jishushell 0.4.30 → 0.5.22

package/dist/services/setup-manager.js

@@ -1,6 +1,6 @@
 import { execFileSync, execSync, spawn as nodeSpawn } from "child_process";
 import { chmodSync, copyFileSync, existsSync, mkdtempSync, readFileSync, renameSync, rmSync, symlinkSync, unlinkSync } from "fs";
-import { userInfo, platform as osPlatform } from "node:os";
+import { userInfo, platform as osPlatform, arch as osArch, cpus as osCpus } from "node:os";
 import { randomBytes } from "node:crypto";
 import { tmpdir } from "node:os";
 import { dirname, join } from "path";
@@ -8,7 +8,8 @@ import { StringDecoder } from "string_decoder";
 import { fileURLToPath } from "url";
 import { JISHUSHELL_HOME, getPanelConfig, savePanelConfig, setOpenclawDockerImage, getOpenclawDockerImage, DEFAULT_OPENCLAW_DOCKER_IMAGE, getRuntimeCatalogEntry, OPENCLAW_MODULES, OPENCLAW_BIN_DIR, } from "../config.js";
 import { ensureDirContainer, ensureDirHost, writeConfigFile, writeSecretFile, writeExecutableFile, writeSystemTmpFile } from "../utils/fs.js";
-import { buildDockerClientEnv, managedColimaSocketPath, resolveDockerHost } from "../utils/docker-host.js";
+import { buildDockerClientEnv, managedColimaSocketPath, managedColimaDockerHost, resolveDockerHost } from "../utils/docker-host.js";
+import { appleSiliconGuard, buildColimaWrapperScript, buildColimaPlist, buildNomadWaitWrapper, buildNomadPlist, buildPanelGateWrapper, buildPanelPlist, } from "./macos-launchd.js";
 import { getAdapter, listRegisteredAdapters } from "./runtime/index.js";
 // Internal usage of task primitives — re-exports further down preserve the
 // public import surface used by runtime/adapters/*, routes, and CLI.
@@ -21,9 +22,9 @@ const NOMAD_BIN = join(BIN_DIR, "nomad");
 const NOMAD_CONFIG_DIR = join(JISHUSHELL_HOME, "nomad");
 const NOMAD_DATA_DIR = join(JISHUSHELL_HOME, "nomad", "data");
 const NOMAD_ALLOC_DIR = join(JISHUSHELL_HOME, "nomad", "data", "alloc");
-const COLIMA_DIR = join(JISHUSHELL_HOME, "colima");
+const _COLIMA_DIR = join(JISHUSHELL_HOME, "colima");
 const COLIMA_PROFILE = "jishushell";
-const COLIMA_SOCKET = managedColimaSocketPath(JISHUSHELL_HOME, COLIMA_PROFILE);
+const _COLIMA_SOCKET = managedColimaSocketPath(JISHUSHELL_HOME, COLIMA_PROFILE);
 const NOMAD_VERSION = "1.6.5";
 let _serverPort = 8090;
 export function setServerPort(port) { _serverPort = port; }
@@ -192,7 +193,7 @@ function curlProgressParser(line) {
 export function getDirSizeMB(dir) {
     try {
         const result = execFileSync("du", ["-sm", dir], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
-        return parseInt(result.split("\t")[0]) || 0;
+        return parseInt(result.split("\t")[0], 10) || 0;
     }
     catch {
         return 0;
@@ -212,15 +213,6 @@ function checkCommand(cmd, versionFlag = "--version") {
         return { ok: false, version: "", path: "" };
     }
 }
-function isProcessRunning(name) {
-    try {
-        const result = execFileSync("pgrep", ["-f", name], { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
-        return result.trim().length > 0;
-    }
-    catch {
-        return false;
-    }
-}
 function isPortListening(port) {
     if (!Number.isInteger(port) || port < 1 || port > 65535)
         return false;
@@ -509,7 +501,7 @@ async function buildRuntimesStatus() {
 export async function upgradeNode(targetMajor = 22) {
     try {
         const current = process.version; // e.g. "v20.20.1"
-        const currentMajor = parseInt(current.replace("v", "").split(".")[0]);
+        const currentMajor = parseInt(current.replace("v", "").split(".")[0], 10);
         if (currentMajor >= targetMajor) {
             return { ok: true, message: `Node.js ${current} already meets requirement (>= ${targetMajor})` };
         }
@@ -578,6 +570,17 @@ export async function upgradeNode(targetMajor = 22) {
 async function installDockerWithTask(task) {
     try {
         emitTask(task, { type: "progress", message: "开始安装 Docker...", progress: 0 });
+        // macOS short-circuit: the rest of this function targets apt/get.docker.com,
+        // both of which silently no-op or hard-fail on Darwin. Docker on macOS is
+        // provided by Colima (auto-installed by the bash installer at
+        // install/jishu-install.sh) — not by this code path. Refuse early with a
+        // clear pointer so the user doesn't see a confusing apt error.
+        if (process.platform === "darwin") {
+            const msg = "macOS Docker 需要 Colima。请运行 shell 安装器 (curl -fsSL https://raw.githubusercontent.com/nicepkg/jishushell/main/install/jishu-install.sh | bash),或参阅 docs/macos-colima.md 手动安装 Colima。";
+            emitTask(task, { type: "error", message: msg });
+            task.status = "error";
+            return { ok: false, message: msg, error: "darwin-not-supported-via-this-path" };
+        }
         const user = execSync("whoami", { encoding: "utf-8", timeout: 5000 }).trim();
         // ── Try the get.docker.com convenience script ─────────────────
         emitTask(task, { type: "log", message: "下载 Docker 安装脚本..." });
@@ -1152,6 +1155,42 @@ function writeNomadConfig() {
   }
 `
         : "";
+    // Detect docker0 bridge CIDR so multi-container apps (weknora etc.) can
+    // declare `host_network: docker_bridge` on their ports and have Nomad
+    // publish them on the docker0 IP — which is what `host.docker.internal`
+    // resolves to inside peer containers. Hardcoding 172.17.0.0/16 would
+    // break setups where docker daemon.json overrides `bip` /
+    // `default-address-pools`. Fall back to the Docker default if detection
+    // fails (e.g. docker not yet installed at panel install time; doctor
+    // will regenerate later).
+    const dockerBridgeCidr = detectDockerBridgeCidr() || "172.17.0.0/16";
+    const dockerBridgeHostNetworkBlock = `
+  host_network "docker_bridge" {
+    cidr = "${dockerBridgeCidr}"
+  }
+`;
+    // Apple Silicon CPU fingerprint workaround. Nomad 1.6.x on darwin/arm64
+    // reads `hw.tbfrequency` (timebase, e.g. 24 MHz on M-series) as the CPU
+    // clock, so a 14-core M4 Max reports as 48 MHz total compute and every
+    // job that asks for CPU>48 gets rejected with "Resources exhausted on
+    // dimension cpu". Override with a conservative estimate (cores × 2500
+    // MHz) — M-series base clock is at least 2.5 GHz, so this never
+    // overcommits relative to actual silicon. Intel Macs fingerprint
+    // correctly and don't need the override.
+    const cpuTotalComputeBlock = platform === "darwin" && osArch() === "arm64"
+        ? `  cpu_total_compute = ${osCpus().length * 2500}  # Apple Silicon workaround: Nomad mis-fingerprints CPU freq via tbfrequency\n`
+        : "";
+    // macOS docker driver endpoint. macOS users run Docker via Colima
+    // (managed by this panel under `~/.jishushell/colima/jishushell/`) or
+    // Docker Desktop (`~/.docker/run/docker.sock`); neither exposes
+    // `/var/run/docker.sock` out of the box. Resolve the correct host once
+    // and bake it into the HCL so Nomad doesn't fall back to the default
+    // `unix:///var/run/docker.sock` and fail. Linux keeps the default
+    // (empty endpoint = Docker's standard /var/run/docker.sock).
+    const dockerHost = platform === "darwin"
+        ? resolveDockerHost({ jishuHome: JISHUSHELL_HOME, colimaProfile: COLIMA_PROFILE })
+        : undefined;
+    const dockerEndpointLine = dockerHost ? `\n    endpoint = "${dockerHost}"` : "";
     const config = `
 data_dir = "${NOMAD_DATA_DIR}"
 
@@ -1171,11 +1210,11 @@ server {
 }
 
 client {
-  enabled = true
+${cpuTotalComputeBlock}  enabled = true
   servers = ["127.0.0.1:4647"]
   network_interface = "${loopbackIface}"
   alloc_dir = "${NOMAD_ALLOC_DIR}"
-${externalHostNetworkBlock}
+${externalHostNetworkBlock}${dockerBridgeHostNetworkBlock}
 
   # drain_on_shutdown intentionally omitted: on single-node Pi there is
   # nowhere to drain workloads to, and draining on every systemctl restart
@@ -1185,7 +1224,10 @@ ${externalHostNetworkBlock}
 }
 
 plugin "docker" {
-  config {
+  config {${dockerEndpointLine}
+    gc {
+      image = false
+    }
     volumes {
       enabled = true
     }
@@ -1208,6 +1250,22 @@ limits {
 `;
     writeConfigFile(join(NOMAD_CONFIG_DIR, "nomad.hcl"), config);
 }
+function detectDockerBridgeCidr() {
+    // `docker network inspect bridge` returns the CIDR for docker0. The exact
+    // value depends on /etc/docker/daemon.json `bip` / `default-address-pools`
+    // — Docker's default is 172.17.0.0/16 but isn't guaranteed. We need the
+    // real value because Nomad uses `host_network "docker_bridge" { cidr = …}`
+    // to pick which interface to publish a port on for specs that declare
+    // `host_network: docker_bridge`. Wrong CIDR → port silently published on
+    // wrong interface → cross-task host.docker.internal calls get refused.
+    try {
+        const raw = execFileSync("docker", ["network", "inspect", "bridge", "--format", "{{(index .IPAM.Config 0).Subnet}}"], { encoding: "utf8", timeout: 3000, stdio: ["pipe", "pipe", "pipe"] }).trim();
+        return /^\d{1,3}(\.\d{1,3}){3}\/\d{1,2}$/.test(raw) ? raw : "";
+    }
+    catch {
+        return "";
+    }
+}
 function detectNomadExternalInterface(loopbackIface) {
     try {
         if (osPlatform() === "darwin") {
@@ -1450,8 +1508,41 @@ function enableNomadNodeEligibility() {
 }
 export async function startNomad() {
     try {
+        const configPath = join(NOMAD_CONFIG_DIR, "nomad.hcl");
+        const readConfig = () => {
+            try {
+                return existsSync(configPath) ? readFileSync(configPath, "utf-8") : "";
+            }
+            catch {
+                return "";
+            }
+        };
+        const oldConfig = readConfig();
         writeNomadConfig();
+        const newConfig = readConfig();
+        const drifted = oldConfig.length > 0 && newConfig.length > 0 && oldConfig !== newConfig;
         if (isPortListening(4646)) {
+            // Nomad already running, but if the rewritten config differs (typically
+            // because detectNomadExternalInterface() now resolves to a different
+            // interface — e.g. older install missing the host_network block, or
+            // network interface renamed across reboots), reload nomad so allocations
+            // bind to the right host network on next placement.
+            if (drifted) {
+                try {
+                    execFileSync("sudo", ["-n", "systemctl", "restart", "nomad"], { stdio: "pipe", timeout: 15000 });
+                    for (let i = 0; i < 15; i++) {
+                        await new Promise(r => setTimeout(r, 1000));
+                        if (isPortListening(4646)) {
+                            await finalizeNomadStartup();
+                            return { ok: true, message: "Nomad restarted (config reconciled)" };
+                        }
+                    }
+                    return { ok: false, message: "Nomad restart timed out after config reconcile", error: "Port 4646 not listening after 15s" };
+                }
+                catch (e) {
+                    console.warn(`[nomad] config drift detected but restart failed (${e.message}); existing nomad continues with stale config`);
+                }
+            }
             await finalizeNomadStartup();
             return { ok: true, message: "Nomad already running" };
         }
@@ -1501,7 +1592,6 @@ export async function startNomad() {
         catch {
             return { ok: false, message: "Nomad not installed", error: "Install Nomad first" };
         }
-        const configPath = join(NOMAD_CONFIG_DIR, "nomad.hcl");
         const logPath = join(NOMAD_CONFIG_DIR, "nomad.log");
         // Use spawn with detached to avoid execSync shell injection and ensure proper daemonization
         try {
@@ -1572,45 +1662,75 @@ export function installNomadSystemd() {
         const configPath = join(NOMAD_CONFIG_DIR, "nomad.hcl");
         writeNomadConfig();
         if (process.platform === "darwin") {
-            const plistLabel = "com.jishushell.nomad";
+            // macOS is Apple Silicon only — fail fast (mirrors the bash uname guard).
+            const guard = appleSiliconGuard();
+            if (!guard.ok)
+                return { ok: false, message: guard.message };
+            const laDir = join(process.env.HOME || dirname(JISHUSHELL_HOME), "Library/LaunchAgents");
+            // Always use JishuShell's private Colima socket — hardcoded, not
+            // runtime-detected. Colima may not be running yet when the plist is
+            // written; runtime fallback would pick the wrong socket (Docker
+            // Desktop or /var/run/docker.sock). Mirrors the bash _COLIMA_SOCKET use.
+            const colimaSocket = managedColimaSocketPath(JISHUSHELL_HOME, COLIMA_PROFILE);
+            const colimaDockerHost = managedColimaDockerHost(JISHUSHELL_HOME, COLIMA_PROFILE);
+            // ── 1. Colima self-retrying launchd agent ───────────────────────
+            // colima binary: prefer PATH, fall back to both Homebrew prefixes
+            // (mirrors the bash COLIMA_BIN resolution).
+            let colimaBin = "";
+            try {
+                colimaBin = execFileSync("which", ["colima"], { encoding: "utf-8", timeout: 5000 }).trim().split("\n")[0];
+            }
+            catch {
+                colimaBin = "";
+            }
+            if (!colimaBin && existsSync("/opt/homebrew/bin/colima"))
+                colimaBin = "/opt/homebrew/bin/colima";
+            if (!colimaBin && existsSync("/usr/local/bin/colima"))
+                colimaBin = "/usr/local/bin/colima";
+            if (!colimaBin)
+                colimaBin = "colima";
+            const colimaWrapperPath = join(BIN_DIR, "colima-launchd-wrapper.sh");
+            writeExecutableFile(colimaWrapperPath, buildColimaWrapperScript({
+                colimaHome: _COLIMA_DIR,
+                profile: COLIMA_PROFILE,
+                socket: colimaSocket,
+                colimaBin,
+            }));
+            const colimaPlistPath = join(laDir, "com.jishushell.colima.plist");
+            writeConfigFile(colimaPlistPath, buildColimaPlist({
+                wrapperPath: colimaWrapperPath,
+                colimaHome: _COLIMA_DIR,
+                logPath: join(_COLIMA_DIR, "colima-launchd.log"),
+            }));
+            try {
+                execSync(`launchctl unload "${colimaPlistPath}" 2>/dev/null`);
+            }
+            catch { }
+            try {
+                execSync(`launchctl load -w "${colimaPlistPath}"`, { timeout: 15000 });
+            }
+            catch { }
+            // ── 2. Nomad gated behind a docker-readiness wrapper ────────────
             const logPath = join(NOMAD_CONFIG_DIR, "nomad.log");
-            const dockerHost = resolveDockerHost({
-                jishuHome: JISHUSHELL_HOME,
-                colimaProfile: COLIMA_PROFILE,
+            const nomadWrapperPath = join(BIN_DIR, "nomad-launchd-wrapper.sh");
+            writeExecutableFile(nomadWrapperPath, buildNomadWaitWrapper({
+                dockerHost: colimaDockerHost,
+                nomadBin: nomadPath,
+                configPath,
+            }));
+            const plistContent = buildNomadPlist({
+                wrapperPath: nomadWrapperPath,
+                dockerHost: colimaDockerHost,
+                logPath,
             });
-            const dockerHostEntry = dockerHost
-                ? `
-    <key>DOCKER_HOST</key><string>${dockerHost}</string>`
-                : "";
-            const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key><string>${plistLabel}</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>${nomadPath}</string>
-    <string>agent</string>
-    <string>-config=${configPath}</string>
-  </array>
-  <key>EnvironmentVariables</key>
-  <dict>${dockerHostEntry}
-    <key>PATH</key><string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
-  </dict>
-  <key>RunAtLoad</key><true/>
-  <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key><string>${logPath}</string>
-  <key>StandardErrorPath</key><string>${logPath}</string>
-</dict>
-</plist>`;
-            const plistPath = join(process.env.HOME || dirname(JISHUSHELL_HOME), `Library/LaunchAgents/${plistLabel}.plist`);
+            const plistPath = join(laDir, "com.jishushell.nomad.plist");
             writeConfigFile(plistPath, plistContent);
             try {
                 execSync(`launchctl unload "${plistPath}" 2>/dev/null`);
             }
             catch { }
             execSync(`launchctl load -w "${plistPath}"`, { timeout: 15000 });
-            return { ok: true, message: "Nomad launchd agent installed and started" };
+            return { ok: true, message: "Nomad launchd agent installed and started (Colima gated)" };
         }
         // Nomad 1.6.5's docker driver fingerprint requires euid==0 — PR #18197 lifted
         // that restriction only in 1.7+, and we intentionally stay on the 1.6 MPL line.
@@ -1664,7 +1784,10 @@ export function installJishushellSystemd(port) {
         // The real owner home: prefer JISHUSHELL_HOME's parent so we don't rely on $HOME.
         const realHome = dirname(JISHUSHELL_HOME);
         if (process.platform === "darwin") {
-            const plistLabel = "com.jishushell.panel";
+            // macOS is Apple Silicon only — fail fast (mirrors the bash uname guard).
+            const guard = appleSiliconGuard();
+            if (!guard.ok)
+                return { ok: false, message: guard.message };
             const logPath = join(JISHUSHELL_HOME, "panel.log");
             const wrapperPath = join(JISHUSHELL_HOME, "bin", "jishushell-panel-start");
             const nomadEnvPath = join(JISHUSHELL_HOME, "nomad.env");
@@ -1677,23 +1800,22 @@ export PATH="/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/local/sbin
 exec "${nodeBin}" "${cliBin}" serve --port ${resolvedPort}
 `;
             writeExecutableFile(wrapperPath, wrapperContent);
-            const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key><string>${plistLabel}</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>/bin/sh</string>
-    <string>${wrapperPath}</string>
-  </array>
-  <key>RunAtLoad</key><true/>
-  <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key><string>${logPath}</string>
-  <key>StandardErrorPath</key><string>${logPath}</string>
-</dict>
-</plist>`;
-            const plistPath = join(process.env.HOME || realHome, `Library/LaunchAgents/${plistLabel}.plist`);
+            // 60s docker-readiness gate so the first post-reboot page load
+            // doesn't flash "image missing"; on timeout it starts anyway
+            // (mirrors the bash panel-launchd-wrapper.sh gate).
+            const gateWrapperPath = join(BIN_DIR, "panel-launchd-wrapper.sh");
+            writeExecutableFile(gateWrapperPath, buildPanelGateWrapper({
+                socket: managedColimaSocketPath(JISHUSHELL_HOME, COLIMA_PROFILE),
+                panelStartWrapper: wrapperPath,
+            }));
+            const plistContent = buildPanelPlist({
+                gateWrapperPath,
+                logPath,
+            });
+            // Symmetric with installNomadSystemd()'s laDir (realHome === dirname(JISHUSHELL_HOME),
+            // so process.env.HOME || dirname(JISHUSHELL_HOME) is provably the same path).
+            const laDir = join(process.env.HOME || dirname(JISHUSHELL_HOME), "Library/LaunchAgents");
+            const plistPath = join(laDir, "com.jishushell.panel.plist");
             writeConfigFile(plistPath, plistContent);
             const panelAlreadyRunning = isPortListening(resolvedPort);
             if (!panelAlreadyRunning) {