jishushell 0.4.24-beta.2 → 0.4.30

package/dist/services/llm-proxy/ssrf.js

@@ -1,6 +1,7 @@
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { lookup } from "dns/promises";
+import { isIP } from "net";
 import { Readable } from "stream";
 // SSRF protection — private IP ranges
 const PRIVATE_HOST_PATTERNS = [
@@ -18,8 +19,14 @@ const PRIVATE_HOST_PATTERNS = [
 ];
 export const LOCAL_PROVIDER_IDS = new Set(["ollama", "vllm", "sglang", "custom"]);
 const LOCALHOST_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
-function isPrivateHost(hostname) {
+function isLinkLocalHost(hostname) {
+    const cleaned = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    return cleaned.startsWith("169.254.") || cleaned.startsWith("fe80:");
+}
+export function isPrivateHost(hostname) {
     const cleaned = hostname.replace(/^\[|\]$/g, "");
+    if (isIP(cleaned) && isPrivateIP(cleaned))
+        return true;
     return PRIVATE_HOST_PATTERNS.some((p) => p.test(cleaned));
 }
 function isPrivateIP(ip) {
@@ -85,21 +92,22 @@ function isPrivateIP(ip) {
 export async function validateUpstreamUrl(urlStr, providerId) {
     try {
         const url = new URL(urlStr);
+        if (url.protocol !== "http:" && url.protocol !== "https:") {
+            throw new Error("upstream URL must use http:// or https://");
+        }
         const isLocalHost = LOCALHOST_HOSTS.has(url.hostname);
         if (LOCAL_PROVIDER_IDS.has(providerId)) {
             // Local AI providers (ollama/vllm/sglang): allow localhost and private
             // networks, but block cloud metadata endpoints (169.254.x.x link-local).
             if (isLocalHost)
                 return null;
-            if (url.hostname.startsWith("169.254.")) {
+            if (isLinkLocalHost(url.hostname)) {
                 throw new Error(`Local provider URL must not target link-local/metadata address ${url.hostname}`);
             }
             // Allow private LAN addresses (192.168.x, 10.x, 172.16-31.x) — admin explicitly configured
             return null;
         }
-        // Even for remote providers, if destination is localhost, skip DNS pinning
-        // but still allow it (reverse-proxy setups). Do NOT skip SSRF for
-        // non-localhost destinations just because providerId looks local.
+        // Preserve explicit localhost reverse-proxy setups for remote providers.
         if (isLocalHost)
             return null;
         if (isPrivateHost(url.hostname)) {
@@ -119,9 +127,12 @@ export async function validateUpstreamUrl(urlStr, providerId) {
         }
     }
     catch (err) {
-        if (err.message.includes("private address") || err.message.includes("private IP"))
+        if (err.message.includes("private address") ||
+            err.message.includes("private IP") ||
+            err.message.includes("must use http") ||
+            err.message.includes("link-local"))
             throw err;
-        throw new Error(`invalid upstream URL: ${urlStr}`);
+        throw new Error("invalid upstream URL");
     }
 }
 /**

package/dist/services/llm-proxy/ssrf.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../../src/services/llm-proxy/ssrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,OAAO,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGlC,sCAAsC;AACtC,MAAM,qBAAqB,GAAG;IAC5B,QAAQ;IACR,OAAO;IACP,4BAA4B;IAC5B,aAAa;IACb,aAAa;IACb,MAAM;IACN,cAAc;IACd,aAAa;IACb,SAAS;IACT,SAAS;IACT,YAAY;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAClF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5E,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC7B,oCAAoC;IACpC,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAEpC,gEAAgE;IAChE,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,mFAAmF;IACnF,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,mCAAmC;YACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;YACrD,gDAAgD;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7B,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAO,mDAAmD;IACpG,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAO,aAAa;IAC/D,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,CAAM,yBAAyB;IAC3E,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,CAAE,gBAAgB;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,CAAE,iBAAiB;IACnE,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,CAAE,8BAA8B;IAChF,sDAAsD;IACtD,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,CAAE,gBAAgB;IACnE,CAAC;IAED,0CAA0C;IAC1C,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACjH,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,UAAkB;IAC1E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,uEAAuE;YACvE,yEAAyE;YACzE,IAAI,WAAW;gBAAE,OAAO,IAAI,CAAC;YAC7B,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,2FAA2F;YAC3F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,2EAA2E;QAC3E,kEAAkE;QAClE,kEAAkE;QAClE,IAAI,WAAW;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC;QAC9C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC;gBAAE,MAAM,CAAC,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,MAAM,GAAG,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,GAAW,EACX,OAAgG,EAChG,QAAyB;IAEzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAEvD,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,GAAG,IAAW,EAAE,EAAE;YACtC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,GAAG,GAAG,SAAS,CACnB;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;YACrC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE;YAC5E,MAAM,EAAE,YAAmB;SAC5B,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAA0B,CAAmB,CAAC;YAC/E,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,KAAK,SAAS;oBAAE,SAAS;gBAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAC,KAAK,MAAM,GAAG,IAAI,CAAC;wBAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAAC,CAAC;;oBAC3D,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,OAAO,CAAC,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClF,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../../src/services/llm-proxy/ssrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,OAAO,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGlC,sCAAsC;AACtC,MAAM,qBAAqB,GAAG;IAC5B,QAAQ;IACR,OAAO;IACP,4BAA4B;IAC5B,aAAa;IACb,aAAa;IACb,MAAM;IACN,cAAc;IACd,aAAa;IACb,SAAS;IACT,SAAS;IACT,YAAY;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAClF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5E,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC7B,oCAAoC;IACpC,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAEpC,gEAAgE;IAChE,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,mFAAmF;IACnF,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,mCAAmC;YACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;YACrD,gDAAgD;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7B,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAO,mDAAmD;IACpG,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAO,aAAa;IAC/D,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,CAAM,yBAAyB;IAC3E,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,CAAE,gBAAgB;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,CAAE,iBAAiB;IACnE,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,CAAE,8BAA8B;IAChF,sDAAsD;IACtD,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,CAAE,gBAAgB;IACnE,CAAC;IAED,0CAA0C;IAC1C,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACjH,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,UAAkB;IAC1E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,uEAAuE;YACvE,yEAAyE;YACzE,IAAI,WAAW;gBAAE,OAAO,IAAI,CAAC;YAC7B,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,kEAAkE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,2FAA2F;YAC3F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,yEAAyE;QACzE,IAAI,WAAW;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC;QAC9C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC;gBAAE,MAAM,CAAC,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IACE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAClC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;YACrC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAClC,MAAM,GAAG,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,GAAW,EACX,OAAgG,EAChG,QAAyB;IAEzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAEvD,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,GAAG,IAAW,EAAE,EAAE;YACtC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,GAAG,GAAG,SAAS,CACnB;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;YACrC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE;YAC5E,MAAM,EAAE,YAAmB;SAC5B,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAA0B,CAAmB,CAAC;YAC/E,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,KAAK,SAAS;oBAAE,SAAS;gBAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAC,KAAK,MAAM,GAAG,IAAI,CAAC;wBAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAAC,CAAC;;oBAC3D,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,OAAO,CAAC,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClF,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtB,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/nomad-manager.js

@@ -415,6 +415,20 @@ function getInstanceAgentType(instanceId) {
     }
 }
 function wrapNomadJob(jid, groupName, task) {
+    // Adapters declare port reservations on `task.Resources.Networks` (legacy
+    // schema). The docker driver's `Config.ports = [<label>]` lookup, however,
+    // resolves labels against the TaskGroup-level `Networks` block. Move (not
+    // copy) the network block so the docker driver can find the port and so
+    // HostNetwork ("external") is honored — without this, ports publish to
+    // 127.0.0.1 by default. Keeping it on both levels would make Nomad reject
+    // the job with "port label already in use".
+    const taskNetworks = Array.isArray(task?.Resources?.Networks)
+        ? task.Resources.Networks
+        : [];
+    const groupNetworks = taskNetworks.length > 0 ? taskNetworks.map((n) => ({ ...n })) : undefined;
+    if (groupNetworks && task?.Resources && typeof task.Resources === "object") {
+        delete task.Resources.Networks;
+    }
     return {
         Job: {
             ID: jid,
@@ -425,6 +439,7 @@ function wrapNomadJob(jid, groupName, task) {
             TaskGroups: [{
                     Name: groupName,
                     Count: 1,
+                    ...(groupNetworks ? { Networks: groupNetworks } : {}),
                     RestartPolicy: {
                         Attempts: 3,
                         Interval: 300000000000,
@@ -457,6 +472,7 @@ async function buildJob(instanceId) {
     if (legacyManager) {
         const runtime = legacyManager.buildRuntime(instanceId);
         const task = legacyManager.buildNomadTask(instanceId, runtime, jid);
+        await injectConnectionsRuntimeEnv(instanceId, task);
         return wrapNomadJob(jid, legacyManager.nomadTaskGroupName(), task);
     }
     // Pure adapter dispatch — no more `isHermesInstance()` / kind literals.
@@ -466,11 +482,54 @@ async function buildJob(instanceId) {
         throw new Error(`Runtime adapter "${agentType}" does not implement buildNomadTask(); cannot schedule Nomad job`);
     }
     const task = await adapter.buildNomadTask(instanceId);
+    await injectConnectionsRuntimeEnv(instanceId, task);
     // Task group name mirrors the agentType. Log/status helpers resolve the
     // Nomad task name via resolveTaskName(instanceId) → adapter.nomadTaskName.
     const groupName = agentType;
     return wrapNomadJob(jid, groupName, task);
 }
+/**
+ * Re-resolve `instance.connections` against the live capability registry
+ * and merge the resulting env into the freshly-built Nomad task. Idempotent
+ * — empty meta.connections short-circuits to a no-op.
+ *
+ * Resolving at start time (rather than reading the frozen
+ * `instance.json["connections-env"]` written by PUT /connections) means
+ * provider port / address changes in the registry propagate on next
+ * restart without requiring the user to re-bind. Failures here are
+ * logged but never block start: a missing required binding still surfaces
+ * via the Connections UI status badge.
+ */
+async function injectConnectionsRuntimeEnv(instanceId, task) {
+    try {
+        const meta = getInstance(instanceId);
+        const connections = meta?.connections;
+        if (!meta || !connections || Object.keys(connections).length === 0)
+            return;
+        const { loadCapabilitySpecForLegacyInstance } = await import("./runtime/migrations.js");
+        const spec = loadCapabilitySpecForLegacyInstance(meta);
+        if (!spec)
+            return;
+        const { resolveConnections } = await import("./connection-resolver.js");
+        const { resolved } = resolveConnections(spec, { connections }, "preCreate");
+        if (resolved.length === 0)
+            return;
+        const { RUNTIME_HOOKS } = await import("./connection-apply.js");
+        const merged = {};
+        for (const binding of resolved) {
+            const hook = RUNTIME_HOOKS[binding.category];
+            if (!hook)
+                continue;
+            Object.assign(merged, await hook(meta, binding));
+        }
+        if (Object.keys(merged).length === 0)
+            return;
+        task.Env = { ...(task.Env ?? {}), ...merged };
+    }
+    catch (e) {
+        console.warn(`[nomad] connections runtime env merge failed for ${instanceId}: ${e?.message ?? e}`);
+    }
+}
 async function getRunningAlloc(instanceId) {
     const jid = jobId(instanceId);
     try {
@@ -607,7 +666,7 @@ export async function getStatus(instanceId) {
 async function phaseRunningCheck(instanceId) {
     const status = await getStatus(instanceId);
     if (status.status === "running") {
-        return { ok: false, error: "Instance is already running" };
+        return { ok: false, error: "Instance is already running", code: "INSTANCE_ALREADY_RUNNING" };
     }
     return { ok: true };
 }
@@ -674,6 +733,81 @@ async function phasePreStartHook(adapter, instanceId) {
         return { ok: false, error: e?.message || String(e) };
     }
 }
+/**
+ * §17 / PR 9 — re-render adapter-managed connection config from the
+ * current capability registry before each instance start.
+ *
+ * Without this hook, env values (like `SEARCH_API_BASE_URL` =
+ * `http://<host>:<port>/search`) are frozen into the adapter's config
+ * files at PUT /connections time. When the host IP changes (DHCP
+ * renewal, pi reboot picking up a new lease, network move) or a
+ * provider gets re-deployed at a different host:port, the consumer
+ * keeps trying the stale address and search/llm/etc. silently fail.
+ *
+ * What this does on every start:
+ *   1. Read connections from instance.json
+ *   2. Re-resolve them in `runtime` mode (tolerant: ambiguous/missing
+ *      becomes empty resolved instead of throwing — start should still
+ *      proceed even if one binding can't be re-rendered)
+ *   3. Collect env via the same persist hooks PUT /connections uses
+ *   4. Call adapter.applyConnectionEnv with the fresh env so the
+ *      adapter rewrites its config files (mcp_servers / openclaw.json /
+ *      etc.) with the current address
+ *
+ * Failures here are logged but never block start: a stale config is
+ * better than no start. If something is genuinely wrong with the
+ * registry, the user will see a connection error in the UI on next
+ * use — at which point they can re-bind manually.
+ */
+async function phaseRefreshConnections(adapter, instanceId) {
+    if (!adapter.applyConnectionEnv)
+        return;
+    try {
+        const meta = getInstance(instanceId);
+        const connections = meta?.connections;
+        if (!meta || !connections || Object.keys(connections).length === 0)
+            return;
+        const { loadCapabilitySpecForLegacyInstance } = await import("./runtime/migrations.js");
+        const spec = loadCapabilitySpecForLegacyInstance(meta);
+        if (!spec)
+            return;
+        const { resolveConnections } = await import("./connection-resolver.js");
+        const { resolved } = resolveConnections(spec, { connections }, "preCreate");
+        if (resolved.length === 0)
+            return;
+        const { PERSIST_HOOKS } = await import("./connection-apply.js");
+        const merged = {};
+        const seenEnvKeys = new Set();
+        // Accumulate env across all resolved bindings via a stub
+        // writeConnectionEnv that just collects into `merged`. We don't
+        // run the real persist hooks here because those would re-write
+        // generic-app `connections-env` (already handled by
+        // injectConnectionsRuntimeEnv); we only want the env so we can
+        // pass it to adapter.applyConnectionEnv below.
+        const stubCtx = {
+            registry: await import("./capability-registry.js"),
+            adapter: { applyConnectionEnv: undefined },
+            async writeConnectionEnv(_inst, env) {
+                for (const [k, v] of Object.entries(env)) {
+                    merged[k] = v;
+                    seenEnvKeys.add(k);
+                }
+            },
+        };
+        for (const binding of resolved) {
+            const hook = PERSIST_HOOKS[binding.category];
+            if (!hook)
+                continue;
+            await hook(meta, binding, stubCtx);
+        }
+        if (seenEnvKeys.size === 0)
+            return;
+        await adapter.applyConnectionEnv(instanceId, merged);
+    }
+    catch (e) {
+        console.warn(`[nomad] connections refresh failed for ${instanceId}: ${e?.message ?? e}`);
+    }
+}
 /**
  * Phase 5: submit to Nomad with a single retry on port race. Between our
  * earlier host probe and Docker's actual bind another process could have
@@ -741,8 +875,12 @@ export async function startInstance(instanceId) {
         return { ok: false, phase, ...rest };
     };
     const running = await phaseRunningCheck(instanceId);
-    if (!running.ok)
-        return failed("running_check", { error: running.error });
+    if (!running.ok) {
+        const extra = { error: running.error };
+        if (running.code)
+            extra.code = running.code;
+        return failed("running_check", extra);
+    }
     const legacyManager = await getLegacyAppManager(instanceId);
     if (legacyManager) {
         const prep = await legacyManager.prepareStart(instanceId);
@@ -761,6 +899,11 @@ export async function startInstance(instanceId) {
         const home = await phaseHomeConflict(instanceId, adapter.findInstancesSharingHome?.(instanceId) ?? []);
         if (!home.ok)
             return failed("home_conflict", { error: home.error });
+        // PR 9 — refresh adapter-managed connection config from current
+        // capability registry before adapter pre-start. Best-effort: never
+        // blocks start (any failure is logged and we proceed with the
+        // existing on-disk config). See phaseRefreshConnections doc.
+        await phaseRefreshConnections(adapter, instanceId);
         const hook = await phasePreStartHook(adapter, instanceId);
         if (!hook.ok) {
             const extra = { error: hook.error };
@@ -777,12 +920,65 @@ export async function startInstance(instanceId) {
     const submit = await phaseSubmit(instanceId, port.portAllocation);
     if (!submit.ok)
         return failed("submit", { error: submit.error });
+    // Auto-register capability providers for legacy instances so they appear
+    // in the Connections UI alongside app-installed apps. App-dir installed
+    // apps short-circuit at the top of this function and don't reach here.
+    await registerLegacyCapabilitiesTopLevel(instanceId);
     return {
         ok: true,
         eval_id: submit.evalId,
         ...(submit.portAllocation ? { port_allocation: submit.portAllocation } : {}),
     };
 }
+/**
+ * Best-effort capability registration for legacy (non-app-installed)
+ * hermes/openclaw instances. Loaded synthetic spec via the migrations
+ * helper; failures are logged but never block start/stop.
+ */
+async function registerLegacyCapabilitiesTopLevel(instanceId) {
+    try {
+        const meta = getInstance(instanceId);
+        if (!meta)
+            return;
+        const { loadCapabilitySpecForLegacyInstance } = await import("./runtime/migrations.js");
+        const synthSpec = loadCapabilitySpecForLegacyInstance(meta);
+        if (!synthSpec?.provides?.length)
+            return;
+        // The synthetic spec's `name` is the yaml template's display name
+        // ("Hermes Agent" / "OpenClaw Container"). For Connections-tab UX we
+        // want the candidate to surface the user's instance name (e.g. "h",
+        // "claw11"), so override before handing it to registerCapabilities.
+        const instanceName = typeof meta.name === "string" && meta.name
+            ? meta.name
+            : instanceId;
+        const namedSpec = { ...synthSpec, name: instanceName };
+        // The synthetic spec has `tasks: []`, so `resolveProvideEndpoint`
+        // can't compute the actual gateway port and falls back to the yaml's
+        // declared port (e.g. openclaw default 18789). Legacy instances may
+        // have been allocated a different port at creation time (port
+        // collision avoidance). Pass the live `getGatewayPort` so the
+        // capability registry advertises the port consumers can actually
+        // reach.
+        const portOverride = getGatewayPort(instanceId);
+        const { registerCapabilities } = await import("./app/app-manager.js");
+        registerCapabilities(instanceId, namedSpec, portOverride > 0 ? portOverride : undefined);
+    }
+    catch (e) {
+        console.warn(`[legacy-capabilities] register failed for ${instanceId}: ${e?.message ?? e}`);
+    }
+}
+async function unregisterLegacyCapabilitiesTopLevel(instanceId, purge) {
+    try {
+        const { markCapabilitiesStopped, unregisterCapabilities } = await import("./app/app-manager.js");
+        if (purge)
+            unregisterCapabilities(instanceId);
+        else
+            markCapabilitiesStopped(instanceId);
+    }
+    catch (e) {
+        console.warn(`[legacy-capabilities] unregister failed for ${instanceId}: ${e?.message ?? e}`);
+    }
+}
 export async function stopInstance(instanceId, purge = false) {
     const jid = jobId(instanceId);
     try {
@@ -794,10 +990,14 @@ export async function stopInstance(instanceId, purge = false) {
                 }
                 catch { /* ignore */ }
             }
+            await unregisterLegacyCapabilitiesTopLevel(instanceId, purge);
             return { ok: true };
         }
-        if (resp.status === 404)
+        if (resp.status === 404) {
+            // Already stopped — still mark capabilities stopped so the UI reflects state.
+            await unregisterLegacyCapabilitiesTopLevel(instanceId, purge);
             return { ok: false, error: "Instance is not running" };
+        }
         return { ok: false, error: await resp.text() };
     }
     catch (e) {
@@ -828,6 +1028,11 @@ export async function restartInstance(instanceId) {
                 const meta = getInstance(instanceId);
                 const agentType = resolveAgentType(meta);
                 const adapter = getAdapter(agentType);
+                // PR 9 — refresh connection-derived config (mcp_servers /
+                // openclaw.json plugins) from current capability registry so
+                // host IP changes propagate on restart without manual re-bind.
+                // Symmetric with the same call in startInstance.
+                await phaseRefreshConnections(adapter, instanceId);
                 if (adapter.hooks?.onBeforeStart) {
                     await adapter.hooks.onBeforeStart({ instanceId });
                 }
@@ -841,8 +1046,12 @@ export async function restartInstance(instanceId) {
                 TaskName: resolveTaskName(instanceId),
                 AllTasks: false,
             });
-            if (resp.ok)
+            if (resp.ok) {
+                // Re-register capabilities — yaml provides may have changed since
+                // the last start (e.g. a panel upgrade adding `llm-agent`).
+                await registerLegacyCapabilitiesTopLevel(instanceId);
                 return { ok: true, alloc_id: alloc.ID };
+            }
             // Non-2xx from the restart endpoint falls through to stop+start
             const errText = await resp.text();
             console.warn(`[nomad] Native restart failed for ${instanceId} (HTTP ${resp.status}): ${errText} — falling back to stop+start`);
@@ -1228,7 +1437,8 @@ var UnifiedNomadJobs;
         return nomadConfigDeclaresHostNetwork("external") ? "external" : undefined;
     }
     function specRequiresExternalHostNetwork(spec) {
-        return spec.tasks.some((task) => (task.ports ?? []).some((port) => (port.visibility ?? "external") !== "internal"));
+        return spec.tasks.some((task) => task.runtime !== "container"
+            && (task.ports ?? []).some((port) => (port.visibility ?? "external") !== "internal"));
     }
     async function validateRequiredHostNetworks(spec) {
         if (!specRequiresExternalHostNetwork(spec))
@@ -1268,7 +1478,18 @@ var UnifiedNomadJobs;
             Label: portLabel(task.name, port.name),
             Value: port.host_port ?? port.port,
             ...(task.runtime === "container" ? { To: port.container_port ?? port.port } : {}),
-            ...(hostNetworkForPort(port) ? { HostNetwork: hostNetworkForPort(port) } : {}),
+            // Attach the named host_network for any externally-visible port —
+            // including container tasks. Without it, Nomad falls back to
+            // HostNetwork="default" (loopback) and the docker driver publishes
+            // to 127.0.0.1, breaking cross-container consumers (e.g. OpenWebUI
+            // calling hermes / openclaw via the connections page). The earlier
+            // restriction to non-container tasks was overcautious — our task
+            // groups use host networking (Mode: "") rather than Nomad bridge
+            // mode, so attaching host_network is safe and is exactly what
+            // searxng-container has been doing in practice all along.
+            ...(hostNetworkForPort(port)
+                ? { HostNetwork: hostNetworkForPort(port) }
+                : {}),
         }));
     }
     // ── Health check → Nomad service check builder ────────────────────────────
@@ -2013,12 +2234,52 @@ var UnifiedNomadJobs;
             const src = v.source.replace(/^~(?=\/|$)/, homedir());
             return `${src}:${v.target}${v.readonly ? ":ro" : ":rw"}`;
         });
+        // Resolve container task user. On Linux we default to the panel
+        // process's host uid:gid so bind-mounted data dirs (owned by the panel
+        // user, typically `pi`) are writable without forcing the container to
+        // run as root and without needing chown / DAC_OVERRIDE gymnastics.
+        // yaml override `user: "<uid>:<gid>"` wins; explicit `user: "root"` or
+        // `user: "0:0"` keeps the image's root default.
+        //
+        // On macOS we skip the host-uid default. Docker on Mac runs inside a
+        // Linux VM (Colima/Docker Desktop) with its own uid namespace — host
+        // uids like 501 (the standard macOS first-user) are virtualised away
+        // by virtiofs and almost never exist in the image's /etc/passwd. Some
+        // images crash hard when started as an unknown uid: e.g. browserless
+        // calls Node.js `os.userInfo()` very early, which throws
+        // `uv_os_get_passwd returned ENOENT` and the container exits before
+        // the port ever binds. Letting the image's default USER directive
+        // take effect is correct on Mac; users who do need bind-mount
+        // ownership control can still set yaml `user:` explicitly.
+        const containerUser = (() => {
+            if (task.runtime !== "container")
+                return undefined;
+            const declared = typeof task.user === "string" ? task.user.trim() : "";
+            if (declared === "host" || declared === "") {
+                if (process.platform === "darwin")
+                    return undefined;
+                const uid = process.getuid?.() ?? 1000;
+                const gid = process.getgid?.() ?? 1000;
+                return `${uid}:${gid}`;
+            }
+            return declared;
+        })();
         const taskDef = {
             Name: task.name,
             Driver: "docker",
+            ...(containerUser ? { User: containerUser } : {}),
             Config: {
                 image,
                 force_pull: false,
+                // Nomad's docker driver default `image_pull_timeout` is 5 minutes;
+                // on Raspberry Pi or other constrained networks a 1+ GiB image
+                // (Open WebUI, OpenClaw, Hermes) can exceed that and the alloc
+                // restart-loops with "Failed to pull: context deadline exceeded"
+                // before it ever starts. Raise to 15 minutes — long enough for
+                // realistic Pi-class pulls, short enough that a genuinely
+                // unreachable registry still surfaces as a failure within a
+                // bounded window.
+                image_pull_timeout: "15m",
                 ...(task.command ? { command: String(task.command) } : {}),
                 args,
                 ...(publishedPorts.length > 0 ? { ports: publishedPorts } : {}),
@@ -2602,6 +2863,10 @@ var UnifiedNomadJobs;
         if (nomadStopped) {
             const allocsStopped = await waitForAllocationsToStop(liveAllocIds);
             if (!allocsStopped) {
+                const lingeringAlloc = await getRunningAlloc(appId);
+                if (!lingeringAlloc) {
+                    return { ok: true };
+                }
                 return { ok: false, error: `App '${appId}' allocations did not stop in time` };
             }
             return { ok: true };
@@ -3155,16 +3420,87 @@ var UnifiedNomadJobs;
         return getGenericJobStatus(nomadJobId);
     }
     UnifiedNomadJobs.getInstanceStatus = getInstanceStatus;
+    /**
+     * Capability registration shim for **legacy** (non-app-installed)
+     * hermes/openclaw instances. Loads the synthetic spec via
+     * loadCapabilitySpecForLegacyInstance and routes provides through the
+     * app-manager registry helpers, so legacy instances surface in
+     * Connections candidate lists like app-installed ones.
+     *
+     * Errors are swallowed and logged — capability registration is best-
+     * effort; a failure here must not block start/stop.
+     */
+    async function registerLegacyCapabilities(instanceId) {
+        try {
+            const meta = getInstance(instanceId);
+            if (!meta)
+                return;
+            const { loadCapabilitySpecForLegacyInstance } = await import("./runtime/migrations.js");
+            const synthSpec = loadCapabilitySpecForLegacyInstance(meta);
+            if (!synthSpec?.provides?.length)
+                return;
+            // Same instance-name override + portOverride passthrough as
+            // registerLegacyCapabilitiesTopLevel — Connections candidates should
+            // show the user's instance name and advertise the actually-allocated
+            // gateway port (not the yaml default).
+            const instanceName = typeof meta.name === "string" && meta.name
+                ? meta.name
+                : instanceId;
+            const namedSpec = { ...synthSpec, name: instanceName };
+            const portOverride = getGatewayPort(instanceId);
+            const { registerCapabilities } = await import("./app/app-manager.js");
+            registerCapabilities(instanceId, namedSpec, portOverride > 0 ? portOverride : undefined);
+        }
+        catch (e) {
+            console.warn(`[legacy-capabilities] register failed for ${instanceId}: ${e?.message ?? e}`);
+        }
+    }
+    async function unregisterLegacyCapabilities(instanceId, purge) {
+        try {
+            const { markCapabilitiesStopped, unregisterCapabilities } = await import("./app/app-manager.js");
+            if (purge) {
+                unregisterCapabilities(instanceId);
+            }
+            else {
+                markCapabilitiesStopped(instanceId);
+            }
+        }
+        catch (e) {
+            console.warn(`[legacy-capabilities] unregister failed for ${instanceId}: ${e?.message ?? e}`);
+        }
+    }
     async function startInstance(nomadJobId) {
         const instanceBackedApp = await getInstanceBackedInstalledApp(nomadJobId);
         if (instanceBackedApp) {
+            // PR 3 sub-step 3d: switch to resolveConnections in runtime mode so
+            // missing required producers / ambiguous prefix candidates throw with
+            // structured codes (412 / 409 / 400). Read the live instance.json so
+            // UI bindings persisted via PUT /connections (PR 4) drive the
+            // resolution; fall back to a stub `{ connections: {} }` when the
+            // instance file isn't readable yet.
             let extraEnv = {};
             try {
-                const { resolveRequires } = await import("./app/app-manager.js");
-                extraEnv = resolveRequires(instanceBackedApp.spec);
+                const { resolveConnections, resolvedToLegacyEnv } = await import("./connection-resolver.js");
+                const legacyInstanceManager = await import("./instance-manager.js");
+                const meta = legacyInstanceManager.getInstance(nomadJobId);
+                const instance = { connections: meta?.connections ?? {} };
+                // Validate in runtime mode so missing required / ambiguous still throws
+                // with structured error codes (412 / 409 / 400) before we touch Nomad.
+                const { resolved } = resolveConnections(instanceBackedApp.spec, instance, "runtime");
+                // Render the full RUNTIME_HOOKS env (covers llm/search/browser/mcp)
+                // rather than just the default-category subset, so apply: openai-env
+                // consumers (e.g. OpenWebUI) self-heal across provider port changes.
+                const { renderRuntimeConnectionsEnv } = await import("./connection-apply.js");
+                const runtimeEnv = await renderRuntimeConnectionsEnv(instanceBackedApp.spec, { id: nomadJobId, connections: instance.connections });
+                extraEnv = { ...resolvedToLegacyEnv(resolved), ...runtimeEnv };
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return {
+                    ok: false,
+                    error: e.message,
+                    ...(e.code ? { code: e.code } : {}),
+                    ...(typeof e.statusCode === "number" ? { statusCode: e.statusCode } : {}),
+                };
             }
             const depCheck = await checkDependencies(instanceBackedApp.spec);
             if (!depCheck.ok) {
@@ -3189,10 +3525,17 @@ var UnifiedNomadJobs;
             return { ok: false, error: `App '${nomadJobId}' 必须通过 app-manager 启动` };
         }
         if (existsSync(instanceMetaPath(nomadJobId))) {
-            return instanceScheduler.startInstance(nomadJobId);
+            const result = await instanceScheduler.startInstance(nomadJobId);
+            if (result.ok)
+                await registerLegacyCapabilities(nomadJobId);
+            return result;
         }
         if (nomadJobId.startsWith(OPENCLAW_PREFIX)) {
-            return instanceScheduler.startInstance(nomadJobId.slice(OPENCLAW_PREFIX.length));
+            const inner = nomadJobId.slice(OPENCLAW_PREFIX.length);
+            const result = await instanceScheduler.startInstance(inner);
+            if (result.ok)
+                await registerLegacyCapabilities(inner);
+            return result;
         }
         if (!isAppJob(nomadJobId)) {
             return { ok: false, error: `Cannot start unmanaged job "${nomadJobId}"` };
@@ -3213,10 +3556,19 @@ var UnifiedNomadJobs;
             return { ok: false, error: `App '${nomadJobId}' 必须通过 app-manager 停止` };
         }
         if (existsSync(instanceMetaPath(nomadJobId))) {
-            return instanceScheduler.stopInstance(nomadJobId, purge);
+            const result = await instanceScheduler.stopInstance(nomadJobId, purge);
+            if (result.ok || result.error?.includes("not running") || result.error?.includes("not found")) {
+                await unregisterLegacyCapabilities(nomadJobId, purge);
+            }
+            return result;
         }
         if (nomadJobId.startsWith(OPENCLAW_PREFIX)) {
-            return instanceScheduler.stopInstance(nomadJobId.slice(OPENCLAW_PREFIX.length), purge);
+            const inner = nomadJobId.slice(OPENCLAW_PREFIX.length);
+            const result = await instanceScheduler.stopInstance(inner, purge);
+            if (result.ok || result.error?.includes("not running") || result.error?.includes("not found")) {
+                await unregisterLegacyCapabilities(inner, purge);
+            }
+            return result;
         }
         try {
             const resp = await nomadDelete(`/v1/job/${nomadJobId}?purge=${purge}`);
@@ -3239,10 +3591,17 @@ var UnifiedNomadJobs;
             return { ok: false, error: `App '${nomadJobId}' 必须通过 app-manager 重启` };
         }
         if (existsSync(instanceMetaPath(nomadJobId))) {
-            return instanceScheduler.restartInstance(nomadJobId);
+            const result = await instanceScheduler.restartInstance(nomadJobId);
+            if (result.ok)
+                await registerLegacyCapabilities(nomadJobId);
+            return result;
         }
         if (nomadJobId.startsWith(OPENCLAW_PREFIX)) {
-            return instanceScheduler.restartInstance(nomadJobId.slice(OPENCLAW_PREFIX.length));
+            const inner = nomadJobId.slice(OPENCLAW_PREFIX.length);
+            const result = await instanceScheduler.restartInstance(inner);
+            if (result.ok)
+                await registerLegacyCapabilities(inner);
+            return result;
         }
         if (!isAppJob(nomadJobId)) {
             return { ok: false, error: `Cannot restart unmanaged job "${nomadJobId}"` };