jishushell 0.4.17 → 0.4.24-beta.2

package/dist/services/agent-apps/installers/adapter.js

@@ -0,0 +1,171 @@
+/**
+ * Installer strategy for adapter-backed agent apps (hermes, openclaw).
+ *
+ * Delegates install to `adapter.startBuildRuntimeImage` (preferred when
+ * present — openclaw builds its image locally) or
+ * `adapter.startInstallRuntime` (hermes pulls from GHCR). Uninstall runs
+ * locally here (docker image rm + clear runtime_catalog + drop shim).
+ *
+ * Probe + cache logic lives in `adapter-probes.ts`; this file re-exports
+ * the probes so callers import one entry point.
+ */
+import { execFile } from "child_process";
+import { existsSync, rmSync } from "fs";
+import { promisify } from "util";
+import { HERMES_RUNTIME_DIR, getPanelConfig, savePanelConfig, } from "../../../config.js";
+import { listInstances } from "../../app/app-manager.js";
+import { getAdapter, hasAdapter, resolveAgentType } from "../../runtime/index.js";
+import { createTask, emitTask, getRunningTasks, } from "../../task-registry.js";
+import { resolveAdapterImage } from "./adapter-probes.js";
+const execFileAsync = promisify(execFile);
+export { forceRefreshAllAdapterUpdates, getUpdateCacheLastCheckedAt, probeAdapterImageSizeMB, probeAdapterStatus, probeAdapterUpdateAvailable, resolveAdapterImage, } from "./adapter-probes.js";
+// ── Dispatch: install ───────────────────────────────────────────────────
+export async function startAdapterInstall(agentType, options = {}) {
+    if (!hasAdapter(agentType)) {
+        return { ok: false, error: `Unknown agentType "${agentType}"` };
+    }
+    // Reject install while uninstall is running — they are destructive of
+    // each other. Names are disjoint (`uninstall-${agentType}` vs
+    // `${agentType}` / `${agentType}-*`), so this check can't match an
+    // install task.
+    if (getRunningTasks(`uninstall-${agentType}`).length > 0) {
+        return {
+            ok: false,
+            error: `${agentType} 正在卸载，请等待卸载完成后再安装`,
+        };
+    }
+    // Dedup: if a task for this agent is already running (Setup wizard, or
+    // the user clicked install twice), join it instead of starting a second.
+    // Adapters use prefix-based names (`openclaw`, `openclaw-docker-pull`,
+    // `hermes`), so a prefix match matches install variants but — by design
+    // — cannot match `uninstall-${agentType}`.
+    const existing = getRunningTasks(agentType);
+    if (existing.length > 0) {
+        return {
+            ok: true,
+            taskId: existing[0].id,
+            reused: true,
+            message: `${agentType} install already in progress`,
+        };
+    }
+    const adapter = getAdapter(agentType);
+    let result;
+    if (typeof adapter.startBuildRuntimeImage === "function") {
+        result = await adapter.startBuildRuntimeImage(options);
+    }
+    else if (typeof adapter.startInstallRuntime === "function") {
+        result = adapter.startInstallRuntime(options);
+    }
+    else {
+        return { ok: false, error: `Runtime "${agentType}" does not implement install` };
+    }
+    if (result && typeof result === "object") {
+        return {
+            ok: result.ok !== false,
+            taskId: result.taskId,
+            message: result.message,
+            error: result.ok === false ? (result.error || result.message) : undefined,
+        };
+    }
+    return { ok: false, error: "Adapter returned an unexpected install result" };
+}
+// ── Dispatch: uninstall ─────────────────────────────────────────────────
+export function startAdapterUninstall(agentType) {
+    if (!hasAdapter(agentType)) {
+        return { ok: false, error: `Unknown agentType "${agentType}"` };
+    }
+    // Reject uninstall while install/update is in flight — we don't want to
+    // yank the docker image out from under a running docker pull.
+    if (getRunningTasks(agentType).length > 0) {
+        return {
+            ok: false,
+            error: `${agentType} 正在安装/更新，请等待完成后再卸载`,
+        };
+    }
+    // Uninstall dedup: second uninstall clicks within the window join nothing
+    // — we just tell the user it's already running.
+    if (getRunningTasks(`uninstall-${agentType}`).length > 0) {
+        return {
+            ok: false,
+            error: `${agentType} 卸载已在进行中`,
+        };
+    }
+    const image = resolveAdapterImage(agentType);
+    const task = createTask(`uninstall-${agentType}`);
+    (async () => {
+        try {
+            emitTask(task, { type: "progress", message: `准备卸载 ${agentType}...`, progress: 0 });
+            if (image) {
+                emitTask(task, { type: "progress", message: `删除 docker 镜像: ${image}`, progress: 30 });
+                try {
+                    await execFileAsync("docker", ["image", "rm", "-f", image], {
+                        timeout: 30_000, encoding: "utf-8",
+                    });
+                    emitTask(task, { type: "log", message: "docker image rm 成功" });
+                }
+                catch (e) {
+                    emitTask(task, {
+                        type: "log",
+                        message: `docker image rm 失败（可能镜像不存在）: ${e.message || e}`,
+                    });
+                }
+            }
+            else {
+                emitTask(task, { type: "log", message: "未找到镜像引用，跳过 docker image rm" });
+            }
+            emitTask(task, { type: "progress", message: "清理 runtime_catalog...", progress: 70 });
+            const config = getPanelConfig();
+            if (config.runtime_catalog && typeof config.runtime_catalog === "object") {
+                delete config.runtime_catalog[agentType];
+                savePanelConfig(config);
+            }
+            if (agentType === "hermes") {
+                emitTask(task, { type: "progress", message: "清理 Hermes shim 目录...", progress: 85 });
+                try {
+                    if (existsSync(HERMES_RUNTIME_DIR)) {
+                        rmSync(HERMES_RUNTIME_DIR, { recursive: true, force: true });
+                    }
+                }
+                catch (e) {
+                    emitTask(task, { type: "log", message: `shim 目录清理失败: ${e.message || e}` });
+                }
+            }
+            emitTask(task, { type: "done", message: `${agentType} 卸载完成`, progress: 100 });
+            task.status = "done";
+        }
+        catch (e) {
+            emitTask(task, { type: "error", message: `卸载失败: ${e?.message || e}` });
+            task.status = "error";
+        }
+    })();
+    return { ok: true, taskId: task.id };
+}
+// ── Helpers consumed by routes/index layer ──────────────────────────────
+/**
+ * Current running task for this agentType. Returns both the id and the
+ * kind so the UI can render "安装中" vs "卸载中" from one field instead
+ * of having to guess from task name shape.
+ *
+ * Install tasks match by prefix (`openclaw`, `openclaw-docker-pull`,
+ * `hermes`). Uninstall tasks use the disjoint `uninstall-${agentType}`
+ * name so no prefix collision is possible.
+ */
+export function findRunningAdapterTask(agentType) {
+    const install = getRunningTasks(agentType)[0];
+    if (install)
+        return { id: install.id, kind: "install" };
+    const uninstall = getRunningTasks(`uninstall-${agentType}`)[0];
+    if (uninstall)
+        return { id: uninstall.id, kind: "uninstall" };
+    return undefined;
+}
+/** Count live instances bound to this agentType — used to block uninstall. */
+export function countInstancesUsingAgentType(agentType) {
+    let count = 0;
+    for (const meta of listInstances()) {
+        if (resolveAgentType(meta) === agentType)
+            count += 1;
+    }
+    return count;
+}
+//# sourceMappingURL=adapter.js.map

package/dist/services/agent-apps/installers/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../../src/services/agent-apps/installers/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EACL,UAAU,EACV,QAAQ,EACR,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,uBAAuB,EACvB,kBAAkB,EAClB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,2EAA2E;AAE3E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,UAA+B,EAAE;IAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,SAAS,GAAG,EAAE,CAAC;IAClE,CAAC;IAED,sEAAsE;IACtE,8DAA8D;IAC9D,mEAAmE;IACnE,gBAAgB;IAChB,IAAI,eAAe,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,SAAS,mBAAmB;SACvC,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,GAAG,SAAS,8BAA8B;SACpD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,MAAW,CAAC;IAChB,IAAI,OAAO,OAAO,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;QACzD,MAAM,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;SAAM,IAAI,OAAO,OAAO,CAAC,mBAAmB,KAAK,UAAU,EAAE,CAAC;QAC7D,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,SAAS,8BAA8B,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;AAC/E,CAAC;AAED,2EAA2E;AAE3E,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,SAAS,GAAG,EAAE,CAAC;IAClE,CAAC;IACD,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,SAAS,oBAAoB;SACxC,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,gDAAgD;IAChD,IAAI,eAAe,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,SAAS,UAAU;SAC9B,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC;IAClD,CAAC,KAAK,IAAI,EAAE;QACV,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,SAAS,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;YAEnF,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACtF,IAAI,CAAC;oBACH,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE;wBAC1D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;qBACnC,CAAC,CAAC;oBACH,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBACjE,CAAC;gBAAC,OAAO,CAAM,EAAE,CAAC;oBAChB,QAAQ,CAAC,IAAI,EAAE;wBACb,IAAI,EAAE,KAAK;wBACX,OAAO,EAAE,gCAAgC,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE;qBAC1D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACrF,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,IAAI,MAAM,CAAC,eAAe,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;gBACzE,OAAQ,MAAM,CAAC,eAAuB,CAAC,SAAS,CAAC,CAAC;gBAClD,eAAe,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;YAED,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACpF,IAAI,CAAC;oBACH,IAAI,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;wBACnC,MAAM,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAM,EAAE,CAAC;oBAChB,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YAED,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,2EAA2E;AAE3E;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB;IAEjB,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,EAAE,CAAC;QACnC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,KAAK,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/services/agent-apps/installers/registry-probe.d.ts

@@ -0,0 +1,38 @@
+/**
+ * OCI / Docker Registry v2 digest lookups via curl.
+ *
+ * We shell out to curl instead of using Node's built-in `fetch` because:
+ *   - Node's fetch (undici) ships a 10 s TCP connect timeout that isn't
+ *     configurable without pulling undici in as a direct dep, and the TLS
+ *     handshake to ghcr.io from edge devices on slow international links
+ *     routinely exceeds that (9–15 s measured from a Pi in mainland China).
+ *   - curl's `--max-time` is wall-clock and reliable.
+ *   - curl is already present on every target platform.
+ *
+ * The call chain implements the standard OCI distribution bearer-token flow:
+ *   1. GET  <realm>?service=...&scope=...            → bearer token
+ *   2. HEAD /v2/<repository>/manifests/<reference>   → docker-content-digest
+ *
+ * Well-known public registries (GHCR, Docker Hub, Quay) always require a
+ * token, so we skip the throwaway unauthenticated probe for them — that
+ * alone saves ~10 s per image on slow WAN links.
+ */
+export interface ImageRef {
+    registry: string;
+    repository: string;
+    reference: string;
+}
+/**
+ * Parse a docker image reference into `{ registry, repository, reference }`.
+ * Handles: "ghcr.io/owner/name:tag", "owner/name:tag" (defaults to Docker
+ * Hub), "name" (defaults to "library/<name>:latest"). Returns null for
+ * digest-pinned refs (no lookup is needed) or malformed strings.
+ */
+export declare function parseImageRef(image: string): ImageRef | null;
+/**
+ * Fetch the current remote digest (sha256 hex, without the "sha256:" prefix)
+ * for a fully-resolved image reference. Returns null when the registry is
+ * unreachable, the image is private without an auth token we can obtain, or
+ * any other probe failure.
+ */
+export declare function fetchRemoteDigest(ref: ImageRef): Promise<string | null>;

package/dist/services/agent-apps/installers/registry-probe.js

@@ -0,0 +1,183 @@
+/**
+ * OCI / Docker Registry v2 digest lookups via curl.
+ *
+ * We shell out to curl instead of using Node's built-in `fetch` because:
+ *   - Node's fetch (undici) ships a 10 s TCP connect timeout that isn't
+ *     configurable without pulling undici in as a direct dep, and the TLS
+ *     handshake to ghcr.io from edge devices on slow international links
+ *     routinely exceeds that (9–15 s measured from a Pi in mainland China).
+ *   - curl's `--max-time` is wall-clock and reliable.
+ *   - curl is already present on every target platform.
+ *
+ * The call chain implements the standard OCI distribution bearer-token flow:
+ *   1. GET  <realm>?service=...&scope=...            → bearer token
+ *   2. HEAD /v2/<repository>/manifests/<reference>   → docker-content-digest
+ *
+ * Well-known public registries (GHCR, Docker Hub, Quay) always require a
+ * token, so we skip the throwaway unauthenticated probe for them — that
+ * alone saves ~10 s per image on slow WAN links.
+ */
+import { execFile } from "child_process";
+import { promisify } from "util";
+const execFileAsync = promisify(execFile);
+const KNOWN_BEARER_REGISTRIES = new Set([
+    "ghcr.io",
+    "registry-1.docker.io",
+    "docker.io",
+    "quay.io",
+]);
+/** Accept header covering all manifest / index media types. */
+const MANIFEST_ACCEPT = [
+    "application/vnd.oci.image.index.v1+json",
+    "application/vnd.oci.image.manifest.v1+json",
+    "application/vnd.docker.distribution.manifest.list.v2+json",
+    "application/vnd.docker.distribution.manifest.v2+json",
+].join(", ");
+/**
+ * Parse a docker image reference into `{ registry, repository, reference }`.
+ * Handles: "ghcr.io/owner/name:tag", "owner/name:tag" (defaults to Docker
+ * Hub), "name" (defaults to "library/<name>:latest"). Returns null for
+ * digest-pinned refs (no lookup is needed) or malformed strings.
+ */
+export function parseImageRef(image) {
+    if (image.includes("@"))
+        return null;
+    const trimmed = image.trim();
+    if (!trimmed)
+        return null;
+    const firstSlash = trimmed.indexOf("/");
+    const firstSegment = firstSlash === -1 ? "" : trimmed.slice(0, firstSlash);
+    const hasRegistry = firstSegment.includes(".") ||
+        firstSegment.includes(":") ||
+        firstSegment === "localhost";
+    let registry;
+    let rest;
+    if (hasRegistry) {
+        registry = firstSegment;
+        rest = trimmed.slice(firstSlash + 1);
+    }
+    else {
+        registry = "registry-1.docker.io";
+        rest = trimmed.includes("/") ? trimmed : `library/${trimmed}`;
+    }
+    const colon = rest.lastIndexOf(":");
+    let repository;
+    let reference;
+    if (colon === -1 || rest.indexOf("/", colon) !== -1) {
+        repository = rest;
+        reference = "latest";
+    }
+    else {
+        repository = rest.slice(0, colon);
+        reference = rest.slice(colon + 1);
+    }
+    if (!/^[a-z0-9][a-z0-9._\-/]{0,254}$/.test(repository))
+        return null;
+    if (!/^[A-Za-z0-9._\-]{1,128}$/.test(reference))
+        return null;
+    return { registry, repository, reference };
+}
+/**
+ * Fetch the current remote digest (sha256 hex, without the "sha256:" prefix)
+ * for a fully-resolved image reference. Returns null when the registry is
+ * unreachable, the image is private without an auth token we can obtain, or
+ * any other probe failure.
+ */
+export async function fetchRemoteDigest(ref) {
+    const manifestUrl = `https://${ref.registry}/v2/${ref.repository}/manifests/${ref.reference}`;
+    if (KNOWN_BEARER_REGISTRIES.has(ref.registry)) {
+        const token = await fetchBearerToken(`https://${ref.registry}/token`, ref.registry, `repository:${ref.repository}:pull`);
+        if (!token)
+            return null;
+        return headDigestWithAuth(manifestUrl, token);
+    }
+    // Unknown registry: try unauthenticated first, then follow the challenge.
+    const unauth = await curlHead(manifestUrl, { Accept: MANIFEST_ACCEPT });
+    if (unauth.ok) {
+        const d = extractDigest(unauth.headers);
+        if (d)
+            return d;
+    }
+    const challenge = unauth.headers["www-authenticate"] || "";
+    const parsed = parseBearerChallenge(challenge);
+    if (!parsed)
+        return null;
+    const token = await fetchBearerToken(parsed.realm, parsed.service || "", parsed.scope || `repository:${ref.repository}:pull`);
+    if (!token)
+        return null;
+    return headDigestWithAuth(manifestUrl, token);
+}
+async function headDigestWithAuth(manifestUrl, token) {
+    const resp = await curlHead(manifestUrl, {
+        Accept: MANIFEST_ACCEPT,
+        Authorization: `Bearer ${token}`,
+    });
+    return resp.ok ? extractDigest(resp.headers) : null;
+}
+async function fetchBearerToken(realm, service, scope) {
+    const url = new URL(realm);
+    url.searchParams.set("service", service);
+    url.searchParams.set("scope", scope);
+    try {
+        const { stdout } = await execFileAsync("curl", [
+            "--silent", "--fail-with-body", "--show-error",
+            "--max-time", "20",
+            url.toString(),
+        ], { timeout: 25_000, encoding: "utf-8" });
+        const body = JSON.parse(stdout);
+        return body.token || body.access_token || null;
+    }
+    catch {
+        return null;
+    }
+}
+async function curlHead(url, headers) {
+    const args = [
+        "--silent", "--show-error", "--head",
+        "--max-time", "20",
+        "--write-out", "\n__STATUS__%{http_code}\n",
+    ];
+    for (const [k, v] of Object.entries(headers)) {
+        args.push("-H", `${k}: ${v}`);
+    }
+    args.push(url);
+    try {
+        const { stdout } = await execFileAsync("curl", args, {
+            timeout: 25_000,
+            encoding: "utf-8",
+            maxBuffer: 1 * 1024 * 1024,
+        });
+        const statusMatch = stdout.match(/__STATUS__(\d{3})/);
+        const statusCode = statusMatch ? parseInt(statusMatch[1], 10) : 0;
+        const parsed = {};
+        for (const raw of stdout.split(/\r?\n/)) {
+            if (!raw || raw.startsWith("HTTP/") || raw.startsWith("__STATUS__"))
+                continue;
+            const idx = raw.indexOf(":");
+            if (idx > 0) {
+                parsed[raw.slice(0, idx).trim().toLowerCase()] = raw.slice(idx + 1).trim();
+            }
+        }
+        return { ok: statusCode >= 200 && statusCode < 400, statusCode, headers: parsed };
+    }
+    catch {
+        return { ok: false, statusCode: 0, headers: {} };
+    }
+}
+function extractDigest(headers) {
+    const m = headers["docker-content-digest"]?.match(/^sha256:([a-f0-9]{64})$/);
+    return m ? m[1] : null;
+}
+function parseBearerChallenge(header) {
+    if (!/^\s*Bearer\b/i.test(header))
+        return null;
+    const realm = /realm="([^"]+)"/i.exec(header)?.[1];
+    if (!realm)
+        return null;
+    return {
+        realm,
+        service: /service="([^"]+)"/i.exec(header)?.[1],
+        scope: /scope="([^"]+)"/i.exec(header)?.[1],
+    };
+}
+//# sourceMappingURL=registry-probe.js.map

package/dist/services/agent-apps/installers/registry-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-probe.js","sourceRoot":"","sources":["../../../../src/services/agent-apps/installers/registry-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,SAAS;IACT,sBAAsB;IACtB,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH,+DAA+D;AAC/D,MAAM,eAAe,GAAG;IACtB,yCAAyC;IACzC,4CAA4C;IAC5C,2DAA2D;IAC3D,sDAAsD;CACvD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAQb;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3E,MAAM,WAAW,GACf,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC1B,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC1B,YAAY,KAAK,WAAW,CAAC;IAE/B,IAAI,QAAgB,CAAC;IACrB,IAAI,IAAY,CAAC;IACjB,IAAI,WAAW,EAAE,CAAC;QAChB,QAAQ,GAAG,YAAY,CAAC;QACxB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,sBAAsB,CAAC;QAClC,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,UAAkB,CAAC;IACvB,IAAI,SAAiB,CAAC;IACtB,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpD,UAAU,GAAG,IAAI,CAAC;QAClB,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAa;IACnD,MAAM,WAAW,GAAG,WAAW,GAAG,CAAC,QAAQ,OAAO,GAAG,CAAC,UAAU,cAAc,GAAG,CAAC,SAAS,EAAE,CAAC;IAE9F,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,WAAW,GAAG,CAAC,QAAQ,QAAQ,EAC/B,GAAG,CAAC,QAAQ,EACZ,cAAc,GAAG,CAAC,UAAU,OAAO,CACpC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,0EAA0E;IAC1E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,OAAO,IAAI,EAAE,EACpB,MAAM,CAAC,KAAK,IAAI,cAAc,GAAG,CAAC,UAAU,OAAO,CACpD,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,WAAmB,EACnB,KAAa;IAEb,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE;QACvC,MAAM,EAAE,eAAe;QACvB,aAAa,EAAE,UAAU,KAAK,EAAE;KACjC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAa,EACb,OAAe,EACf,KAAa;IAEb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,MAAM,EACN;YACE,UAAU,EAAE,kBAAkB,EAAE,cAAc;YAC9C,YAAY,EAAE,IAAI;YAClB,GAAG,CAAC,QAAQ,EAAE;SACf,EACD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CACvC,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA8C,CAAC;QAC7E,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,OAA+B;IAE/B,MAAM,IAAI,GAAa;QACrB,UAAU,EAAE,cAAc,EAAE,QAAQ;QACpC,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,4BAA4B;KAC5C,CAAC;IACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE;YACnD,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;SAC3B,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;gBAAE,SAAS;YAC9E,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACZ,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAA+B;IACpD,MAAM,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7E,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO;QACL,KAAK;QACL,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/services/agent-apps/installers/shell-script.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Installer strategy for shell-script-driven agent apps (Ollama and any other
+ * system tool shipped as a `curl | bash` installer).
+ *
+ * Responsibilities:
+ *   - probe installed version + binary size via `probeCommand`
+ *   - probe update availability via GitHub Releases (when `githubRepo` set)
+ *   - install: fetch script → optional sha256 verify → `sudo -n bash`
+ *   - uninstall: stop+disable systemd unit + rm binary + rm extraCleanup
+ *
+ * Heavy ops stream progress through the shared task-registry so the UI
+ * picks them up via `/api/setup/tasks/:id`, identical to adapter installs.
+ */
+import type { AgentAppSource, InstallStartResult } from "../types.js";
+type ShellScriptSource = Extract<AgentAppSource, {
+    kind: "shell-script";
+}>;
+export declare function probeShellScriptStatus(source: ShellScriptSource): Promise<{
+    installed: boolean;
+    version?: string;
+} | null>;
+export declare function probeShellScriptSizeMB(source: ShellScriptSource): Promise<number | null>;
+/**
+ * Read-only cache lookup used by `buildCardView`. Returns null (UI stays
+ * neutral) until the user clicks "检查更新" at least once, which kicks off
+ * the network probe via `refreshShellScriptUpdateCache`.
+ *
+ * Intentionally NOT falling back to an on-demand probe here — the catalog
+ * endpoint is polled every 5 s and the GitHub Releases API is slow + rate-
+ * limited. See docs/agent-apps-design.md "update checks only on explicit
+ * click".
+ */
+export declare function readShellScriptUpdateAvailable(appId: string): boolean | null;
+export declare function getShellScriptUpdateCacheLastCheckedAt(): number | null;
+/**
+ * Compare installed version vs GitHub Releases latest tag. Writes the
+ * result to the cache and returns it. Called by `checkAllAgentAppUpdates`;
+ * not called from the catalog hot path.
+ */
+export declare function refreshShellScriptUpdateCache(appId: string, source: ShellScriptSource): Promise<boolean | null>;
+export declare function findRunningShellScriptTask(appId: string): {
+    id: string;
+    kind: "install" | "uninstall";
+} | undefined;
+export declare function startShellScriptInstall(appId: string, source: ShellScriptSource): Promise<InstallStartResult>;
+export declare function startShellScriptUninstall(appId: string, source: ShellScriptSource): Promise<InstallStartResult>;
+export {};