jishushell 0.4.24-beta.2 → 0.4.30

package/INSTALL-NOTICE

@@ -20,6 +20,17 @@ software bundled with or installed by this product.
   with its respective license terms, including any restrictions on
   commercial use, competitive offerings, or redistribution.
 
+  Xcode Command Line Tools (build tools for macOS)
+    URL     : https://www.apple.com/legal/sla/docs/xcode.pdf
+    License : Apple Xcode and Apple SDKs Agreement
+    Author  : Apple Inc.
+
+  Homebrew (package manager for macOS)
+    URL     : https://github.com/Homebrew/brew
+    License : BSD 2-Clause License
+              https://github.com/Homebrew/brew/blob/HEAD/LICENSE.txt
+    Author  : Homebrew contributors
+
   Docker Engine
     URL     : https://github.com/moby/moby
     License : Apache License, Version 2.0

package/apps/browserless-chromium-container.yaml

@@ -0,0 +1,78 @@
+id: browserless-chromium-container
+name: Browserless Chromium
+version: "1.0.0"
+jishushell:
+  min_version: "0.4.30"
+description: "运行 browserless/chromium 服务，提供可嵌入实例页的浏览器调试画面与自动化连接端点"
+singleInstance: true
+
+tasks:
+  - name: browserless
+    role: service
+    runtime: container
+    image: "ghcr.io/browserless/chromium:latest"
+    env:
+      HOST: "0.0.0.0"
+      PORT: "3000"
+      TOKEN: ""
+      CONCURRENT: "5"
+      QUEUED: "10"
+      TIMEOUT: "120000"
+      # 防反爬虫配置
+      DEFAULT_USER_AGENT: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
+      FUNCTION_ENABLE_INCOGNITO: "true"
+      NAVIGATION_TIMEOUT: "30000"
+      # 减少自动化检测特征
+      DEFAULT_LAUNCH_ARGS: "--disable-blink-features=AutomationControlled --disable-infobars --window-size=1920,1080 --start-maximized"
+      DEFAULT_HEADLESS: "new"
+      # 持久化用户数据（cookies/localStorage/session），登录后会话保持
+      DATA_DIR: "/tmp/browserless-data"
+    volumes:
+      - source: "~/.jishushell/apps/${app_id}/data"
+        target: "/tmp/browserless-data"
+    resources:
+      cpu: "1000m"
+      memory: "2048Mi"
+    ports:
+      - name: http
+        port: 3000
+        visibility: external
+    health:
+      http:
+        path: /docs
+        port: 3000
+      interval: "15s"
+      timeout: "5s"
+      retries: 6
+      start_period: "35s"
+
+provides:
+  - capability: "browserless-debugger"
+    port: 3000
+    path: "/debugger/"
+    protocol: "http"
+    description: "Browserless Debug Viewer，可在实例页中嵌入浏览器画面"
+  - capability: "browserless-api"
+    port: 3000
+    path: "/"
+    protocol: "http"
+    description: "Browserless 根 API（供调试器页面连接 ws 与 sessions 接口）"
+  - capability: "browserless-docs"
+    port: 3000
+    path: "/docs/"
+    protocol: "http"
+    description: "Browserless API 文档页"
+  - capability: "browser-ws"
+    task: "browserless"
+    port: 3000
+    protocol: "ws"
+    description: "Browserless CDP/WebSocket 连接端点（ws://host:3000），用于 browser 类 require 自动绑定（命名遵循 <category>-<vendor> 约定）"
+
+lifecycle:
+  install:
+    - downloadImage: "ghcr.io/browserless/chromium:latest"
+    - mkdir: "~/.jishushell/apps/${app_id}/data"
+  pre_start:
+    - mkdir: "~/.jishushell/apps/${app_id}/data"
+  uninstall:
+    - deleteImage: "ghcr.io/browserless/chromium:latest"

package/apps/hermes-container.yaml

@@ -2,7 +2,7 @@ id: hermes-container
 name: Hermes Agent
 version: "1.0.0"
 jishushell:
-  min_version: "0.4.24"
+  min_version: "0.4.30"
 agentType: hermes
 description: "Hermes Agent 容器运行时，使用 apps 目录作为统一安装根"
 singleInstance: false
@@ -32,4 +32,38 @@ tasks:
       interval: "15s"
       timeout: "5s"
       retries: 3
-      start_period: "30s"
+      start_period: "30s"
+
+provides:
+  - capability: "web-hermes"
+    task: "gateway"
+    port: 8642
+    protocol: "http"
+    description: "Hermes Agent Web UI"
+  - capability: "llm-agent"
+    task: "gateway"
+    port: 8642
+    protocol: "http"
+    path: "/v1"
+    auth:
+      kind: "bearer"
+      tokenSource: "instance.env.API_SERVER_KEY"
+    description: "OpenAI-compatible chat endpoint (verified on Pi: GET /v1/models returns hermes-agent model)"
+
+requires:
+  - capability: "llm"
+    inject_as: "LLM_ENDPOINT"
+    required: false
+    cardinality: "one"
+  - capability: "search"
+    inject_as: "SEARCH_API_BASE_URL"
+    required: false
+    cardinality: "one"
+  - capability: "browser"
+    inject_as: "BROWSER_CDP_URL"
+    required: false
+    cardinality: "one"
+  - capability: "mcp"
+    inject_as: "MCP_SERVERS"
+    required: false
+    cardinality: "many"

package/apps/ollama-binary.yaml

@@ -2,7 +2,7 @@ id: ollama-binary
 name: Ollama
 version: "1.0.0"
 jishushell:
-  min_version: "0.4.24"
+  min_version: "0.4.30"
 description: "通过官方脚本，安装并运行Ollama"
 singleInstance: true
 
@@ -62,8 +62,15 @@ provides:
           - cmd: "help"
             description: "Help about any command"
   - capability: "ollama-api"
+    task: "gateway"
     port: 11434
+    protocol: "http"
     description: "Ollama HTTP API，兼容 OpenAI /v1/chat/completions 端点"
+  - capability: "llm-ollama"
+    task: "gateway"
+    port: 11434
+    protocol: "http"
+    description: "Ollama OpenAI-compatible LLM endpoint (Connections 主推命名)"
 
 lifecycle:
   pre_install:
@@ -76,22 +83,29 @@ lifecycle:
   install:
     - run: >-
         install_marker="$HOME/.jishushell/apps/${app_id}/.ollama-install-needed";
-        owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        owner_marker="$HOME/.jishushell/.ollama-installed-by-jishushell-${app_id}";
+        legacy_owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        system_install_marker="$HOME/.jishushell/.ollama-system-install-${app_id}";
         rm -f "$install_marker";
         if command -v ollama >/dev/null 2>&1; then
-          if [ -f "$owner_marker" ]; then
+          if [ -f "$owner_marker" ] || [ -f "$legacy_owner_marker" ]; then
             echo "检测到由 JishuShell 安装的 ollama，复用现有二进制。" >&2;
+            rm -f "$system_install_marker";
           else
             echo "检测到系统中已安装 ollama，跳过二进制安装。" >&2;
+            rm -f "$owner_marker" "$legacy_owner_marker";
+            : > "$system_install_marker";
           fi;
         else
           echo "未检测到 ollama，开始安装..." >&2;
-          rm -f "$owner_marker";
+          rm -f "$owner_marker" "$legacy_owner_marker" "$system_install_marker";
           : > "$install_marker";
         fi
     - run: >-
         install_marker="$HOME/.jishushell/apps/${app_id}/.ollama-install-needed";
-        owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        owner_marker="$HOME/.jishushell/.ollama-installed-by-jishushell-${app_id}";
+        legacy_owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        system_install_marker="$HOME/.jishushell/.ollama-system-install-${app_id}";
         for BINDIR in /usr/local/bin /usr/bin /bin; do
           echo "$PATH" | grep -q "$BINDIR" && break || continue;
         done;
@@ -104,6 +118,8 @@ lifecycle:
         fi;
         curl -fsSL https://ollama.com/install.sh | sh;
         rm -f "$install_marker";
+        rm -f "$legacy_owner_marker";
+        rm -f "$system_install_marker";
         : > "$owner_marker"
       sudo: true
       ifFileExists: "~/.jishushell/apps/${app_id}/.ollama-install-needed"
@@ -111,10 +127,14 @@ lifecycle:
       successIfCommandExists: "ollama"
     - run: >-
         install_marker="$HOME/.jishushell/apps/${app_id}/.ollama-install-needed";
-        owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        owner_marker="$HOME/.jishushell/.ollama-installed-by-jishushell-${app_id}";
+        legacy_owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        system_install_marker="$HOME/.jishushell/.ollama-system-install-${app_id}";
         if [ -f "$install_marker" ] && command -v ollama >/dev/null 2>&1; then
           echo "检测到 ollama 已可用，补记为由 JishuShell 安装。" >&2;
           rm -f "$install_marker";
+          rm -f "$legacy_owner_marker";
+          rm -f "$system_install_marker";
           : > "$owner_marker";
         fi
       ifFileExists: "~/.jishushell/apps/${app_id}/.ollama-install-needed"
@@ -156,9 +176,26 @@ lifecycle:
 
   uninstall:
     - run: >-
+        owner_marker="$HOME/.jishushell/.ollama-installed-by-jishushell-${app_id}";
+        legacy_owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        system_install_marker="$HOME/.jishushell/.ollama-system-install-${app_id}";
+        uninstall_marker="$HOME/.jishushell/.ollama-uninstall-needed-${app_id}";
+        rm -f "$uninstall_marker";
+        if [ -f "$system_install_marker" ]; then
+          echo "检测到复用的是系统已有 ollama，卸载时保留系统安装。" >&2;
+          rm -f "$system_install_marker";
+        elif [ -f "$owner_marker" ] || [ -f "$legacy_owner_marker" ]; then
+          : > "$uninstall_marker";
+        fi
+    - run: >-
+        owner_marker="$HOME/.jishushell/.ollama-installed-by-jishushell-${app_id}";
+        legacy_owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        system_install_marker="$HOME/.jishushell/.ollama-system-install-${app_id}";
+        uninstall_marker="$HOME/.jishushell/.ollama-uninstall-needed-${app_id}";
         rm -f /usr/local/bin/ollama /usr/bin/ollama /bin/ollama;
         rm -rf /usr/local/lib/ollama /usr/lib/ollama /usr/share/ollama 2>/dev/null || true;
-        rm -f "$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell"
+        rm -rf /Applications/Ollama.app "$HOME/Applications/Ollama.app" 2>/dev/null || true;
+        rm -f "$owner_marker" "$legacy_owner_marker" "$system_install_marker" "$uninstall_marker"
       sudo: true
-      ifFileExists: "~/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell"
+      ifFileExists: "~/.jishushell/.ollama-uninstall-needed-${app_id}"
 

package/apps/ollama-cpu-container.yaml

@@ -2,7 +2,7 @@ id: ollama-cpu-docker
 name: Ollama CPU(Docker)
 version: "1.0.0"
 jishushell:
-  min_version: "0.4.24"
+  min_version: "0.4.30"
 description: "使用 alpine/ollama 镜像运行的纯 CPU 版 Ollama"
 singleInstance: true
 
@@ -33,5 +33,12 @@ tasks:
 
 provides:
   - capability: "ollama-api"
+    task: "gateway"
     port: 11434
+    protocol: "http"
     description: "Ollama HTTP API，兼容 OpenAI /v1/chat/completions 端点"
+  - capability: "llm-ollama"
+    task: "gateway"
+    port: 11434
+    protocol: "http"
+    description: "Ollama OpenAI-compatible LLM endpoint (Connections 主推命名)"

package/apps/ollama-with-hollama-binary.yaml

@@ -2,7 +2,7 @@ id: ollama-with-hollama-binary
 name: Ollama
 version: "1.0.0"
 jishushell:
-  min_version: "0.4.24"
+  min_version: "0.4.30"
 description: "通过官方脚本安装并运行 Ollama，同时提供 Hollama Web UI。"
 singleInstance: true
 
@@ -52,13 +52,20 @@ tasks:
 
 provides:
   - capability: "hollama-web"
+    task: "hollama"
     port: 4173
     protocol: "http"
     description: "Hollama Web 界面"
   - capability: "ollama-api"
+    task: "gateway"
     port: 11434
     protocol: "http"
     description: "Ollama HTTP API，兼容 OpenAI /v1/chat/completions 端点"
+  - capability: "llm-ollama"
+    task: "gateway"
+    port: 11434
+    protocol: "http"
+    description: "Ollama OpenAI-compatible LLM endpoint (Connections 主推命名)"
 
 lifecycle:
   pre_install:
@@ -72,22 +79,29 @@ lifecycle:
     - downloadImage: "ghcr.io/fmaclen/hollama:latest"
     - run: >-
         install_marker="$HOME/.jishushell/apps/${app_id}/.ollama-install-needed";
-        owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        owner_marker="$HOME/.jishushell/.ollama-installed-by-jishushell-${app_id}";
+        legacy_owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        system_install_marker="$HOME/.jishushell/.ollama-system-install-${app_id}";
         rm -f "$install_marker";
         if command -v ollama >/dev/null 2>&1; then
-          if [ -f "$owner_marker" ]; then
+          if [ -f "$owner_marker" ] || [ -f "$legacy_owner_marker" ]; then
             echo "检测到由 JishuShell 安装的 ollama，复用现有二进制。" >&2;
+            rm -f "$system_install_marker";
           else
             echo "检测到系统中已安装 ollama，跳过二进制安装。" >&2;
+            rm -f "$owner_marker" "$legacy_owner_marker";
+            : > "$system_install_marker";
           fi;
         else
           echo "未检测到 ollama，开始安装..." >&2;
-          rm -f "$owner_marker";
+          rm -f "$owner_marker" "$legacy_owner_marker" "$system_install_marker";
           : > "$install_marker";
         fi
     - run: >-
         install_marker="$HOME/.jishushell/apps/${app_id}/.ollama-install-needed";
-        owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        owner_marker="$HOME/.jishushell/.ollama-installed-by-jishushell-${app_id}";
+        legacy_owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        system_install_marker="$HOME/.jishushell/.ollama-system-install-${app_id}";
         for BINDIR in /usr/local/bin /usr/bin /bin; do
           echo "$PATH" | grep -q "$BINDIR" && break || continue;
         done;
@@ -100,6 +114,8 @@ lifecycle:
         fi;
         curl -fsSL https://ollama.com/install.sh | sh;
         rm -f "$install_marker";
+        rm -f "$legacy_owner_marker";
+        rm -f "$system_install_marker";
         : > "$owner_marker"
       sudo: true
       ifFileExists: "~/.jishushell/apps/${app_id}/.ollama-install-needed"
@@ -107,10 +123,14 @@ lifecycle:
       successIfCommandExists: "ollama"
     - run: >-
         install_marker="$HOME/.jishushell/apps/${app_id}/.ollama-install-needed";
-        owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        owner_marker="$HOME/.jishushell/.ollama-installed-by-jishushell-${app_id}";
+        legacy_owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        system_install_marker="$HOME/.jishushell/.ollama-system-install-${app_id}";
         if [ -f "$install_marker" ] && command -v ollama >/dev/null 2>&1; then
           echo "检测到 ollama 已可用，补记为由 JishuShell 安装。" >&2;
           rm -f "$install_marker";
+          rm -f "$legacy_owner_marker";
+          rm -f "$system_install_marker";
           : > "$owner_marker";
         fi
       ifFileExists: "~/.jishushell/apps/${app_id}/.ollama-install-needed"
@@ -152,8 +172,25 @@ lifecycle:
 
   uninstall:
     - run: >-
+        owner_marker="$HOME/.jishushell/.ollama-installed-by-jishushell-${app_id}";
+        legacy_owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        system_install_marker="$HOME/.jishushell/.ollama-system-install-${app_id}";
+        uninstall_marker="$HOME/.jishushell/.ollama-uninstall-needed-${app_id}";
+        rm -f "$uninstall_marker";
+        if [ -f "$system_install_marker" ]; then
+          echo "检测到复用的是系统已有 ollama，卸载时保留系统安装。" >&2;
+          rm -f "$system_install_marker";
+        elif [ -f "$owner_marker" ] || [ -f "$legacy_owner_marker" ]; then
+          : > "$uninstall_marker";
+        fi
+    - run: >-
+        owner_marker="$HOME/.jishushell/.ollama-installed-by-jishushell-${app_id}";
+        legacy_owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
+        system_install_marker="$HOME/.jishushell/.ollama-system-install-${app_id}";
+        uninstall_marker="$HOME/.jishushell/.ollama-uninstall-needed-${app_id}";
         rm -f /usr/local/bin/ollama /usr/bin/ollama /bin/ollama;
         rm -rf /usr/local/lib/ollama /usr/lib/ollama /usr/share/ollama 2>/dev/null || true;
-        rm -f "$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell"
+        rm -rf /Applications/Ollama.app "$HOME/Applications/Ollama.app" 2>/dev/null || true;
+        rm -f "$owner_marker" "$legacy_owner_marker" "$system_install_marker" "$uninstall_marker"
       sudo: true
-      ifFileExists: "~/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell"
+      ifFileExists: "~/.jishushell/.ollama-uninstall-needed-${app_id}"

package/apps/openclaw-binary.yaml

@@ -2,7 +2,7 @@ id: openclaw-binary
 name: OpenClaw Binary
 version: "1.0.0"
 jishushell:
-  min_version: "0.4.24"
+  min_version: "0.4.30"
 agentType: openclaw
 description: "将 OpenClaw 安装到应用目录内的 npm prefix，并以 process runtime 运行网关"
 singleInstance: false
@@ -33,8 +33,37 @@ tasks:
 
 provides:
   - capability: "openclaw-dashboard"
+    task: "gateway"
     port: 18789
+    protocol: "http"
     description: "OpenClaw Dashboard"
+  - capability: "llm-agent"
+    task: "gateway"
+    port: 18789
+    protocol: "http"
+    path: "/v1"
+    description: "OpenAI-compatible agent endpoint backed by OpenClaw"
+    auth:
+      kind: "bearer"
+      tokenSource: "instance.config.gateway.auth.token"
+
+requires:
+  - capability: "llm"
+    inject_as: "LLM_ENDPOINT"
+    required: false
+    cardinality: "one"
+  - capability: "search"
+    inject_as: "SEARCH_API_BASE_URL"
+    required: false
+    cardinality: "one"
+  - capability: "browser"
+    inject_as: "BROWSER_CDP_URL"
+    required: false
+    cardinality: "one"
+  - capability: "mcp"
+    inject_as: "MCP_SERVERS"
+    required: false
+    cardinality: "many"
 
 lifecycle:
   install:

package/apps/openclaw-container.yaml

@@ -2,7 +2,7 @@ id: openclaw-container
 name: OpenClaw Container
 version: "1.0.0"
 jishushell:
-  min_version: "0.4.24"
+  min_version: "0.4.30"
 agentType: openclaw
 description: "基于 openclaw-runtime 容器运行的 OpenClaw 网关"
 singleInstance: false
@@ -33,5 +33,40 @@ tasks:
 
 provides:
   - capability: "openclaw-dashboard"
+    task: "gateway"
     port: 18789
-    description: "OpenClaw Dashboard"
+    protocol: "http"
+    description: "OpenClaw Dashboard"
+  # OpenClaw exposes OpenAI-compatible chat/completions when its config has
+  # `gateway.http.endpoints.chatCompletions.enabled = true`. The runtime
+  # adapter's startInstance hook patches openclaw.json on every start to
+  # ensure that flag is on, so any consumer binding this provider gets a
+  # working /v1/chat/completions endpoint regardless of when the instance
+  # was originally created. Auth uses the gateway token from openclaw.json.
+  - capability: "llm-agent"
+    task: "gateway"
+    port: 18789
+    protocol: "http"
+    path: "/v1"
+    description: "OpenAI-compatible agent endpoint backed by OpenClaw"
+    auth:
+      kind: "bearer"
+      tokenSource: "instance.config.gateway.auth.token"
+
+requires:
+  - capability: "llm"
+    inject_as: "LLM_ENDPOINT"
+    required: false
+    cardinality: "one"
+  - capability: "search"
+    inject_as: "SEARCH_API_BASE_URL"
+    required: false
+    cardinality: "one"
+  - capability: "browser"
+    inject_as: "BROWSER_CDP_URL"
+    required: false
+    cardinality: "one"
+  - capability: "mcp"
+    inject_as: "MCP_SERVERS"
+    required: false
+    cardinality: "many"

package/apps/openclaw-with-ollama-container.yaml

@@ -2,7 +2,7 @@ id: openclaw-with-ollama-container
 name: OpenClaw With Ollama
 version: "1.0.0"
 jishushell:
-  min_version: "0.4.24"
+  min_version: "0.4.30"
 agentType: openclaw
 description: "通过 requires 消费 ollama-api 能力，并将解析地址注入 OpenClaw 运行环境"
 singleInstance: false
@@ -39,4 +39,13 @@ tasks:
 provides:
   - capability: "openclaw-dashboard"
     port: 18789
-    description: "OpenClaw Dashboard"
+    description: "OpenClaw Dashboard"
+  - capability: "llm-agent"
+    task: "gateway"
+    port: 18789
+    protocol: "http"
+    path: "/v1"
+    description: "OpenAI-compatible agent endpoint backed by OpenClaw"
+    auth:
+      kind: "bearer"
+      tokenSource: "instance.config.gateway.auth.token"

package/apps/openclaw-with-searxng-container.yaml

@@ -2,7 +2,7 @@ id: openclaw-with-searxng-container
 name: OpenClaw With SearXNG Container
 version: "1.0.0"
 jishushell:
-  min_version: "0.4.24"
+  min_version: "0.4.30"
 agentType: openclaw
 description: "将 SearXNG 作为 sidecar 子 task 安装并运行，并注入 OpenClaw 搜索环境"
 singleInstance: false
@@ -46,7 +46,11 @@ tasks:
     args: ["gateway", "run", "--port", "18789", "--allow-unconfigured"]
     env:
       NODE_ENV: production
-      SEARCH_API_BASE_URL: "http://127.0.0.1:8080/search"
+      # SEARCH_API_BASE_URL injected by Connection apply hook (search category, §13).
+      # Single-candidate fallback (`requires: search-searxng`) auto-binds the
+      # sidecar SearXNG below on first start, so meta-app UX stays "open the
+      # box and it works".
+      SEARCH_API_BASE_URL: "${requires.SEARCH_API_BASE_URL}"
     resources:
       cpu: "1000m"
       memory: "1024Mi"
@@ -65,8 +69,24 @@ tasks:
 
 provides:
   - capability: "openclaw-dashboard"
+    task: "gateway"
     port: 18789
+    protocol: "http"
     description: "OpenClaw Dashboard"
+  - capability: "llm-agent"
+    task: "gateway"
+    port: 18789
+    protocol: "http"
+    path: "/v1"
+    description: "OpenAI-compatible agent endpoint backed by OpenClaw"
+    auth:
+      kind: "bearer"
+      tokenSource: "instance.config.gateway.auth.token"
+
+requires:
+  - capability: "search-searxng"
+    inject_as: "SEARCH_API_BASE_URL"
+    required: false
 
 lifecycle:
   install:

package/apps/openwebui-container.yaml

@@ -2,7 +2,7 @@ id: openwebui-container
 name: Open WebUI
 version: "1.0.0"
 jishushell:
-  min_version: "0.4.24"
+  min_version: "0.4.30"
 description: "使用 Open WebUI 提供自托管的大模型 Web 界面，容器模式由 Nomad 管理生命周期"
 singleInstance: false
 
@@ -11,6 +11,11 @@ tasks:
     role: service
     runtime: container
     image: "ghcr.io/open-webui/open-webui:main"
+    # Run as the panel user's uid:gid (typically pi=1000:1000). Bind-mount
+    # source `~/.jishushell/apps/${app_id}/data` is owned by the panel user,
+    # so the container can read/write it directly — no chown, no
+    # CAP_DAC_OVERRIDE, no DB readonly errors. Mirrors hermes / openclaw.
+    user: "host"
     env:
       HOME: "/app/backend/data"
       PORT: "8080"
@@ -19,6 +24,32 @@ tasks:
       HF_HOME: "/app/backend/data/.cache/huggingface"
       TRANSFORMERS_CACHE: "/app/backend/data/.cache/huggingface/transformers"
       SENTENCE_TRANSFORMERS_HOME: "/app/backend/data/.cache/sentence-transformers"
+      # OpenWebUI's start.sh writes a generated WEBUI_SECRET_KEY to a key
+      # file. The default path is `.webui_secret_key` in the image's
+      # /app/backend WORKDIR, which is owned by root and unwritable when
+      # running as uid 1000. Redirect to the bind-mounted (and writable)
+      # data dir so the key persists across restarts and survives image
+      # upgrades.
+      WEBUI_SECRET_KEY_FILE: "/app/backend/data/.webui_secret_key"
+      # Open WebUI marks OPENAI_API_BASE_URL / OPENAI_API_KEY as PersistentConfig:
+      # without this flag, the first start writes them to the internal DB and
+      # subsequent restarts ignore env, defeating Connections "Save & Restart"
+      # rebinds. Disabling persistent config means the Admin UI's manual
+      # OpenAI config doesn't survive restarts — that's the trade-off
+      # JishuShell takes to own LLM configuration via Connections (§13.3.2.1).
+      ENABLE_PERSISTENT_CONFIG: "False"
+      # JishuShell ships Open WebUI as a chat front-end only — RAG /
+      # reranker / Whisper STT all need ML model downloads from
+      # HuggingFace at first boot (~500 MB – 1.5 GB). On slow outbound
+      # networks (Raspberry Pi behind throttled NAT) this blocks
+      # health checks for hours. Bypassing them keeps the boot path
+      # to "FastAPI up in <30s". Users who want RAG/STT can flip these
+      # back from Admin UI and accept the one-time download.
+      BYPASS_EMBEDDING_AND_RETRIEVAL: "True"
+      RAG_EMBEDDING_MODEL: ""
+      RAG_RERANKING_MODEL: ""
+      WHISPER_MODEL: ""
+      AUDIO_STT_ENGINE: ""
     resources:
       cpu: "1000m"
       memory: "1024Mi"
@@ -41,10 +72,23 @@ tasks:
 
 provides:
   - capability: "openwebui-web"
+    task: "openwebui"
+    port: 3000
+    protocol: "http"
+    description: "Open WebUI Web 界面（legacy capability，请改用 web-openwebui）"
+  - capability: "web-openwebui"
+    task: "openwebui"
     port: 3000
     protocol: "http"
     description: "Open WebUI Web 界面"
 
+requires:
+  - capability: "llm"
+    inject_as: "OPENAI_API_BASE_URL"
+    apply: "openai-env"
+    cardinality: "one"
+    required: false
+
 lifecycle:
   install:
     - downloadImage: "ghcr.io/open-webui/open-webui:main"

package/apps/playwright-container.yaml

@@ -2,7 +2,7 @@ id: playwright-container
 name: Playwright
 version: "1.0.0"
 jishushell:
-  min_version: "0.4.24"
+  min_version: "0.4.30"
 description: "在容器中启动 Playwright UI，通过浏览器查看和管理测试运行"
 singleInstance: false
 
@@ -52,9 +52,15 @@ tasks:
 
 provides:
   - capability: "playwright-ui"
+    task: "playwright-ui"
     port: 14567
     protocol: "http"
     description: "Playwright UI Web 界面"
+  # browser-playwright (CDP endpoint) is TODO — needs a sidecar task that runs
+  # `npx playwright launch-server --browser chromium --hostname 0.0.0.0`,
+  # captures the token-bearing ws URL into a file/env, and registers it as a
+  # capability with protocol=ws. Until the sidecar lands, OpenClaw / Hermes
+  # browser slots cannot bind to this app via the Connections UI.
 
 lifecycle:
   install: