jishushell 0.4.10 → 0.4.24

package/apps/ollama-with-hollama-binary.yaml

@@ -0,0 +1,195 @@
+id: ollama-with-hollama-binary
+name: Ollama
+version: "1.0.0"
+jishushell:
+  min_version: "0.4.24"
+description: "通过官方脚本安装并运行 Ollama，同时提供 Hollama Web UI。"
+singleInstance: true
+
+tasks:
+  - name: gateway
+    role: service
+    runtime: process
+    command: /usr/local/bin/ollama
+    args: ["serve"]
+    env:
+      OLLAMA_HOST: "0.0.0.0:11434"
+    resources:
+      cpu: "2000m"
+      memory: "4096Mi"
+    ports:
+      - name: gateway
+        port: 11434
+        visibility: external
+    health:
+      http:
+        path: /api/version
+        port: 11434
+      interval: "15s"
+      timeout: "5s"
+      retries: 3
+      start_period: "30s"
+
+  - name: hollama
+    role: sidecar
+    runtime: container
+    image: "ghcr.io/fmaclen/hollama:latest"
+    resources:
+      cpu: "500m"
+      memory: "512Mi"
+    ports:
+      - name: webui
+        port: 4173
+        visibility: external
+    health:
+      http:
+        path: /
+        port: 4173
+      interval: "15s"
+      timeout: "5s"
+      retries: 6
+      start_period: "30s"
+
+provides:
+  - capability: "hollama-web"
+    port: 4173
+    protocol: "http"
+    description: "Hollama Web 界面"
+  - capability: "ollama-api"
+    port: 11434
+    protocol: "http"
+    description: "Ollama HTTP API，兼容 OpenAI /v1/chat/completions 端点"
+
+lifecycle:
+  pre_install:
+    - run: >-
+        if ! command -v ollama >/dev/null 2>&1; then
+          echo "未检测到 ollama 命令，将通过官方脚本安装 Ollama..." >&2;
+        else
+          echo "检测到系统中已安装 ollama，跳过安装步骤，直接使用系统版本。" >&2;
+        fi;
+  install:
+    - downloadImage: "ghcr.io/fmaclen/hollama:latest"
+    - run: >-
+        if ! command -v ollama >/dev/null 2>&1; then
+          echo "未检测到 ollama，开始安装..." >&2;
+          if [ "$(id -u)" -ne 0 ]; then
+            if ! command -v sudo >/dev/null 2>&1; then
+              echo "未检测到 sudo，当前环境无法自动安装 Ollama。请以 root 身份重试。" >&2;
+              exit 1;
+            fi;
+            if [ -n "${JISHUSHELL_SUDO_ASKPASS:-}" ]; then
+              sudo_probe_output="$(sudo -A true 2>&1)" || {
+                if printf '%s\n' "$sudo_probe_output" | grep -qi "no new privileges"; then
+                  echo "当前运行环境禁止 sudo 提权（no new privileges），无法自动安装 Ollama。请在系统终端手动安装，或调整容器/服务配置后重试。" >&2;
+                else
+                  echo "提供的 sudo 密码无效，无法安装 Ollama。" >&2;
+                fi;
+                exit 1;
+              };
+              run_as_root() { sudo -A "$@"; };
+            else
+              sudo_probe_output="$(sudo -n true 2>&1)" || {
+                if printf '%s\n' "$sudo_probe_output" | grep -qi "no new privileges"; then
+                  echo "当前运行环境禁止 sudo 提权（no new privileges），无法自动安装 Ollama。请在系统终端手动安装，或调整容器/服务配置后重试。" >&2;
+                else
+                  echo "安装 Ollama 需要 sudo 密码；请在页面弹窗中输入后重试。" >&2;
+                fi;
+                exit 1;
+              };
+              run_as_root() { sudo -n "$@"; };
+            fi;
+          else
+            run_as_root() { "$@"; };
+          fi;
+          for BINDIR in /usr/local/bin /usr/bin /bin; do
+            echo "$PATH" | grep -q "$BINDIR" && break || continue;
+          done;
+          OLLAMA_INSTALL_DIR="$(dirname "${BINDIR:-/usr/local/bin}")";
+          if [ -d "$OLLAMA_INSTALL_DIR/lib/ollama" ]; then
+            old_dir="$OLLAMA_INSTALL_DIR/lib/ollama.jishushell-old-$(date +%s)";
+            echo "检测到旧版 Ollama 目录，先移动到 $old_dir 以避免长时间卡在清理步骤..." >&2;
+            run_as_root mv "$OLLAMA_INSTALL_DIR/lib/ollama" "$old_dir";
+            ( run_as_root rm -rf "$old_dir" >/dev/null 2>&1 || true ) &
+          fi;
+          curl -fsSL https://ollama.com/install.sh | run_as_root sh;
+        else
+          echo "检测到系统中已安装 ollama，跳过二进制安装。" >&2;
+        fi
+      timeout_ms: 900000
+      successIfCommandExists: "ollama"
+    - run: >-
+        case "$(uname -s)" in
+          Linux)
+            if command -v systemctl >/dev/null 2>&1 && systemctl list-unit-files ollama.service >/dev/null 2>&1; then
+              echo "停止并禁用 ollama.service，后续交由 Nomad 管理..." >&2;
+              if [ "$(id -u)" -eq 0 ]; then
+                run_as_root() { "$@"; };
+              elif [ -n "${JISHUSHELL_SUDO_ASKPASS:-}" ]; then
+                sudo_probe_output="$(sudo -A true 2>&1)" || {
+                  if printf '%s\n' "$sudo_probe_output" | grep -qi "no new privileges"; then
+                    echo "当前运行环境禁止 sudo 提权（no new privileges），无法清理 ollama.service。请在系统终端手动执行后重试。" >&2;
+                  else
+                    echo "提供的 sudo 密码无效，无法清理 ollama.service。" >&2;
+                  fi;
+                  exit 1;
+                };
+                run_as_root() { sudo -A "$@"; };
+              elif command -v sudo >/dev/null 2>&1; then
+                run_as_root() { sudo -n "$@"; };
+              else
+                run_as_root() { "$@"; };
+              fi;
+              run_as_root systemctl disable --now ollama;
+            else
+              echo "Linux 环境未检测到 ollama.service，跳过 systemd 清理。" >&2;
+            fi
+            ;;
+          Darwin)
+            echo "macOS 环境尝试关闭 Ollama 自启与正在运行的进程..." >&2;
+            if command -v launchctl >/dev/null 2>&1; then
+              launchctl bootout "gui/$(id -u)"/com.ollama.ollama 2>/dev/null || true;
+              launchctl disable "gui/$(id -u)/com.ollama.ollama" 2>/dev/null || true;
+            fi;
+            osascript -e 'tell application "Ollama" to quit' >/dev/null 2>&1 || true;
+            pkill -TERM -x ollama 2>/dev/null || true;
+            pkill -TERM -x Ollama 2>/dev/null || true
+            ;;
+          *)
+            echo "当前平台不支持自动清理 Ollama 自启，跳过。" >&2
+            ;;
+        esac
+
+  uninstall:
+    - run: >-
+        if [ "$(id -u)" -ne 0 ]; then
+          if ! command -v sudo >/dev/null 2>&1; then
+            echo "当前环境未检测到 sudo，无法卸载 Ollama。请以 root 身份重试。" >&2;
+            exit 1;
+          fi;
+          if [ -n "${JISHUSHELL_SUDO_ASKPASS:-}" ]; then
+            sudo_probe_output="$(sudo -A true 2>&1)" || {
+              if printf '%s\n' "$sudo_probe_output" | grep -qi "no new privileges"; then
+                echo "当前运行环境禁止 sudo 提权（no new privileges），无法卸载 Ollama。请在系统终端手动执行，或调整容器/服务配置后重试。" >&2;
+              else
+                echo "提供的 sudo 密码无效，无法卸载 Ollama。" >&2;
+              fi;
+              exit 1;
+            };
+            run_as_root() { sudo -A "$@"; };
+          else
+            sudo_probe_output="$(sudo -n true 2>&1)" || {
+              if printf '%s\n' "$sudo_probe_output" | grep -qi "no new privileges"; then
+                echo "当前运行环境禁止 sudo 提权（no new privileges），无法卸载 Ollama。请在系统终端手动执行，或调整容器/服务配置后重试。" >&2;
+              else
+                echo "卸载 Ollama 需要 sudo 密码；请在页面弹窗中输入后重试。" >&2;
+              fi;
+              exit 1;
+            };
+            run_as_root() { sudo -n "$@"; };
+          fi;
+        else
+          run_as_root() { "$@"; };
+        fi;
+        run_as_root rm -f /usr/local/bin/ollama /usr/bin/ollama /bin/ollama;
+        run_as_root rm -rf /usr/local/lib/ollama /usr/lib/ollama /usr/share/ollama 2>/dev/null || true

package/apps/openclaw-binary.yaml

@@ -0,0 +1,69 @@
+id: openclaw-binary
+name: OpenClaw Binary
+version: "1.0.0"
+jishushell:
+  min_version: "0.4.24"
+agentType: openclaw
+description: "将 OpenClaw 安装到应用目录内的 npm prefix，并以 process runtime 运行网关"
+singleInstance: false
+
+tasks:
+  - name: gateway
+    role: service
+    runtime: process
+    command: ~/.jishushell/apps/${app_id}/bin/openclaw
+    args: ["gateway", "run", "--port", "18789", "--allow-unconfigured"]
+    env:
+      NODE_ENV: production
+    resources:
+      cpu: "1000m"
+      memory: "2024Mi"
+    ports:
+      - name: http
+        port: 18789
+        visibility: external
+    health:
+      http:
+        path: /health
+        port: 18789
+      interval: "15s"
+      timeout: "5s"
+      retries: 3
+      start_period: "30s"
+
+provides:
+  - capability: "openclaw-dashboard"
+    port: 18789
+    description: "OpenClaw Dashboard"
+
+lifecycle:
+  install:
+    - mkdir: "~/.jishushell/apps/${app_id}/runtime"
+    - mkdir: "~/.jishushell/apps/${app_id}/bin"
+    - mkdir: "~/.jishushell/apps/${app_id}/openclaw-home"
+    - run: >-
+        runtime_dir="$HOME/.jishushell/apps/${app_id}/runtime";
+        pkg_entry="$runtime_dir/lib/node_modules/openclaw/openclaw.mjs";
+        if [ -f "$pkg_entry" ]; then
+          echo "检测到应用目录中已安装 OpenClaw，跳过 npm 安装。" >&2;
+        else
+          npm install -g --prefix "$runtime_dir" openclaw@latest;
+        fi
+      timeout_ms: 900000
+    - run: >-
+        runtime_dir="$HOME/.jishushell/apps/${app_id}/runtime";
+        wrapper_dir="$HOME/.jishushell/apps/${app_id}/bin";
+        openclaw_home="$HOME/.jishushell/apps/${app_id}/openclaw-home";
+        pkg_entry="$runtime_dir/lib/node_modules/openclaw/openclaw.mjs";
+        wrapper="$wrapper_dir/openclaw";
+        node_bin="$(command -v node)";
+        if [ -z "$node_bin" ]; then
+          echo "未检测到 node，可执行 OpenClaw wrapper 创建失败。" >&2;
+          exit 1;
+        fi;
+        if [ ! -f "$pkg_entry" ]; then
+          echo "未找到 OpenClaw 入口文件: $pkg_entry" >&2;
+          exit 1;
+        fi;
+        printf '%s\n' '#!/bin/sh' "export OPENCLAW_HOME=\"$openclaw_home\"" "export HOME=\"$openclaw_home\"" "exec \"$node_bin\" \"$pkg_entry\" \"\$@\"" > "$wrapper";
+        chmod +x "$wrapper"

package/apps/openclaw-container.yaml

@@ -0,0 +1,37 @@
+id: openclaw-container
+name: OpenClaw Container
+version: "1.0.0"
+jishushell:
+  min_version: "0.4.24"
+agentType: openclaw
+description: "基于 openclaw-runtime 容器运行的 OpenClaw 网关"
+singleInstance: false
+
+tasks:
+  - name: gateway
+    role: service
+    runtime: container
+    image: "ghcr.io/x-aijishu/openclaw-runtime:latest"
+    args: ["gateway", "run", "--port", "18789", "--allow-unconfigured"]
+    env:
+      NODE_ENV: production
+    resources:
+      cpu: "1000m"
+      memory: "2024Mi"
+    ports:
+      - name: http
+        port: 18789
+        visibility: external
+    health:
+      http:
+        path: /health
+        port: 18789
+      interval: "15s"
+      timeout: "5s"
+      retries: 3
+      start_period: "30s"
+
+provides:
+  - capability: "openclaw-dashboard"
+    port: 18789
+    description: "OpenClaw Dashboard"

package/apps/openclaw-with-ollama-container.yaml

@@ -0,0 +1,42 @@
+id: openclaw-with-ollama-container
+name: OpenClaw With Ollama
+version: "1.0.0"
+jishushell:
+  min_version: "0.4.24"
+agentType: openclaw
+description: "通过 requires 消费 ollama-api 能力，并将解析地址注入 OpenClaw 运行环境"
+singleInstance: false
+
+requires:
+  - capability: "ollama-api"
+    inject_as: OLLAMA_API_ADDR
+
+tasks:
+  - name: gateway
+    role: service
+    runtime: container
+    image: "ghcr.io/x-aijishu/openclaw-runtime:latest"
+    args: ["gateway", "run", "--port", "18789", "--allow-unconfigured"]
+    env:
+      NODE_ENV: production
+      OLLAMA_BASE_URL: "http://${requires.OLLAMA_API_ADDR}"
+    resources:
+      cpu: "1000m"
+      memory: "1024Mi"
+    ports:
+      - name: http
+        port: 18789
+        visibility: external
+    health:
+      http:
+        path: /health
+        port: 18789
+      interval: "15s"
+      timeout: "5s"
+      retries: 3
+      start_period: "30s"
+
+provides:
+  - capability: "openclaw-dashboard"
+    port: 18789
+    description: "OpenClaw Dashboard"

package/apps/openclaw-with-searxng-container.yaml

@@ -0,0 +1,136 @@
+id: openclaw-with-searxng-container
+name: OpenClaw With SearXNG Container
+version: "1.0.0"
+jishushell:
+  min_version: "0.4.24"
+agentType: openclaw
+description: "将 SearXNG 作为 sidecar 子 task 安装并运行，并注入 OpenClaw 搜索环境"
+singleInstance: false
+
+tasks:
+  - name: searxng
+    role: sidecar
+    runtime: container
+    image: "searxng/searxng:latest"
+    env:
+      SEARXNG_PORT: "8080"
+      SEARXNG_BASE_URL: "http://localhost:8080/"
+      FORCE_OWNERSHIP: "false"
+    resources:
+      cpu: "500m"
+      memory: "512Mi"
+    ports:
+      - name: http
+        port: 8080
+        visibility: internal
+    volumes:
+      - source: "~/.jishushell/apps/${app_id}/settings/settings.yml"
+        target: "/etc/searxng/settings.yml"
+        readonly: true
+      - source: "~/.jishushell/apps/${app_id}/settings/limiter.toml"
+        target: "/etc/searxng/limiter.toml"
+        readonly: true
+    health:
+      http:
+        path: /healthz
+        port: 8080
+      interval: "15s"
+      timeout: "5s"
+      retries: 3
+      start_period: "30s"
+
+  - name: gateway
+    role: service
+    runtime: container
+    image: "ghcr.io/x-aijishu/openclaw-runtime:latest"
+    args: ["gateway", "run", "--port", "18789", "--allow-unconfigured"]
+    env:
+      NODE_ENV: production
+      SEARCH_API_BASE_URL: "http://127.0.0.1:8080/search"
+    resources:
+      cpu: "1000m"
+      memory: "1024Mi"
+    ports:
+      - name: http
+        port: 18789
+        visibility: external
+    health:
+      http:
+        path: /health
+        port: 18789
+      interval: "15s"
+      timeout: "5s"
+      retries: 3
+      start_period: "30s"
+
+provides:
+  - capability: "openclaw-dashboard"
+    port: 18789
+    description: "OpenClaw Dashboard"
+
+lifecycle:
+  install:
+    - downloadImage: "searxng/searxng:latest"
+    - mkdir: "~/.jishushell/apps/${app_id}/settings"
+    - run: |
+        SETTINGS_DIR="$HOME/.jishushell/apps/${app_id}/settings"
+        SECRET_KEY="$(head -c 48 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' | head -c 32)"
+
+        export SETTINGS_DIR SECRET_KEY
+        python3 <<'PY'
+        from pathlib import Path
+        import os
+        from textwrap import dedent
+
+        settings_dir = Path(os.environ["SETTINGS_DIR"])
+        secret = os.environ["SECRET_KEY"]
+
+        (settings_dir / "settings.yml").write_text(
+            dedent(
+                f'''
+                use_default_settings:
+                  engines:
+                    remove:
+                      - ahmia
+                      - torch
+                      - wikidata
+                server:
+                  secret_key: "{secret}"
+                  port: 8080
+                  bind_address: "0.0.0.0"
+                  limiter: false
+                search:
+                  formats:
+                    - html
+                    - json
+                '''
+            ).lstrip(),
+            encoding="utf-8",
+        )
+
+        (settings_dir / "limiter.toml").write_text(
+            dedent(
+                '''
+                [botdetection]
+                ipv4_prefix = 32
+                ipv6_prefix = 48
+                trusted_proxies = [
+                  "127.0.0.0/8",
+                  "::1",
+                ]
+
+                [botdetection.ip_limit]
+                filter_link_local = false
+                link_token = false
+
+                [botdetection.ip_lists]
+                block_ip = []
+                pass_ip = []
+                pass_searxng_org = true
+                '''
+            ).lstrip(),
+            encoding="utf-8",
+        )
+        PY
+
+        chmod 644 "$SETTINGS_DIR/settings.yml" "$SETTINGS_DIR/limiter.toml"

package/apps/openwebui-container.yaml

@@ -0,0 +1,53 @@
+id: openwebui-container
+name: Open WebUI
+version: "1.0.0"
+jishushell:
+  min_version: "0.4.24"
+description: "使用 Open WebUI 提供自托管的大模型 Web 界面，容器模式由 Nomad 管理生命周期"
+singleInstance: false
+
+tasks:
+  - name: openwebui
+    role: service
+    runtime: container
+    image: "ghcr.io/open-webui/open-webui:main"
+    env:
+      HOME: "/app/backend/data"
+      PORT: "8080"
+      TMPDIR: "/app/backend/data/tmp"
+      XDG_CACHE_HOME: "/app/backend/data/.cache"
+      HF_HOME: "/app/backend/data/.cache/huggingface"
+      TRANSFORMERS_CACHE: "/app/backend/data/.cache/huggingface/transformers"
+      SENTENCE_TRANSFORMERS_HOME: "/app/backend/data/.cache/sentence-transformers"
+    resources:
+      cpu: "1000m"
+      memory: "1024Mi"
+    ports:
+      - name: http
+        port: 3000
+        container_port: 8080
+        visibility: external
+    volumes:
+      - source: "~/.jishushell/apps/${app_id}/data"
+        target: "/app/backend/data"
+    health:
+      http:
+        path: /
+        port: 8080
+      interval: "15s"
+      timeout: "5s"
+      retries: 6
+      start_period: "40s"
+
+provides:
+  - capability: "openwebui-web"
+    port: 3000
+    protocol: "http"
+    description: "Open WebUI Web 界面"
+
+lifecycle:
+  install:
+    - downloadImage: "ghcr.io/open-webui/open-webui:main"
+    - mkdir: "~/.jishushell/apps/${app_id}/data"
+    - mkdir: "~/.jishushell/apps/${app_id}/data/tmp"
+    - mkdir: "~/.jishushell/apps/${app_id}/data/.cache"

package/apps/playwright-container.yaml

@@ -0,0 +1,120 @@
+id: playwright-container
+name: Playwright
+version: "1.0.0"
+jishushell:
+  min_version: "0.4.24"
+description: "在容器中启动 Playwright UI，通过浏览器查看和管理测试运行"
+singleInstance: false
+
+tasks:
+  - name: playwright-ui
+    role: service
+    runtime: container
+    image: "mcr.microsoft.com/playwright:v1.55.0-noble"
+    env:
+      HOME: "/tmp/playwright-home"
+      NPM_CONFIG_CACHE: "/tmp/playwright-home/.npm"
+    command: /bin/sh
+    args:
+      - -lc
+      # 1. Stub xdg-open so playwright UI's auto-browser-open attempt doesn't
+      #    throw "spawn xdg-open ENOENT" on a headless container (unhandled
+      #    error kills the Node process before the UI server is reachable).
+      # 2. Invoke cli.js via `node` directly: `npx --no-install playwright`
+      #    resolves to node_modules/.bin/playwright -> ../@playwright/test/cli.js,
+      #    and a host-side `npm install --prefix` sometimes skips the +x bit
+      #    on that target. Going through node sidesteps the exec-bit dance.
+      # 3. `--ui` makes the intent explicit; `--ui-host`/`--ui-port` alone
+      #    leave behaviour at the mercy of playwright CLI detection.
+      - >-
+        ln -sf /bin/true /usr/local/bin/xdg-open 2>/dev/null;
+        cd /workspace &&
+        exec node ./node_modules/@playwright/test/cli.js test
+        --ui --ui-host=0.0.0.0 --ui-port=14567
+    resources:
+      cpu: "1000m"
+      memory: "1024Mi"
+    ports:
+      - name: http
+        port: 14567
+        visibility: external
+    volumes:
+      - source: "~/.jishushell/apps/${app_id}/workspace"
+        target: "/workspace"
+    health:
+      http:
+        path: /
+        port: 14567
+      interval: "15s"
+      timeout: "5s"
+      retries: 6
+      start_period: "30s"
+
+provides:
+  - capability: "playwright-ui"
+    port: 14567
+    protocol: "http"
+    description: "Playwright UI Web 界面"
+
+lifecycle:
+  install:
+    - downloadImage: "mcr.microsoft.com/playwright:v1.55.0-noble"
+    - mkdir: "~/.jishushell/apps/${app_id}/workspace"
+    - mkdir: "~/.jishushell/apps/${app_id}/workspace/tests"
+    - run: |
+        WORKSPACE="$HOME/.jishushell/apps/${app_id}/workspace"
+
+        if [ ! -f "$WORKSPACE/package.json" ]; then
+          cat > "$WORKSPACE/package.json" <<'EOF'
+        {
+          "name": "playwright-ui-workspace",
+          "private": true
+        }
+        EOF
+        fi
+
+        if [ ! -f "$WORKSPACE/playwright.config.ts" ]; then
+          cat > "$WORKSPACE/playwright.config.ts" <<'EOF'
+        import { defineConfig } from '@playwright/test';
+
+        export default defineConfig({
+          testDir: './tests',
+          use: {
+            headless: true,
+          },
+        });
+        EOF
+        fi
+
+        if [ ! -f "$WORKSPACE/tests/example.spec.ts" ]; then
+          cat > "$WORKSPACE/tests/example.spec.ts" <<'EOF'
+        import { test, expect } from '@playwright/test';
+
+        test('homepage smoke', async ({ page }) => {
+          await page.goto('https://example.com');
+          await expect(page).toHaveTitle(/Example Domain/);
+        });
+        EOF
+        fi
+    - run: |
+        WORKSPACE="$HOME/.jishushell/apps/${app_id}/workspace"
+        PLAYWRIGHT_HOME="/tmp/playwright-home"
+
+        if [ ! -d "$WORKSPACE/node_modules/@playwright/test" ]; then
+          mkdir -p "$PLAYWRIGHT_HOME"
+          export HOME="$PLAYWRIGHT_HOME"
+          export NPM_CONFIG_CACHE="$PLAYWRIGHT_HOME/.npm"
+          npm install --prefix "$WORKSPACE" @playwright/test
+        fi
+
+        # npm install --prefix on the host side occasionally leaves the
+        # playwright CLI targets without +x (the bin symlink exists, but
+        # kernel exec on the target file fails). Re-assert here so both
+        # `npx playwright` and the bin-direct path work.
+        for cli in \
+          "$WORKSPACE/node_modules/@playwright/test/cli.js" \
+          "$WORKSPACE/node_modules/playwright-core/cli.js" \
+          "$WORKSPACE/node_modules/playwright/cli.js"; do
+          [ -f "$cli" ] && chmod +x "$cli"
+        done
+      timeout_ms: 900000