jishushell 0.4.17 → 0.4.24-beta.2

package/dist/services/app/hermes-agent-manager.js

@@ -0,0 +1,289 @@
+/**
+ * Hermes Agent App-type Manager
+ *
+ * Encapsulates all logic specific to the "hermes-agent" app type:
+ *   - Instance directory layout  (hermes-home/data)
+ *   - Instance creation
+ *   - Pre-start validation
+ *
+ *   - Nomad task builder (buildNomadTaskHermes) and Nomad secrets writer
+ */
+import { execFileSync } from "child_process";
+import { randomBytes } from "crypto";
+import { chownSync, existsSync, statSync } from "fs";
+import { join } from "path";
+import { INSTANCES_DIR } from "../../config.js";
+import { safeWriteJson } from "../../utils/safe-json.js";
+import { ensureDirContainer } from "../../utils/fs.js";
+import { writeSecretFile } from "../../utils/fs.js";
+import { compileTaskRuntime } from "./app-compiler.js";
+import { getInstance, getInstanceDir, instanceMetaPath, resolveServiceUser, defaultGatewayPort, releasePort, parseEnvFile, getInstanceRuntime, getRuntimeEnv, } from "../instance-manager.js";
+// ── Constants ─────────────────────────────────────────────────────────────────
+const HERMES_HOME_DIRNAME = "hermes-home";
+const HERMES_ENV_FILENAME = "hermes.env";
+const DEFAULT_HERMES_IMAGE = "jishushell-hermes:latest";
+// ── Path helpers ──────────────────────────────────────────────────────────────
+export function defaultHermesHome(instanceId) {
+    return join(getInstanceDir(instanceId), HERMES_HOME_DIRNAME);
+}
+export function defaultHermesEnvFile(instanceId) {
+    return join(getInstanceDir(instanceId), HERMES_ENV_FILENAME);
+}
+export function getHermesHome(instanceId) {
+    const meta = getInstance(instanceId);
+    return meta?.hermes_home || defaultHermesHome(instanceId);
+}
+export function getHermesEnvFile(instanceId) {
+    const meta = getInstance(instanceId);
+    return meta?.hermes_env_file || defaultHermesEnvFile(instanceId);
+}
+// ── Pre-start validation ──────────────────────────────────────────────────────
+export async function prepareStartHermes(instanceId) {
+    const { DOCKER_IMAGE_RE, MAX_DOCKER_IMAGE_NAME_LEN } = await import("../nomad-manager.js");
+    const { getNomadDriver } = await import("../../config.js");
+    const hermesHome = getHermesHome(instanceId);
+    ensureDirContainer(join(hermesHome, "data"));
+    if (getNomadDriver() === "docker") {
+        const inst = getInstance(instanceId);
+        const image = inst?.runtime?.image || DEFAULT_HERMES_IMAGE;
+        if (!DOCKER_IMAGE_RE.test(image) || image.length > MAX_DOCKER_IMAGE_NAME_LEN) {
+            return { ok: false, error: `Invalid Docker image name: "${image}"` };
+        }
+        try {
+            execFileSync("docker", ["image", "inspect", image], { timeout: 10000, stdio: "ignore" });
+        }
+        catch {
+            console.log(`[hermes] Docker image ${image} not found, starting background pull...`);
+            try {
+                const { exec: execAsync } = await import("child_process");
+                const { promisify } = await import("util");
+                promisify(execAsync)(`docker pull ${image}`, { timeout: 0 }).catch((e) => {
+                    console.warn(`[hermes] Background pull of ${image} failed: ${e.message}`);
+                });
+                return {
+                    ok: false,
+                    error: `Docker image ${image} not found locally. Pull started in background — retry in a few minutes.`,
+                };
+            }
+            catch (e) {
+                return { ok: false, error: `Docker image ${image} not available: ${e.message}` };
+            }
+        }
+    }
+    return { ok: true };
+}
+// ── Instance creation ─────────────────────────────────────────────────────────
+export async function createHermesInstance(instanceId, name, description, options) {
+    const { appSpec } = options;
+    const d = getInstanceDir(instanceId);
+    if (existsSync(d))
+        throw new Error(`Instance '${instanceId}' already exists`);
+    const hermesHome = defaultHermesHome(instanceId);
+    const hermesEnvFile = defaultHermesEnvFile(instanceId);
+    ensureDirContainer(d);
+    try {
+        const parentGid = statSync(INSTANCES_DIR).gid;
+        chownSync(d, -1, parentGid);
+    }
+    catch { /* non-root without CAP_CHOWN */ }
+    ensureDirContainer(hermesHome);
+    ensureDirContainer(join(hermesHome, "data"));
+    const hermesApiKey = randomBytes(32).toString("hex");
+    writeSecretFile(hermesEnvFile, `HERMES_API_KEY=${hermesApiKey}\n`);
+    const serviceTask = appSpec?.tasks.find((t) => t.role === "service");
+    const compiled = serviceTask ? compileTaskRuntime(serviceTask, instanceId) : null;
+    const image = compiled?.image || serviceTask?.image || DEFAULT_HERMES_IMAGE;
+    const resources = compiled?.resources || { CPU: 1500, MemoryMB: 3072 };
+    const webuiHostPort = await defaultGatewayPort(instanceId);
+    let allocatedPort = webuiHostPort;
+    try {
+        const taskEnv = { ...(serviceTask?.env || {}) };
+        delete taskEnv.HERMES_API_KEY;
+        // Wire Open WebUI to JishuShell LLM proxy so the Hermes instance can
+        // use the panel's configured LLM provider out of the box.
+        const { getPanelConfig } = await import("../../config.js");
+        const panelPort = getPanelConfig().port || 8090;
+        const proxyBaseUrl = `http://host.docker.internal:${panelPort}/jsproxy/v1`;
+        const runtime = {
+            command: null,
+            args: [],
+            cwd: "/data",
+            user: "root",
+            env_files: [hermesEnvFile],
+            env: {
+                OPENCLAW_GATEWAY_PORT: String(webuiHostPort),
+                HERMES_WEBUI_PORT: String(webuiHostPort),
+                HERMES_HOME: "/data/.hermes",
+                DATA_DIR: "/data/open-webui",
+                PORT: "8080",
+                OPENAI_API_BASE_URL: proxyBaseUrl,
+                OPENAI_API_KEY: hermesApiKey,
+                ...taskEnv,
+            },
+            image,
+            resources,
+        };
+        const meta = {
+            id: instanceId,
+            name,
+            description,
+            hermes_home: hermesHome,
+            hermes_env_file: hermesEnvFile,
+            app_type: "hermes-agent",
+            runtime,
+            created_at: new Date().toISOString(),
+            ...(appSpec ? { app_id: appSpec.app_id ?? appSpec.id } : {}),
+        };
+        safeWriteJson(instanceMetaPath(instanceId), meta);
+        // Generate LLM proxy token and write it to hermes.env so that
+        // Open WebUI inside the container can authenticate to the proxy.
+        try {
+            const { ensureInstanceProxyToken } = await import("../llm-proxy/index.js");
+            const proxyToken = ensureInstanceProxyToken(instanceId);
+            // Update runtime env to pass proxy token as OPENAI_API_KEY
+            runtime.env.OPENAI_API_KEY = proxyToken;
+            safeWriteJson(instanceMetaPath(instanceId), meta);
+        }
+        catch (e) {
+            console.warn(`[hermes] Proxy bootstrap for ${instanceId} deferred: ${e.message}`);
+        }
+        const svcUser = resolveServiceUser();
+        if (svcUser) {
+            try {
+                execFileSync("chown", ["-R", `${svcUser.uid}:${svcUser.gid}`, d], { timeout: 10_000 });
+                execFileSync("chown", ["-R", `${svcUser.uid}:${svcUser.gid}`, hermesHome], { timeout: 10_000 });
+            }
+            catch (e) {
+                console.warn(`[hermes] chown for ${instanceId} failed:`, e.message);
+            }
+        }
+        return meta;
+    }
+    finally {
+        if (allocatedPort != null)
+            releasePort(allocatedPort);
+    }
+}
+import { DEFAULT_RESOURCES, DEFAULT_ENV, MAX_CPU_MHZ, MAX_MEMORY_MB, VALID_USER_RE, normalizeDockerResources, nomadGet, nomadPut, jobId, } from "../nomad-manager.js";
+function buildHermesRuntime(instanceId) {
+    const runtime = getInstanceRuntime(instanceId);
+    const hermesHome = getHermesHome(instanceId);
+    if (runtime.user && !VALID_USER_RE.test(runtime.user)) {
+        throw new Error(`Invalid runtime user: ${runtime.user}`);
+    }
+    const env = { ...DEFAULT_ENV };
+    Object.assign(env, getRuntimeEnv(instanceId));
+    delete env.HERMES_API_KEY;
+    env.HERMES_HOME = hermesHome;
+    const resources = { ...DEFAULT_RESOURCES, CPU: 1500, MemoryMB: 3072 };
+    for (const [key, value] of Object.entries(runtime.resources || {})) {
+        if (value != null)
+            resources[key] = Number(value);
+    }
+    resources.CPU = Math.max(1, Math.min(resources.CPU, MAX_CPU_MHZ));
+    resources.MemoryMB = Math.max(1, Math.min(resources.MemoryMB, MAX_MEMORY_MB));
+    return {
+        command: runtime.command || null,
+        args: Array.isArray(runtime.args) ? runtime.args.map(String) : [],
+        user: runtime.user || "root",
+        cwd: runtime.cwd || "/data",
+        env,
+        resources,
+        image: runtime.image ?? null,
+    };
+}
+export function buildNomadTaskHermes(instanceId, runtime, safeJobId) {
+    const hermesHome = getHermesHome(instanceId);
+    const image = runtime.image || DEFAULT_HERMES_IMAGE;
+    const webuiHostPort = parseInt(runtime.env?.HERMES_WEBUI_PORT || runtime.env?.OPENCLAW_GATEWAY_PORT || "8080", 10);
+    const containerEnv = { ...runtime.env };
+    containerEnv.PORT = "8080";
+    delete containerEnv.HERMES_API_KEY;
+    const normalizedResources = normalizeDockerResources(instanceId, {
+        ...runtime,
+        resources: runtime.resources || { CPU: 1500, MemoryMB: 3072 },
+    });
+    return {
+        Name: "gateway",
+        Driver: "docker",
+        User: "0:0",
+        Config: {
+            image,
+            force_pull: false,
+            volumes: [`${hermesHome}/data:/data:rw`],
+            extra_hosts: ["host.docker.internal:host-gateway"],
+            pids_limit: 1024,
+            mounts: [
+                { type: "tmpfs", target: "/tmp", tmpfs_options: { size: 536870912 } },
+                { type: "tmpfs", target: "/var/run", tmpfs_options: { size: 52428800 } },
+            ],
+        },
+        Env: containerEnv,
+        Resources: {
+            ...normalizedResources,
+            Networks: [{
+                    ReservedPorts: [{ Label: "gateway", Value: webuiHostPort, To: 8080 }],
+                }],
+        },
+        LogConfig: { MaxFiles: 3, MaxFileSizeMB: 20 },
+        Templates: [{
+                DestPath: "secrets/hermes.env",
+                Envvars: true,
+                EmbeddedTmpl: [
+                    `{{ if nomadVarExists "nomad/jobs/${safeJobId}/hermes/gateway" }}`,
+                    `HERMES_API_KEY={{ with nomadVar "nomad/jobs/${safeJobId}/hermes/gateway" }}{{ .HERMES_API_KEY }}{{ end }}`,
+                    `{{ end }}`,
+                ].join("\n"),
+                ChangeMode: "restart",
+            }],
+    };
+}
+export async function writeNomadSecretsHermes(instanceId) {
+    const jid = jobId(instanceId);
+    const ns = "default";
+    const varPath = `nomad/jobs/${jid}/hermes/gateway`;
+    const encodedPath = encodeURIComponent(varPath);
+    const hermesEnvFile = getHermesEnvFile(instanceId);
+    const env = parseEnvFile(hermesEnvFile);
+    const apiKey = env.HERMES_API_KEY || "";
+    if (!apiKey)
+        return;
+    const items = { HERMES_API_KEY: apiKey };
+    const MAX_ATTEMPTS = 3;
+    for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+        let cas = 0;
+        try {
+            const existing = await nomadGet(`/v1/var/${encodedPath}?namespace=${ns}`);
+            if (existing.ok) {
+                const data = await existing.json();
+                cas = data.ModifyIndex || 0;
+            }
+        }
+        catch { /* variable may not exist yet */ }
+        const resp = await nomadPut(`/v1/var/${encodedPath}?cas=${cas}&namespace=${ns}`, {
+            Namespace: ns,
+            Path: varPath,
+            Items: items,
+        });
+        if (resp.ok)
+            return;
+        const text = await resp.text();
+        if (resp.status === 409 && attempt < MAX_ATTEMPTS - 1) {
+            await new Promise(r => setTimeout(r, 100 * Math.pow(2, attempt)));
+            continue;
+        }
+        throw new Error(`Failed to write Nomad Variables for ${instanceId}` +
+            ` (attempt ${attempt + 1}/${MAX_ATTEMPTS}): HTTP ${resp.status} ${text}`);
+    }
+}
+// ── AppTypeManager export ──────────────────────────────────────────────────
+export const hermesAgentManager = {
+    appType: "hermes-agent",
+    createInstance: createHermesInstance,
+    prepareStart: prepareStartHermes,
+    writeNomadSecrets: writeNomadSecretsHermes,
+    buildNomadTask: buildNomadTaskHermes,
+    nomadTaskGroupName: () => "hermes",
+    buildRuntime: buildHermesRuntime,
+};
+//# sourceMappingURL=hermes-agent-manager.js.map

package/dist/services/app/hermes-agent-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes-agent-manager.js","sourceRoot":"","sources":["../../../src/services/app/hermes-agent-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EACL,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAEhC,iFAAiF;AAEjF,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAC1C,MAAM,mBAAmB,GAAG,YAAY,CAAC;AACzC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAExD,iFAAiF;AAEjF,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,OAAQ,IAAI,EAAE,WAAkC,IAAI,iBAAiB,CAAC,UAAU,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,OAAQ,IAAI,EAAE,eAAsC,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC;AAC3F,CAAC;AAED,iFAAiF;AAEjF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACzD,MAAM,EAAE,eAAe,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC3F,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAE3D,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAE7C,IAAI,cAAc,EAAE,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,oBAAoB,CAAC;QAC3D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,KAAK,GAAG,EAAE,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YACH,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,yCAAyC,CAAC,CAAC;YACrF,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;gBAC1D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC3C,SAAS,CAAC,SAAS,CAAC,CAAC,eAAe,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;oBAC5E,OAAO,CAAC,IAAI,CAAC,+BAA+B,KAAK,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC5E,CAAC,CAAC,CAAC;gBACH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,gBAAgB,KAAK,0EAA0E;iBACvG,CAAC;YACJ,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,KAAK,mBAAmB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACnF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,iFAAiF;AAEjF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,IAAY,EACZ,WAAmB,EACnB,OAA8B;IAE9B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE5B,MAAM,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,kBAAkB,CAAC,CAAC;IAE9E,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEvD,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC;QAC9C,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;IAC5C,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAE7C,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,eAAe,CAAC,aAAa,EAAE,kBAAkB,YAAY,IAAI,CAAC,CAAC;IAEnE,MAAM,WAAW,GAAG,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,WAAW,EAAE,KAAK,IAAI,oBAAoB,CAAC;IAC5E,MAAM,SAAS,GAAG,QAAQ,EAAE,SAAS,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAEvE,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,aAAa,GAAkB,aAAa,CAAC;IAEjD,IAAI,CAAC;QACH,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;QACxE,OAAO,OAAO,CAAC,cAAc,CAAC;QAE9B,qEAAqE;QACrE,0DAA0D;QAC1D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC;QAChD,MAAM,YAAY,GAAG,+BAA+B,SAAS,aAAa,CAAC;QAE3E,MAAM,OAAO,GAAwB;YACnC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE;YACR,GAAG,EAAE,OAAO;YACZ,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,CAAC,aAAa,CAAC;YAC1B,GAAG,EAAE;gBACH,qBAAqB,EAAE,MAAM,CAAC,aAAa,CAAC;gBAC5C,iBAAiB,EAAE,MAAM,CAAC,aAAa,CAAC;gBACxC,WAAW,EAAE,eAAe;gBAC5B,QAAQ,EAAE,kBAAkB;gBAC5B,IAAI,EAAE,MAAM;gBACZ,mBAAmB,EAAE,YAAY;gBACjC,cAAc,EAAE,YAAY;gBAC5B,GAAG,OAAO;aACX;YACD,KAAK;YACL,SAAS;SACV,CAAC;QAEF,MAAM,IAAI,GAAiB;YACzB,EAAE,EAAE,UAAU;YACd,IAAI;YACJ,WAAW;YACX,WAAW,EAAE,UAAU;YACvB,eAAe,EAAE,aAAa;YAC9B,QAAQ,EAAE,cAAc;YACxB,OAAO;YACP,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAG,OAAe,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC;QACF,aAAa,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;QAElD,8DAA8D;QAC9D,iEAAiE;QACjE,IAAI,CAAC;YACH,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAC3E,MAAM,UAAU,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;YACxD,2DAA2D;YAC3D,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,UAAU,CAAC;YACxC,aAAa,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,gCAAgC,UAAU,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;gBACvF,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAClG,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,sBAAsB,UAAU,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,IAAI,IAAI;YAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAKD,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EAEb,wBAAwB,EACxB,QAAQ,EACR,QAAQ,EACR,KAAK,GAEN,MAAM,qBAAqB,CAAC;AAE7B,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAE7C,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,cAAc,CAAC;IAC1B,GAAG,CAAC,WAAW,GAAG,UAAU,CAAC;IAE7B,MAAM,SAAS,GAAG,EAAE,GAAG,iBAAiB,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,KAAK,IAAI,IAAI;YAAE,SAAS,CAAC,GAA6B,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;IACD,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAClE,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;IAE9E,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;QAChC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QACjE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO;QAC3B,GAAG;QACH,SAAS;QACT,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,OAA4B,EAC5B,SAAiB;IAEjB,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,oBAAoB,CAAC;IAEpD,MAAM,aAAa,GAAG,QAAQ,CAC5B,OAAO,CAAC,GAAG,EAAE,iBAAiB,IAAI,OAAO,CAAC,GAAG,EAAE,qBAAqB,IAAI,MAAM,EAC9E,EAAE,CACH,CAAC;IAEF,MAAM,YAAY,GAA2B,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAChE,YAAY,CAAC,IAAI,GAAG,MAAM,CAAC;IAC3B,OAAO,YAAY,CAAC,cAAc,CAAC;IAEnC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,UAAU,EAAE;QAC/D,GAAG,OAAO;QACV,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC9D,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE;YACN,KAAK;YACL,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,CAAC,GAAG,UAAU,gBAAgB,CAAC;YACxC,WAAW,EAAE,CAAC,mCAAmC,CAAC;YAClD,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;gBACrE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;aACzE;SACF;QACD,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE;YACT,GAAG,mBAAmB;YACtB,QAAQ,EAAE,CAAC;oBACT,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;iBACtE,CAAC;SACH;QACD,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;QAC7C,SAAS,EAAE,CAAC;gBACV,QAAQ,EAAE,oBAAoB;gBAC9B,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE;oBACZ,oCAAoC,SAAS,qBAAqB;oBAClE,+CAA+C,SAAS,mDAAmD;oBAC3G,WAAW;iBACZ,CAAC,IAAI,CAAC,IAAI,CAAC;gBACZ,UAAU,EAAE,SAAS;aACtB,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,SAAS,CAAC;IACrB,MAAM,OAAO,GAAG,cAAc,GAAG,iBAAiB,CAAC;IACnD,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEhD,MAAM,aAAa,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,KAAK,GAA2B,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IAEjE,MAAM,YAAY,GAAG,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,WAAW,cAAc,EAAE,EAAE,CAAC,CAAC;YAC1E,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;QAE5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,WAAW,QAAQ,GAAG,cAAc,EAAE,EAAE,EAAE;YAC/E,SAAS,EAAE,EAAE;YACb,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,EAAE;YAAE,OAAO;QAEpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uCAAuC,UAAU,EAAE;YACnD,aAAa,OAAO,GAAG,CAAC,IAAI,YAAY,WAAW,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAmB;IAChD,OAAO,EAAE,cAAc;IACvB,cAAc,EAAE,oBAAoB;IACpC,YAAY,EAAE,kBAAkB;IAChC,iBAAiB,EAAE,uBAAuB;IAC1C,cAAc,EAAE,oBAAoB;IACpC,kBAAkB,EAAE,GAAG,EAAE,CAAC,QAAQ;IAClC,YAAY,EAAE,kBAAkB;CACjC,CAAC"}

package/dist/services/app/id-normalizer.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Instance ID normalizer for V2 creation flows.
+ *
+ * Computes the canonical instance ID at creation time, enforcing:
+ *  - Singleton apps use their AppSpec `id` verbatim.
+ *  - Tier-1 agents (openclaw / hermes) are prefixed with their kind.
+ *  - Custom (non-singleton) apps are prefixed with the spec's canonical `id`.
+ *  - Prefix application is idempotent: existing prefix is not doubled.
+ *  - Reserved-prefix protection: custom apps cannot produce an ID that starts
+ *    with `openclaw-` or `hermes-`.
+ */
+/** Runtime adapter key used to decide ID prefix and dispatch logic. */
+export type InstanceKind = "openclaw" | "hermes" | "custom";
+/**
+ * Compute the canonical instance id at creation time.
+ *
+ * @param userInput  Raw string from the user (name / short id).
+ * @param kind       Runtime adapter key: `"openclaw"`, `"hermes"`, or `"custom"`.
+ * @param spec       Optional AppSpec — required when `kind === "custom"`.
+ *
+ * @throws {Error}  If `userInput` reduces to an empty string after kebab conversion.
+ * @throws {Error}  If the resolved id (custom kind) starts with a reserved prefix.
+ */
+export declare function normalizeInstanceId(userInput: string, kind: InstanceKind, spec?: {
+    id: string;
+    singleInstance?: boolean;
+}): string;

package/dist/services/app/id-normalizer.js

@@ -0,0 +1,77 @@
+/**
+ * Instance ID normalizer for V2 creation flows.
+ *
+ * Computes the canonical instance ID at creation time, enforcing:
+ *  - Singleton apps use their AppSpec `id` verbatim.
+ *  - Tier-1 agents (openclaw / hermes) are prefixed with their kind.
+ *  - Custom (non-singleton) apps are prefixed with the spec's canonical `id`.
+ *  - Prefix application is idempotent: existing prefix is not doubled.
+ *  - Reserved-prefix protection: custom apps cannot produce an ID that starts
+ *    with `openclaw-` or `hermes-`.
+ */
+/** Reserved Tier-1 prefixes that custom apps must not produce. */
+const RESERVED_PREFIXES = ["openclaw-", "hermes-"];
+/**
+ * Convert an arbitrary string to kebab-case:
+ *  - Lowercase all characters.
+ *  - Replace any run of non-alphanumeric characters with a single `-`.
+ *  - Strip leading and trailing `-`.
+ */
+function toKebab(s) {
+    return s
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+}
+/**
+ * Compute the canonical instance id at creation time.
+ *
+ * @param userInput  Raw string from the user (name / short id).
+ * @param kind       Runtime adapter key: `"openclaw"`, `"hermes"`, or `"custom"`.
+ * @param spec       Optional AppSpec — required when `kind === "custom"`.
+ *
+ * @throws {Error}  If `userInput` reduces to an empty string after kebab conversion.
+ * @throws {Error}  If the resolved id (custom kind) starts with a reserved prefix.
+ */
+export function normalizeInstanceId(userInput, kind, spec) {
+    // Singleton apps always use the canonical spec id regardless of user input.
+    if (spec?.singleInstance) {
+        return spec.id;
+    }
+    const userPart = toKebab(userInput);
+    if (userPart === "") {
+        throw new Error(`invalid instance id: user input "${userInput}" produces an empty string after normalization`);
+    }
+    // Reserved-prefix protection runs first for custom kind — catches the
+    // "user tried to smuggle a Tier-1 id via custom" case even if the route
+    // didn't supply an AppSpec yet.
+    if (kind === "custom") {
+        for (const reserved of RESERVED_PREFIXES) {
+            if (userPart.startsWith(reserved)) {
+                throw new Error(`reserved prefix "${reserved}": custom app id cannot start with it`);
+            }
+        }
+        if (!spec) {
+            throw new Error("custom kind requires an AppSpec: route must supply app_spec_yaml or app_spec_ref");
+        }
+    }
+    // Determine the prefix: Tier-1 agents use their kind; custom apps use spec.id.
+    const prefix = kind === "custom" ? spec.id : kind;
+    // Idempotent: skip prefixing if userPart already starts with `<prefix>-` or
+    // equals `<prefix>` exactly.
+    const normalized = userPart.startsWith(`${prefix}-`) || userPart === prefix
+        ? userPart
+        : `${prefix}-${userPart}`;
+    // Final reserved-prefix guard on the computed id: catches the case where the
+    // spec's own id starts with a Tier-1 prefix (would only happen if an AppSpec
+    // author did something adversarial).
+    if (kind === "custom") {
+        for (const reserved of RESERVED_PREFIXES) {
+            if (normalized.startsWith(reserved)) {
+                throw new Error(`reserved prefix "${reserved}": custom app id cannot start with it`);
+            }
+        }
+    }
+    return normalized;
+}
+//# sourceMappingURL=id-normalizer.js.map

package/dist/services/app/id-normalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-normalizer.js","sourceRoot":"","sources":["../../../src/services/app/id-normalizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,kEAAkE;AAClE,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,SAAS,CAAU,CAAC;AAE5D;;;;;GAKG;AACH,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC;SACL,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,IAAkB,EAClB,IAA+C;IAE/C,4EAA4E;IAC5E,IAAI,IAAI,EAAE,cAAc,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAEpC,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,oCAAoC,SAAS,gDAAgD,CAC9F,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,gCAAgC;IAChC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;YACzC,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,oBAAoB,QAAQ,uCAAuC,CACpE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnD,4EAA4E;IAC5E,6BAA6B;IAC7B,MAAM,UAAU,GACd,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,QAAQ,KAAK,MAAM;QACtD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;IAE9B,6EAA6E;IAC7E,6EAA6E;IAC7E,qCAAqC;IACrC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;YACzC,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,oBAAoB,QAAQ,uCAAuC,CACpE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/services/app/ollama-manager.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Ollama App-type Manager
+ *
+ * Encapsulates all logic specific to the "ollama" app type:
+ *   - Instance directory layout  (ollama-home/models)
+ *   - Instance creation
+ *   - Pre-start validation
+ *
+ * Ollama runs as a plain Docker container with a mounted model directory.
+ * No IM channels, no OpenClaw config, no Nomad Variables needed.
+ */
+import type { AppTypeManager, CreateInstanceOptions, InstanceMeta, StartPreparation } from "./types.js";
+export declare function defaultOllamaHome(instanceId: string): string;
+export declare function getOllamaHome(instanceId: string): string;
+export declare function prepareStartOllama(instanceId: string): Promise<StartPreparation>;
+export declare function createOllamaInstance(instanceId: string, name: string, description: string, options: CreateInstanceOptions): Promise<InstanceMeta>;
+export declare function buildNomadTaskOllama(instanceId: string, runtime: Record<string, any>, _safeJobId: string): Record<string, any>;
+export declare const ollamaManager: AppTypeManager;

package/dist/services/app/ollama-manager.js

@@ -0,0 +1,207 @@
+/**
+ * Ollama App-type Manager
+ *
+ * Encapsulates all logic specific to the "ollama" app type:
+ *   - Instance directory layout  (ollama-home/models)
+ *   - Instance creation
+ *   - Pre-start validation
+ *
+ * Ollama runs as a plain Docker container with a mounted model directory.
+ * No IM channels, no OpenClaw config, no Nomad Variables needed.
+ */
+import { execFileSync } from "child_process";
+import { chownSync, existsSync, statSync } from "fs";
+import { join } from "path";
+import { INSTANCES_DIR, getInstanceDir, instanceMetaPath } from "../../config.js";
+import { safeWriteJson } from "../../utils/safe-json.js";
+import { ensureDirContainer } from "../../utils/fs.js";
+import { compileTaskRuntime } from "./app-compiler.js";
+import { resolveServiceUser, defaultGatewayPort, releasePort, getInstanceRuntime, getRuntimeEnv, getGatewayPort, } from "../instance-manager.js";
+// ── Constants ─────────────────────────────────────────────────────────────────
+const OLLAMA_HOME_DIRNAME = "ollama-home";
+const DEFAULT_OLLAMA_IMAGE = "ollama/ollama:latest";
+// ── Path helpers ──────────────────────────────────────────────────────────────
+export function defaultOllamaHome(instanceId) {
+    return join(getInstanceDir(instanceId), OLLAMA_HOME_DIRNAME);
+}
+export function getOllamaHome(instanceId) {
+    return defaultOllamaHome(instanceId);
+}
+// ── Pre-start validation ──────────────────────────────────────────────────────
+export async function prepareStartOllama(instanceId) {
+    const { DOCKER_IMAGE_RE, MAX_DOCKER_IMAGE_NAME_LEN } = await import("../nomad-manager.js");
+    const { getNomadDriver } = await import("../../config.js");
+    if (getNomadDriver() === "docker") {
+        const { getInstance } = await import("../instance-manager.js");
+        const inst = getInstance(instanceId);
+        const image = inst?.runtime?.image || DEFAULT_OLLAMA_IMAGE;
+        if (!DOCKER_IMAGE_RE.test(image) || image.length > MAX_DOCKER_IMAGE_NAME_LEN) {
+            return { ok: false, error: `Invalid Docker image name: "${image}"` };
+        }
+        try {
+            execFileSync("docker", ["image", "inspect", image], { timeout: 10000, stdio: "ignore" });
+        }
+        catch {
+            console.log(`[ollama] Docker image ${image} not found, starting background pull...`);
+            try {
+                const { exec: execAsync } = await import("child_process");
+                const { promisify } = await import("util");
+                promisify(execAsync)(`docker pull ${image}`, { timeout: 0 }).catch((e) => {
+                    console.warn(`[ollama] Background pull of ${image} failed: ${e.message}`);
+                });
+                return {
+                    ok: false,
+                    error: `Docker image ${image} not found locally. Pull started in background — retry in a few minutes.`,
+                };
+            }
+            catch (e) {
+                return { ok: false, error: `Docker image ${image} not available: ${e.message}` };
+            }
+        }
+    }
+    return { ok: true };
+}
+// ── Instance creation ─────────────────────────────────────────────────────────
+export async function createOllamaInstance(instanceId, name, description, options) {
+    const { appSpec } = options;
+    const d = getInstanceDir(instanceId);
+    if (existsSync(d))
+        throw new Error(`Instance '${instanceId}' already exists`);
+    const ollamaHome = defaultOllamaHome(instanceId);
+    ensureDirContainer(d);
+    try {
+        const parentGid = statSync(INSTANCES_DIR).gid;
+        chownSync(d, -1, parentGid);
+    }
+    catch { /* non-root */ }
+    ensureDirContainer(ollamaHome);
+    ensureDirContainer(join(ollamaHome, "models"));
+    const serviceTask = appSpec?.tasks.find((t) => t.role === "service");
+    const compiled = serviceTask ? compileTaskRuntime(serviceTask, instanceId) : null;
+    const image = compiled?.image || serviceTask?.image || DEFAULT_OLLAMA_IMAGE;
+    const resources = compiled?.resources || { CPU: 2000, MemoryMB: 4096 };
+    // Ollama exposes port 11434 by default; we still use the gateway port pool
+    // so we don't allocate a fixed port that clashes with other instances.
+    const hostPort = await defaultGatewayPort(instanceId);
+    let allocatedPort = hostPort;
+    try {
+        const taskEnv = { ...(serviceTask?.env || {}) };
+        const runtime = {
+            command: null,
+            args: [],
+            cwd: "/root",
+            user: "root",
+            env_files: [],
+            env: {
+                // Use OPENCLAW_GATEWAY_PORT for consistency with the port helpers
+                OPENCLAW_GATEWAY_PORT: String(hostPort),
+                OLLAMA_HOST: `0.0.0.0:11434`,
+                OLLAMA_MODELS: "/models",
+                ...taskEnv,
+            },
+            image,
+            resources,
+        };
+        const meta = {
+            id: instanceId,
+            name,
+            description,
+            ollama_home: ollamaHome,
+            app_type: "ollama",
+            runtime,
+            created_at: new Date().toISOString(),
+            ...(appSpec ? { app_id: appSpec.app_id ?? appSpec.id } : {}),
+        };
+        safeWriteJson(instanceMetaPath(instanceId), meta);
+        const svcUser = resolveServiceUser();
+        if (svcUser) {
+            try {
+                execFileSync("chown", ["-R", `${svcUser.uid}:${svcUser.gid}`, d], { timeout: 10_000 });
+                execFileSync("chown", ["-R", `${svcUser.uid}:${svcUser.gid}`, ollamaHome], { timeout: 10_000 });
+            }
+            catch (e) {
+                console.warn(`[ollama] chown for ${instanceId} failed:`, e.message);
+            }
+        }
+        return meta;
+    }
+    finally {
+        if (allocatedPort != null)
+            releasePort(allocatedPort);
+    }
+}
+// ── Nomad task builder for Ollama ──────────────────────────────────────────
+import { DEFAULT_RESOURCES, DEFAULT_ENV, MAX_CPU_MHZ, MAX_MEMORY_MB, VALID_USER_RE, normalizeDockerResources, } from "../nomad-manager.js";
+function buildOllamaRuntime(instanceId) {
+    const runtime = getInstanceRuntime(instanceId);
+    const ollamaHome = getOllamaHome(instanceId);
+    if (runtime.user && !VALID_USER_RE.test(runtime.user)) {
+        throw new Error(`Invalid runtime user: ${runtime.user}`);
+    }
+    const env = { ...DEFAULT_ENV };
+    Object.assign(env, getRuntimeEnv(instanceId));
+    env.OLLAMA_MODELS = "/models";
+    const resources = { ...DEFAULT_RESOURCES, CPU: 2000, MemoryMB: 4096 };
+    for (const [key, value] of Object.entries(runtime.resources || {})) {
+        if (value != null)
+            resources[key] = Number(value);
+    }
+    resources.CPU = Math.max(1, Math.min(resources.CPU, MAX_CPU_MHZ));
+    resources.MemoryMB = Math.max(1, Math.min(resources.MemoryMB, MAX_MEMORY_MB));
+    return {
+        command: runtime.command || null,
+        args: Array.isArray(runtime.args) ? runtime.args.map(String) : [],
+        user: runtime.user || "root",
+        cwd: runtime.cwd || "/root",
+        env,
+        resources,
+        image: runtime.image ?? null,
+    };
+}
+export function buildNomadTaskOllama(instanceId, runtime, _safeJobId) {
+    const ollamaHome = getOllamaHome(instanceId);
+    const image = runtime.image || DEFAULT_OLLAMA_IMAGE;
+    const hostPort = getGatewayPort(instanceId);
+    const containerEnv = { ...runtime.env };
+    containerEnv.OLLAMA_HOST = "0.0.0.0:11434";
+    containerEnv.OLLAMA_MODELS = "/models";
+    const normalizedResources = normalizeDockerResources(instanceId, runtime);
+    return {
+        Name: "gateway",
+        Driver: "docker",
+        User: "0:0",
+        Config: {
+            image,
+            force_pull: false,
+            volumes: [
+                `${ollamaHome}:/root/.ollama:rw`,
+                `${join(ollamaHome, "models")}:/models:rw`,
+            ],
+            extra_hosts: ["host.docker.internal:host-gateway"],
+            pids_limit: 512,
+            mounts: [
+                { type: "tmpfs", target: "/tmp", tmpfs_options: { size: 536870912 } },
+            ],
+        },
+        Env: containerEnv,
+        Resources: {
+            ...normalizedResources,
+            Networks: [{
+                    ReservedPorts: [{ Label: "gateway", Value: hostPort, To: 11434 }],
+                }],
+        },
+        LogConfig: { MaxFiles: 3, MaxFileSizeMB: 10 },
+        Templates: [],
+    };
+}
+// ── AppTypeManager export ──────────────────────────────────────────────────
+export const ollamaManager = {
+    appType: "ollama",
+    createInstance: createOllamaInstance,
+    prepareStart: prepareStartOllama,
+    writeNomadSecrets: async () => { },
+    buildNomadTask: buildNomadTaskOllama,
+    nomadTaskGroupName: () => "ollama",
+    buildRuntime: buildOllamaRuntime,
+};
+//# sourceMappingURL=ollama-manager.js.map