                if (!home.startsWith(d + "/") && existsSync(home)) {
+                    execFileSync("chown", ["-R", `${svcUser.uid}:${svcUser.gid}`, home], { timeout: 10_000 });
+                }
+            }
+            catch (e) {
+                console.warn(`[openclaw] chown for ${instanceId} failed:`, e.message);
+            }
+        }
+        return meta;
+    }
+    finally {
+        releasePort(allocatedPort);
+    }
+}
+import { getOpenclawDockerImage, } from "../../config.js";
+import { DEFAULT_PIDS_LIMIT, DEFAULT_RESOURCES, DEFAULT_ARGS, DEFAULT_USER, DEFAULT_CWD, DEFAULT_ENV, MAX_CPU_MHZ, MAX_MEMORY_MB, VALID_USER_RE, resolveUidGid, normalizeDockerResources, nomadGet, nomadPut, jobId, } from "../nomad-manager.js";
+function buildOpenclawRuntime(instanceId) {
+    const runtime = getInstanceRuntime(instanceId);
+    const openclawHome = getOpenclawHome(instanceId);
+    if (runtime.user && !VALID_USER_RE.test(runtime.user)) {
+        throw new Error(`Invalid runtime user: ${runtime.user}`);
+    }
+    const command = runtime.command || "/usr/bin/openclaw";
+    let args = runtime.args;
+    if (!Array.isArray(args))
+        args = [...DEFAULT_ARGS];
+    else
+        args = args.map(String);
+    const env = { ...DEFAULT_ENV };
+    Object.assign(env, getRuntimeEnv(instanceId));
+    delete env.JSPROXY_API_KEY;
+    env.OPENCLAW_HOME = openclawHome;
+    env.OPENCLAW_INSTANCE_ID = instanceId;
+    const resources = { ...DEFAULT_RESOURCES };
+    for (const [key, value] of Object.entries(runtime.resources || {})) {
+        if (value != null)
+            resources[key] = Number(value);
+    }
+    resources.CPU = Math.max(1, Math.min(resources.CPU, MAX_CPU_MHZ));
+    resources.MemoryMB = Math.max(1, Math.min(resources.MemoryMB, MAX_MEMORY_MB));
+    return {
+        command: String(command),
+        args,
+        user: runtime.user || DEFAULT_USER,
+        cwd: runtime.cwd || DEFAULT_CWD,
+        env,
+        resources,
+        image: runtime.image ?? null,
+    };
+}
+export function buildNomadTaskOpenClaw(instanceId, runtime, safeJobId) {
+    const openclawHome = getOpenclawHome(instanceId);
+    const image = runtime.image || getOpenclawDockerImage();
+    const volumes = [`${openclawHome}:${openclawHome}:rw`];
+    const containerEnv = { ...runtime.env };
+    containerEnv.HOME = openclawHome;
+    if (!containerEnv.OPENCLAW_STATE_DIR) {
+        containerEnv.OPENCLAW_STATE_DIR = `${openclawHome}/.openclaw`;
+    }
+    containerEnv.npm_config_prefix = `${openclawHome}/.npm-global`;
+    containerEnv.PIP_USER = "1";
+    containerEnv.PYTHONUSERBASE = `${openclawHome}/.local`;
+    containerEnv.NODE_ENV = "production";
+    containerEnv.NODE_PATH = [
+        `${openclawHome}/.npm-global/lib/node_modules`,
+        "/app/node_modules",
+    ].join(":");
+    containerEnv.PATH = [
+        `${openclawHome}/.npm-global/bin`,
+        `${openclawHome}/.local/bin`,
+        `${openclawHome}/go/bin`,
+        `${openclawHome}/.cargo/bin`,
+        "/usr/local/sbin",
+        "/usr/local/bin",
+        "/usr/sbin",
+        "/usr/bin",
+        "/sbin",
+        "/bin",
+    ].join(":");
+    const runtimeArgs = [...(runtime.args || [])];
+    const gatewayPort = getGatewayPort(instanceId);
+    const normalizedResources = normalizeDockerResources(instanceId, runtime);
+    return {
+        Name: "gateway",
+        Driver: "docker",
+        User: resolveUidGid(runtime.user),
+        Config: {
+            image,
+            force_pull: false,
+            args: runtimeArgs,
+            work_dir: openclawHome,
+            volumes,
+            extra_hosts: ["host.docker.internal:host-gateway"],
+            cap_drop: ["ALL"],
+            security_opt: ["no-new-privileges"],
+            pids_limit: DEFAULT_PIDS_LIMIT,
+            readonly_rootfs: true,
+            mounts: [
+                { type: "tmpfs", target: "/tmp", tmpfs_options: { size: 536870912 } },
+                { type: "tmpfs", target: "/var/tmp", tmpfs_options: { size: 67108864 } },
+                { type: "tmpfs", target: "/run", tmpfs_options: { size: 52428800 } },
+            ],
+        },
+        Env: containerEnv,
+        Resources: {
+            ...normalizedResources,
+            Networks: [{ ReservedPorts: [{ Label: "gateway", Value: gatewayPort }] }],
+        },
+        LogConfig: { MaxFiles: 3, MaxFileSizeMB: 10 },
+        Templates: [{
+                DestPath: "secrets/instance.env",
+                Envvars: true,
+                EmbeddedTmpl: [
+                    `{{ if nomadVarExists "nomad/jobs/${safeJobId}/openclaw/gateway" }}`,
+                    `JSPROXY_API_KEY={{ with nomadVar "nomad/jobs/${safeJobId}/openclaw/gateway" }}{{ .JSPROXY_API_KEY }}{{ end }}`,
+                    `{{ end }}`,
+                ].join("\n"),
+                ChangeMode: "restart",
+            }],
+    };
+}
+export async function writeNomadSecretsOpenClaw(instanceId) {
+    const jid = jobId(instanceId);
+    const ns = "default";
+    const varPath = `nomad/jobs/${jid}/openclaw/gateway`;
+    const encodedPath = encodeURIComponent(varPath);
+    const env = getRuntimeEnv(instanceId);
+    const proxyToken = env.JSPROXY_API_KEY || "";
+    if (!proxyToken)
+        return;
+    const items = { JSPROXY_API_KEY: proxyToken };
+    const MAX_ATTEMPTS = 3;
+    for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+        let cas = 0;
+        try {
+            const existing = await nomadGet(`/v1/var/${encodedPath}?namespace=${ns}`);
+            if (existing.ok) {
+                const data = await existing.json();
+                cas = data.ModifyIndex || 0;
+            }
+        }
+        catch { /* variable may not exist yet — cas=0 creates a new one */ }
+        const resp = await nomadPut(`/v1/var/${encodedPath}?cas=${cas}&namespace=${ns}`, {
+            Namespace: ns,
+            Path: varPath,
+            Items: items,
+        });
+        if (resp.ok)
+            return;
+        const text = await resp.text();
+        if (resp.status === 409 && attempt < MAX_ATTEMPTS - 1) {
+            await new Promise(r => setTimeout(r, 100 * Math.pow(2, attempt)));
+            continue;
+        }
+        throw new Error(`Failed to write Nomad Variables for ${instanceId}` +
+            ` (attempt ${attempt + 1}/${MAX_ATTEMPTS}): HTTP ${resp.status} ${text}`);
+    }
+}
+// ── AppTypeManager export ──────────────────────────────────────────────────
+export const openclawManager = {
+    appType: "openclaw",
+    createInstance: createOpenclawInstance,
+    prepareStart: prepareStartOpenClaw,
+    writeNomadSecrets: writeNomadSecretsOpenClaw,
+    buildNomadTask: buildNomadTaskOpenClaw,
+    nomadTaskGroupName: () => "openclaw",
+    buildRuntime: buildOpenclawRuntime,
+};
+//# sourceMappingURL=openclaw-manager.js.map