jishushell 0.4.2-beta2 → 0.4.10

package/Dockerfile.openclaw-slim

@@ -0,0 +1,58 @@
+# syntax=docker/dockerfile:1
+# Self-contained OpenClaw runtime image with entrypoint version-switch.
+# Build:  docker build -f Dockerfile.openclaw-slim -t jishushell-openclaw:slim .
+ARG NODE_IMAGE=node:22-bookworm-slim
+
+# ── Stage 1: install ──
+FROM ${NODE_IMAGE} AS builder
+ARG OPENCLAW_VERSION=latest
+WORKDIR /app
+RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ git ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# Install the requested OpenClaw version. The build arg becomes part of the
+# layer cache key so a new upstream release cannot silently reuse an older install.
+RUN npm install -g --prefix /app "openclaw@${OPENCLAW_VERSION}" \
+    --omit=dev --no-audit --no-fund
+
+# OpenClaw's postinstall script installs bundled plugin runtime deps
+# (e.g. @buape/carbon for Discord) into the top-level node_modules.
+# npm runs it automatically but it may fail silently (non-fatal).
+# Re-run it explicitly to ensure all deps are installed.
+# Requires git (some deps use git+ssh: protocol — rewrite to https).
+RUN git config --global url."https://github.com/".insteadOf "ssh://git@github.com/" && \
+    cd /app/lib/node_modules/openclaw && \
+    node scripts/postinstall-bundled-plugins.mjs 2>&1 || true
+
+# ── Stage 2: final runtime image ──
+FROM ${NODE_IMAGE}
+# Re-declare the ARG so it's available in this stage (Docker ARG scope is
+# per-stage). Inject it as an OCI label so `docker inspect` reports the real
+# bundled OpenClaw version for both CI and local-fallback builds.
+ARG OPENCLAW_VERSION=latest
+LABEL org.opencontainers.image.title="OpenClaw Runtime"
+LABEL org.opencontainers.image.description="Self-contained OpenClaw runtime with Python and version-switch entrypoint"
+LABEL org.opencontainers.image.version="${OPENCLAW_VERSION}"
+LABEL org.opencontainers.image.source="https://github.com/x-aijishu/jishushell"
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    procps hostname curl git lsof openssl \
+    python3 python3-pip python3-venv && \
+    ln -sf /usr/bin/python3 /usr/local/bin/python && \
+    rm -rf /var/lib/apt/lists/* && \
+    rm -f /usr/lib/python*/EXTERNALLY-MANAGED
+
+# Copy OpenClaw from builder
+COPY --from=builder /app/lib/node_modules/ /app/node_modules/
+RUN ln -sf /app/node_modules/openclaw/openclaw.mjs /app/openclaw.mjs && \
+    # Backward-compat: old code references /usr/local/bin/openclaw
+    ln -sf /usr/local/bin/openclaw-entry.sh /usr/local/bin/openclaw && \
+    cp /app/node_modules/openclaw/package.json /app/package.json 2>/dev/null || true
+
+# Entrypoint wrapper
+COPY openclaw-entry.sh /usr/local/bin/openclaw-entry.sh
+RUN chmod +x /usr/local/bin/openclaw-entry.sh
+
+WORKDIR /app
+USER node
+ENTRYPOINT ["/usr/local/bin/openclaw-entry.sh"]
+CMD ["gateway", "--allow-unconfigured"]

package/INSTALL-NOTICE

@@ -23,9 +23,15 @@ software bundled with or installed by this product.
   Docker Engine
     URL     : https://github.com/moby/moby
     License : Apache License, Version 2.0
-              https://www.apache.org/licenses/LICENSE-2.0
+              https://github.com/moby/moby/blob/master/LICENSE
     Author  : Docker, Inc.
 
+  Colima
+    URL     : https://github.com/abiosoft/colima
+    License : MIT License
+              https://github.com/abiosoft/colima/blob/main/LICENSE
+    Author  : Abiola Ibrahim
+
   Nomad v1.11.3+ (>= 1.7.0)
     URL     : https://github.com/hashicorp/nomad
     License : Business Source License 1.1 (BSL 1.1)

package/dist/auth.js

@@ -1,5 +1,5 @@
 import { AUTH_FILE, getJwtSecret, JWT_ALGORITHM, JWT_EXPIRE_HOURS } from "./config.js";
-import { safeReadJson, safeWriteJson } from "./utils/safe-json.js";
+import { safeReadSecretJson, safeWriteSecretJson } from "./utils/safe-json.js";
 import bcrypt from "bcryptjs";
 import jwt from "jsonwebtoken";
 const AUTH_CACHE_TTL = 60_000;
@@ -9,10 +9,10 @@ let _authCache = null;
 let _initInProgress = false;
 function invalidateAuthCache() { _authCache = null; }
 function readAuthData() {
-    return safeReadJson(AUTH_FILE, "auth");
+    return safeReadSecretJson(AUTH_FILE, "auth");
 }
 function writeAuthData(data) {
-    safeWriteJson(AUTH_FILE, data, true);
+    safeWriteSecretJson(AUTH_FILE, data, true);
 }
 export function isInitialized() {
     return readAuthData() !== null;

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,GAAG,MAAM,cAAc,CAAC;AAO/B,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,IAAI,UAAU,GAAmD,IAAI,CAAC;AACtE,2EAA2E;AAC3E,2EAA2E;AAC3E,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,SAAS,mBAAmB,KAAW,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC;AAE3D,SAAS,YAAY;IACnB,OAAO,YAAY,CAAW,SAAS,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACnC,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,YAAY,EAAE,KAAK,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,+EAA+E;IAC/E,kDAAkD;IAClD,IAAI,eAAe,IAAI,YAAY,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7D,eAAe,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,mFAAmF;QACnF,IAAI,YAAY,EAAE,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,aAAa,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC;QACpE,mBAAmB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,WAAmB,EAAE,WAAmB;IAC3E,IAAI,CAAC,MAAM,cAAc,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QACxC,IAAI,cAAc,IAAI,IAAI;YAAE,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,aAAa,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3E,mBAAmB,EAAE,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,MAAM,eAAe,GAAG,IAAI,EAAE,gBAAgB,IAAI,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,YAAY,EAAE,EAAE;QACrE,SAAS,EAAE,aAAa;QACxB,SAAS,EAAE,GAAG,gBAAgB,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE,CAAmB,CAAC;QAErG,IAAI,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAC,EAAE,KAAK,UAAU,CAAC,eAAe,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAClD,UAAU,GAAG,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,EAAE,KAAK,cAAc,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,GAAG,MAAM,cAAc,CAAC;AAO/B,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,IAAI,UAAU,GAAmD,IAAI,CAAC;AACtE,2EAA2E;AAC3E,2EAA2E;AAC3E,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,SAAS,mBAAmB,KAAW,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC;AAE3D,SAAS,YAAY;IACnB,OAAO,kBAAkB,CAAW,SAAS,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACnC,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,YAAY,EAAE,KAAK,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,+EAA+E;IAC/E,kDAAkD;IAClD,IAAI,eAAe,IAAI,YAAY,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7D,eAAe,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,mFAAmF;QACnF,IAAI,YAAY,EAAE,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,aAAa,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC;QACpE,mBAAmB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,WAAmB,EAAE,WAAmB;IAC3E,IAAI,CAAC,MAAM,cAAc,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QACxC,IAAI,cAAc,IAAI,IAAI;YAAE,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,aAAa,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3E,mBAAmB,EAAE,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,MAAM,eAAe,GAAG,IAAI,EAAE,gBAAgB,IAAI,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,YAAY,EAAE,EAAE;QACrE,SAAS,EAAE,aAAa;QACxB,SAAS,EAAE,GAAG,gBAAgB,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE,CAAmB,CAAC;QAErG,IAAI,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAC,EAAE,KAAK,UAAU,CAAC,eAAe,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAClD,UAAU,GAAG,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,EAAE,KAAK,cAAc,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 if (process.platform === "darwin") {
-    const extra = ["/usr/local/bin", "/opt/homebrew/bin", "/opt/homebrew/sbin", "/Applications/Docker.app/Contents/Resources/bin"];
+    const extra = ["/usr/local/bin", "/opt/homebrew/bin", "/opt/homebrew/sbin"];
     const current = process.env.PATH ?? "";
     const missing = extra.filter(p => !current.split(":").includes(p));
     if (missing.length > 0)
@@ -10,6 +10,12 @@ import { existsSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 import { exec } from "child_process";
+if (process.platform === "darwin") {
+    const jHome = process.env.JISHUSHELL_HOME || join(homedir(), ".jishushell");
+    const sock = join(jHome, "colima", "jishushell", "docker.sock");
+    if (existsSync(sock))
+        process.env.DOCKER_HOST = `unix://${sock}`;
+}
 import { createServer } from "./server.js";
 import { runInstall, parseInstallArgs } from "./install.js";
 import { startPanel, stopPanel, stopWithJobs, restartPanel, runDoctor, runOnboard, showStatus, resetAll, checkUpdate, runUpdate } from "./control.js";
@@ -24,6 +30,32 @@ function openBrowser(url) {
     exec(cmd, () => { });
 }
 const [subcommand, ...rest] = process.argv.slice(2);
+// ── HTTP thin-client helpers for backup commands ───────────────────────────
+async function apiCall(path, opts = {}) {
+    const port = process.env.JISHUSHELL_PORT || "8090";
+    const url = `http://127.0.0.1:${port}/api${path}`;
+    const res = await fetch(url, {
+        method: opts.method || "GET",
+        headers: opts.body ? { "Content-Type": "application/json" } : {},
+        body: opts.body ? JSON.stringify(opts.body) : undefined,
+    });
+    if (!res.ok) {
+        const err = await res.json().catch(() => ({ detail: res.statusText }));
+        throw new Error(err.detail || `HTTP ${res.status}`);
+    }
+    return res.json();
+}
+async function waitForJob(jobId) {
+    while (true) {
+        const job = await apiCall(`/backup/jobs/${jobId}`);
+        if (job.status === "completed")
+            return job;
+        if (job.status === "failed")
+            throw new Error(job.error || "Job failed");
+        process.stdout.write(`\r  ${job.progress || job.status}...`);
+        await new Promise(r => setTimeout(r, 1500));
+    }
+}
 // ── Helper to parse --port from remaining args ─────────────────────────────
 function parsePort(args) {
     for (let i = 0; i < args.length; i++) {
@@ -230,6 +262,469 @@ else if (subcommand === "uninstall") {
     // Step 2: remove the npm global package (now ~/.jishushell is already gone)
     const npmResult = spawnSync("npm", ["uninstall", "-g", "jishushell"], { stdio: "inherit" });
     process.exit((cleanResult.status ?? 0) || (npmResult.status ?? 0));
+    // ── backup ─────────────────────────────────────────────────────────────────
+}
+else if (subcommand === "backup") {
+    // Handle "backup verify <instance-id> <filename>" subcommand
+    if (rest[0] === "verify") {
+        const instanceId = rest[1];
+        const filename = rest[2];
+        if (!instanceId || !filename) {
+            console.error("Usage: jishushell backup verify <instance-id> <filename>");
+            process.exit(1);
+        }
+        try {
+            const result = await apiCall(`/instances/${instanceId}/backup/verify/${encodeURIComponent(filename)}`, { method: "POST" });
+            console.log(result.valid ? "Verification PASSED." : "Verification FAILED.");
+            for (const check of result.checks || []) {
+                console.log(`  ${check.passed ? "+" : "x"} ${check.name}${check.detail ? ": " + check.detail : ""}`);
+            }
+            if (rest.includes("--json"))
+                console.log(JSON.stringify(result, null, 2));
+        }
+        catch (e) {
+            console.error(`Verify failed: ${e.message}`);
+            process.exit(1);
+        }
+        process.exit(0);
+    }
+    const id = rest[0];
+    if (!id) {
+        console.error("Usage: jishushell backup <id> [--with-sessions] [--only-config] [--state-only] [--no-workspace]");
+        process.exit(1);
+    }
+    const withSessions = rest.includes("--with-sessions");
+    const onlyConfig = rest.includes("--only-config");
+    const stateOnly = rest.includes("--state-only");
+    const noWorkspace = rest.includes("--no-workspace");
+    try {
+        console.log(`Creating backup for ${id}...`);
+        const result = await apiCall(`/instances/${id}/backup`, {
+            method: "POST",
+            body: {
+                include_sessions: withSessions,
+                only_config: onlyConfig,
+                scope: stateOnly ? "state" : "home",
+                // Only send include_workspace when the user explicitly opted out;
+                // otherwise let the backend default (include=true unless only_config).
+                ...(noWorkspace ? { include_workspace: false } : {}),
+            },
+        });
+        if (result.job_id) {
+            const job = await waitForJob(result.job_id);
+            console.log(`\nBackup complete: ${job.result?.filename} (${job.result?.size} bytes)`);
+        }
+        if (rest.includes("--verify") && result.job_id) {
+            const job = await apiCall(`/backup/jobs/${result.job_id}`);
+            if (job.result?.filename) {
+                console.log("Verifying...");
+                const v = await apiCall(`/instances/${id}/backup/verify/${encodeURIComponent(job.result.filename)}`, { method: "POST" });
+                console.log(v.valid ? "Verification passed." : "Verification FAILED.");
+            }
+        }
+    }
+    catch (e) {
+        console.error(`Backup failed: ${e.message}`);
+        process.exit(1);
+    }
+    process.exit(0);
+    // ── restore ────────────────────────────────────────────────────────────────
+}
+else if (subcommand === "restore") {
+    // Handle restore --new (create new instance from backup, no existing instance ID required)
+    if (rest.includes("--new")) {
+        const fromIdx = rest.indexOf("--from");
+        const idxNewId = rest.indexOf("--id");
+        if (fromIdx !== -1) {
+            // restore --new --from <src-id> --latest|--pick [--id <new-id>]
+            const sourceId = rest[fromIdx + 1];
+            if (!sourceId) {
+                console.error("Usage: jishushell restore --new --from <src-id> --latest|--pick [--id <new-id>]");
+                process.exit(1);
+            }
+            let backups;
+            try {
+                backups = await apiCall(`/instances/${sourceId}/backups`);
+            }
+            catch (e) {
+                console.error(`Restore failed: ${e.message}`);
+                process.exit(1);
+            }
+            if (!backups.length) {
+                console.error("No backups found.");
+                process.exit(1);
+            }
+            let backupFile = "";
+            if (rest.includes("--latest")) {
+                backupFile = backups[0].filename;
+            }
+            else {
+                console.log("Available backups:");
+                backups.forEach((b, i) => {
+                    console.log(`  ${i + 1}. [${b.type}] ${new Date(b.created_at).toLocaleString()} (${(b.size / 1024 / 1024).toFixed(1)}MB)`);
+                });
+                const readline = await import("readline");
+                const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+                const answer = await new Promise(r => rl.question("Select number: ", r));
+                rl.close();
+                const idx = parseInt(answer, 10) - 1;
+                if (idx < 0 || idx >= backups.length) {
+                    console.error("Invalid selection.");
+                    process.exit(1);
+                }
+                backupFile = backups[idx].filename;
+            }
+            const newId = idxNewId !== -1 ? rest[idxNewId + 1] : `${sourceId}-copy`;
+            console.log(`Creating new instance ${newId} from ${sourceId}/${backupFile}...`);
+            try {
+                const result = await apiCall("/instances/create-from-backup", {
+                    method: "POST",
+                    body: { source_id: sourceId, backup_file: backupFile, new_id: newId, new_name: newId },
+                });
+                if (result.ok) {
+                    console.log(`Instance created: ${result.instance_id}`);
+                    if (result.warnings?.length)
+                        result.warnings.forEach((w) => console.log(`  Warning: ${w}`));
+                }
+                else {
+                    console.error(`Create from backup failed: ${result.detail || "unknown error"}`);
+                    if (result.warnings?.length)
+                        result.warnings.forEach((w) => console.log(`  Warning: ${w}`));
+                    process.exit(1);
+                }
+            }
+            catch (e) {
+                console.error(`Restore --new failed: ${e.message}`);
+                process.exit(1);
+            }
+        }
+        else {
+            // restore --new <file> [--id <new-id>]
+            const file = rest.find((a) => !a.startsWith("--") && a !== "restore");
+            if (!file) {
+                console.error("Usage: jishushell restore --new <file> [--id <new-id>]");
+                process.exit(1);
+            }
+            console.log("Note: restore --new from local file requires import flow.");
+            console.log(`Use: jishushell import ${file}`);
+        }
+        process.exit(0);
+    }
+    const id = rest[0];
+    if (!id) {
+        console.error("Usage: jishushell restore <id> <--latest|--pick|file>");
+        process.exit(1);
+    }
+    let file = "";
+    if (rest.includes("--latest") || rest.includes("--pick")) {
+        let backups;
+        try {
+            backups = await apiCall(`/instances/${id}/backups`);
+        }
+        catch (e) {
+            console.error(`Restore failed: ${e.message}`);
+            process.exit(1);
+        }
+        if (!backups.length) {
+            console.error("No backups found.");
+            process.exit(1);
+        }
+        if (rest.includes("--latest")) {
+            file = backups[0].filename;
+        }
+        else {
+            console.log("Available backups:");
+            backups.forEach((b, i) => {
+                console.log(`  ${i + 1}. ${b.type} ${new Date(b.created_at).toLocaleString()} (${(b.size / 1024 / 1024).toFixed(1)}MB)`);
+            });
+            const readline = await import("readline");
+            const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+            const answer = await new Promise(r => rl.question("Select number: ", r));
+            rl.close();
+            const idx = parseInt(answer, 10) - 1;
+            if (idx < 0 || idx >= backups.length) {
+                console.error("Invalid selection.");
+                process.exit(1);
+            }
+            file = backups[idx].filename;
+        }
+    }
+    else {
+        file = rest[1];
+    }
+    if (!file) {
+        console.error("No backup file specified.");
+        process.exit(1);
+    }
+    try {
+        console.log(`Restoring ${id} from ${file}...`);
+        const result = await apiCall(`/instances/${id}/restore/${encodeURIComponent(file)}`, { method: "POST" });
+        if (result.job_id) {
+            const job = await waitForJob(result.job_id);
+            const r = job.result || {};
+            if (r.ok) {
+                console.log(`\nRestore complete.`);
+                if (r.api_key_status === "lost") {
+                    console.log("Warning: archive was built on a different platform/arch; verify API Key configuration still matches this host.");
+                }
+                if (r.warnings?.length)
+                    r.warnings.forEach((w) => console.log(`  Warning: ${w}`));
+            }
+            else {
+                console.error(`\nRestore failed.${r.rolled_back ? " Auto-rollback completed." : ""}`);
+                if (r.warnings?.length)
+                    r.warnings.forEach((w) => console.log(`  ${w}`));
+            }
+        }
+    }
+    catch (e) {
+        console.error(`Restore failed: ${e.message}`);
+        process.exit(1);
+    }
+    process.exit(0);
+    // ── export ─────────────────────────────────────────────────────────────────
+}
+else if (subcommand === "export") {
+    const id = rest[0];
+    if (!id) {
+        console.error("Usage: jishushell export <id> [--with-sessions]");
+        process.exit(1);
+    }
+    const withSessions = rest.includes("--with-sessions");
+    try {
+        console.log(`Exporting ${id}...`);
+        const result = await apiCall(`/instances/${id}/export`, {
+            method: "POST",
+            body: { include_sessions: withSessions },
+        });
+        if (result.job_id) {
+            const job = await waitForJob(result.job_id);
+            const r = job.result || {};
+            console.log(`\nExport complete: ${r.filename}`);
+            console.log(`Download: http://127.0.0.1:${process.env.JISHUSHELL_PORT || "8090"}/api/instances/${id}/export/download/${encodeURIComponent(r.filename)}`);
+            if (r.warnings?.length)
+                r.warnings.forEach((w) => console.log(`  Warning: ${w}`));
+        }
+    }
+    catch (e) {
+        console.error(`Export failed: ${e.message}`);
+        process.exit(1);
+    }
+    process.exit(0);
+    // ── import ─────────────────────────────────────────────────────────────────
+}
+else if (subcommand === "import") {
+    const file = rest[0];
+    if (!file) {
+        console.error("Usage: jishushell import <file> [--id <id>] [--name <name>]");
+        process.exit(1);
+    }
+    const idIdx = rest.indexOf("--id");
+    const nameIdx = rest.indexOf("--name");
+    const customId = idIdx !== -1 ? rest[idIdx + 1] : undefined;
+    const customName = nameIdx !== -1 ? rest[nameIdx + 1] : undefined;
+    try {
+        const { readFileSync } = await import("fs");
+        const { basename } = await import("path");
+        const port = process.env.JISHUSHELL_PORT || "8090";
+        console.log("Uploading file...");
+        const fileData = readFileSync(file);
+        const boundary = "----JishuShellCLI" + Date.now();
+        const fileName = basename(file);
+        const body = Buffer.concat([
+            Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="${fileName}"\r\nContent-Type: application/gzip\r\n\r\n`),
+            fileData,
+            Buffer.from(`\r\n--${boundary}--\r\n`),
+        ]);
+        const uploadRes = await fetch(`http://127.0.0.1:${port}/api/instances/import/upload`, {
+            method: "POST",
+            headers: { "Content-Type": `multipart/form-data; boundary=${boundary}` },
+            body,
+        });
+        if (!uploadRes.ok) {
+            const err = await uploadRes.json().catch(() => ({ detail: uploadRes.statusText }));
+            throw new Error(err.detail || `Upload failed: ${uploadRes.status}`);
+        }
+        const { temp_id } = await uploadRes.json();
+        console.log("Previewing...");
+        const preview = await apiCall("/instances/import/preview", { method: "POST", body: { temp_id } });
+        console.log(`  Name: ${preview.manifest?.name || "unknown"}`);
+        console.log(`  Type: ${preview.manifest?.type || "unknown"}`);
+        console.log(`  Size: ${((preview.estimated_size || 0) / 1024 / 1024).toFixed(1)}MB`);
+        if (preview.warnings?.length) {
+            for (const w of preview.warnings)
+                console.log(`  Warning: ${w}`);
+        }
+        const instanceId = customId || preview.manifest?.name?.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 63) || `import-${Date.now()}`;
+        const instanceName = customName || preview.manifest?.name || instanceId;
+        console.log(`Creating instance ${instanceId}...`);
+        const result = await apiCall("/instances/import", {
+            method: "POST",
+            body: { temp_id, id: instanceId, name: instanceName },
+        });
+        if (result.ok) {
+            console.log(`Instance created: ${result.instance_id}`);
+            if (result.warnings?.length) {
+                for (const w of result.warnings)
+                    console.log(`  Warning: ${w}`);
+            }
+        }
+        else {
+            console.error(`Import failed: ${result.detail || "unknown error"}`);
+            if (result.warnings?.length) {
+                for (const w of result.warnings)
+                    console.log(`  Warning: ${w}`);
+            }
+            process.exit(1);
+        }
+    }
+    catch (e) {
+        console.error(`Import failed: ${e.message}`);
+        process.exit(1);
+    }
+    process.exit(0);
+    // ── clone ──────────────────────────────────────────────────────────────────
+}
+else if (subcommand === "clone") {
+    const src = rest[0];
+    const newId = rest[1];
+    if (!src || !newId) {
+        console.error("Usage: jishushell clone <src-id> <new-id> [--with-sessions] [--no-memory]");
+        process.exit(1);
+    }
+    const withSessions = rest.includes("--with-sessions");
+    const noMemory = rest.includes("--no-memory");
+    try {
+        console.log(`Cloning ${src} to ${newId}...`);
+        const result = await apiCall("/instances", {
+            method: "POST",
+            body: {
+                id: newId,
+                name: newId,
+                clone_from: src,
+                clone_options: {
+                    include_sessions: withSessions,
+                    include_memory: !noMemory,
+                },
+            },
+        });
+        console.log(`Clone created: ${result.id || newId}`);
+    }
+    catch (e) {
+        console.error(`Clone failed: ${e.message}`);
+        process.exit(1);
+    }
+    process.exit(0);
+    // ── backups ────────────────────────────────────────────────────────────────
+}
+else if (subcommand === "backups") {
+    const sub = rest[0];
+    if (sub === "list") {
+        const id = rest[1];
+        try {
+            if (id) {
+                const backups = await apiCall(`/instances/${id}/backups`);
+                if (!backups.length) {
+                    console.log("No backups.");
+                }
+                else {
+                    backups.forEach((b, i) => {
+                        console.log(`  ${i + 1}. [${b.type}] ${new Date(b.created_at).toLocaleString()} ${(b.size / 1024 / 1024).toFixed(1)}MB ${b.filename}`);
+                    });
+                }
+            }
+            else {
+                const orphans = await apiCall("/backups/orphaned");
+                if (orphans.length) {
+                    console.log("Orphaned backups:");
+                    for (const o of orphans) {
+                        console.log(`  ${o.instance_id}: ${o.backups?.length || 0} files`);
+                    }
+                }
+                else {
+                    console.log("No orphaned backups.");
+                }
+            }
+        }
+        catch (e) {
+            console.error(`backups list failed: ${e.message}`);
+            process.exit(1);
+        }
+    }
+    else if (sub === "clean") {
+        try {
+            const orphans = await apiCall("/backups/orphaned");
+            if (!orphans.length) {
+                console.log("No orphaned backups to clean.");
+                process.exit(0);
+            }
+            const force = rest.includes("--force");
+            console.log(`Found ${orphans.length} orphaned backup(s):`);
+            for (const o of orphans) {
+                console.log(`  ${o.instance_id}: ${o.backups?.length || 0} files`);
+            }
+            if (!force) {
+                const readline = await import("readline");
+                const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+                const answer = await new Promise(r => rl.question("Delete all orphaned backups? (y/N): ", r));
+                rl.close();
+                if (answer.toLowerCase() !== "y") {
+                    console.log("Cancelled.");
+                    process.exit(0);
+                }
+            }
+            for (const o of orphans) {
+                for (const b of o.backups || []) {
+                    await apiCall(`/backups/orphaned/${encodeURIComponent(o.instance_id)}/${encodeURIComponent(b.filename)}`, { method: "DELETE" });
+                }
+                console.log(`  Cleaned: ${o.instance_id}`);
+            }
+            console.log("Done.");
+        }
+        catch (e) {
+            console.error(`backups clean failed: ${e.message}`);
+            process.exit(1);
+        }
+    }
+    else {
+        console.error("Usage: jishushell backups list [id]\n       jishushell backups clean [--force]");
+        process.exit(1);
+    }
+    process.exit(0);
+    // ── auto-backup ────────────────────────────────────────────────────────────
+}
+else if (subcommand === "auto-backup") {
+    const id = rest[0];
+    const action = rest[1];
+    if (!id || !action) {
+        console.error("Usage: jishushell auto-backup <id> enable|disable|status");
+        process.exit(1);
+    }
+    try {
+        if (action === "status") {
+            const config = await apiCall(`/instances/${id}/auto-backup`);
+            console.log(JSON.stringify(config, null, 2));
+        }
+        else if (action === "enable") {
+            const interval = parseInt(rest[rest.indexOf("--interval") + 1], 10) || 24;
+            const keep = parseInt(rest[rest.indexOf("--keep") + 1], 10) || 7;
+            await apiCall(`/instances/${id}/auto-backup`, { method: "PUT", body: { enabled: true, interval_hours: interval, keep_count: keep } });
+            console.log(`Auto-backup enabled for ${id} (every ${interval}h, keep ${keep})`);
+        }
+        else if (action === "disable") {
+            await apiCall(`/instances/${id}/auto-backup`, { method: "PUT", body: { enabled: false } });
+            console.log(`Auto-backup disabled for ${id}`);
+        }
+        else {
+            console.error(`Unknown action: ${action}. Use enable|disable|status`);
+            process.exit(1);
+        }
+    }
+    catch (e) {
+        console.error(`auto-backup failed: ${e.message}`);
+        process.exit(1);
+    }
+    process.exit(0);
     // ── help ───────────────────────────────────────────────────────────────────
 }
 else if (!subcommand || subcommand === "help" || subcommand === "--help" || subcommand === "-h") {
@@ -254,8 +749,29 @@ Commands:
   update-check                     检查是否有新版本（0=有新版本，1=已是最新）
   update                           安装最新版本并重启面板
   install [options]                安装依赖并配置 JishuShell
+  llm list                         列出已配置的 LLM provider
+  llm add <name> <url> <key>       新增 LLM provider
+  llm update <name> <url> <key>    更新 LLM provider
+  llm delete <name>                删除 LLM provider
+  llm set-default <name>           设置默认 LLM provider
+  llm help                         LLM 子命令帮助
+  job list                         列出所有实例及运行状态
+  job status <id>                  查看实例详细状态
+  job start/stop/restart <id>      启停实例
+  job logs <id>                    查看实例日志
+  job exec <id> -- <cmd>           在容器内执行命令
   pairing list                     列出等待审批的 DM 配对请求
   pairing approve <ch> <code>      审批飞书/Lark 配对码（在容器内执行）
+  backup <id> [--with-sessions] [--only-config]  备份实例（加 --verify 校验完整性）
+  backup verify <id> <filename>    校验备份文件完整性
+  restore <id> <--latest|--pick|file>  从备份文件还原实例
+  restore --new --from <src-id> --latest|--pick [--id <new-id>]  从备份创建新实例
+  export <id> [--with-sessions]    导出实例为可迁移归档包
+  import <file> [--id <id>] [--name <name>]  导入归档包为新实例
+  clone <src-id> <new-id> [--with-sessions] [--no-memory]  克隆实例
+  backups list [id]                列出备份（不指定 id 则列孤立备份）
+  backups clean [--force]          清理孤立备份文件
+  auto-backup <id> enable|disable|status  管理定时自动备份
   help                             显示此帮助信息
 
 Server options: