jishushell 0.5.15 → 0.5.22

package/Dockerfile.hermes-slim

@@ -178,11 +178,8 @@ RUN mkdir -p /opt/data && \
 COPY templates/hermes-entrypoint.sh /usr/local/bin/jishushell-hermes-entry.sh
 RUN chmod 0755 /usr/local/bin/jishushell-hermes-entry.sh
 
-# Advertise the protocol contract this image satisfies. The panel reads
-# this label via `docker inspect` before launching an instance; a panel
-# that only knows protocol version N refuses to start an image that
-# declares N+1, which is how we gate rolling upgrades without silent
-# behavioral drift.
+# Retained as build metadata for operators and registry inspection. Runtime
+# readiness is determined from the official ghcr.io RepoDigest, not this label.
 LABEL runtime.protocol.version="1"
 
 # Zombie reaping is handled by Nomad's `init: true` flag (docker-init

package/apps/filebrowser-container.yaml

@@ -78,6 +78,7 @@ provides:
     task: "filebrowser"
     port: 18088
     path: "/"
+    embedded: "proxy"
     protocol: "http"
     visibility: "external"
     description: "Filebrowser Web UI；panel 反代到 /apps/filebrowser/*"

package/apps/ollama-binary.yaml

@@ -106,6 +106,28 @@ lifecycle:
         owner_marker="$HOME/.jishushell/.ollama-installed-by-jishushell-${app_id}";
         legacy_owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
         system_install_marker="$HOME/.jishushell/.ollama-system-install-${app_id}";
+        if [ "$(uname -s)" = "Linux" ] && ! command -v zstd >/dev/null 2>&1; then
+          echo "未检测到 zstd；Ollama v0.24+ 安装包仅提供 .tar.zst，需先安装 zstd..." >&2;
+          pm_rc=1;
+          if command -v apt-get >/dev/null 2>&1; then
+            DEBIAN_FRONTEND=noninteractive apt-get update -qq || true;
+            DEBIAN_FRONTEND=noninteractive apt-get install -y zstd && pm_rc=0;
+          elif command -v dnf >/dev/null 2>&1; then
+            dnf install -y zstd && pm_rc=0;
+          elif command -v yum >/dev/null 2>&1; then
+            yum install -y zstd && pm_rc=0;
+          elif command -v apk >/dev/null 2>&1; then
+            apk add --no-cache zstd && pm_rc=0;
+          elif command -v pacman >/dev/null 2>&1; then
+            pacman -Sy --noconfirm zstd && pm_rc=0;
+          else
+            echo "ERROR: 未找到受支持的包管理器（apt/dnf/yum/apk/pacman）来安装 zstd" >&2;
+          fi;
+          if [ "$pm_rc" != "0" ] || ! command -v zstd >/dev/null 2>&1; then
+            echo "ERROR: 自动安装 zstd 失败；请手动安装后重试。" >&2;
+            exit 1;
+          fi;
+        fi;
         for BINDIR in /usr/local/bin /usr/bin /bin; do
           echo "$PATH" | grep -q "$BINDIR" && break || continue;
         done;
@@ -117,6 +139,10 @@ lifecycle:
           ( rm -rf "$old_dir" >/dev/null 2>&1 || true ) &
         fi;
         curl -fsSL https://ollama.com/install.sh | sh;
+        if ! command -v ollama >/dev/null 2>&1; then
+          echo "ERROR: 安装脚本结束后仍未找到 ollama 命令；请检查网络、磁盘空间或 zstd 是否可用。" >&2;
+          exit 1;
+        fi;
         rm -f "$install_marker";
         rm -f "$legacy_owner_marker";
         rm -f "$system_install_marker";
@@ -138,6 +164,18 @@ lifecycle:
           : > "$owner_marker";
         fi
       ifFileExists: "~/.jishushell/apps/${app_id}/.ollama-install-needed"
+    - run: >-
+        if [ -e /usr/local/bin/ollama ]; then
+          exit 0;
+        fi;
+        if ! command -v ollama >/dev/null 2>&1; then
+          exit 0;
+        fi;
+        real_ollama="$(command -v ollama)";
+        echo "检测到 ollama 位于 $real_ollama 但 /usr/local/bin/ollama 不存在；建立兼容符号链接（用于 Apple Silicon brew 等场景）..." >&2;
+        mkdir -p /usr/local/bin;
+        ln -sf "$real_ollama" /usr/local/bin/ollama
+      sudo: true
     - run: >-
         service_active_marker="$HOME/.jishushell/apps/${app_id}/.ollama-service-active";
         rm -f "$service_active_marker";
@@ -198,4 +236,10 @@ lifecycle:
         rm -f "$owner_marker" "$legacy_owner_marker" "$system_install_marker" "$uninstall_marker"
       sudo: true
       ifFileExists: "~/.jishushell/.ollama-uninstall-needed-${app_id}"
+    - run: >-
+        if [ -L /usr/local/bin/ollama ]; then
+          echo "清理由 JishuShell 建立的兼容性符号链接 /usr/local/bin/ollama" >&2;
+          rm -f /usr/local/bin/ollama;
+        fi
+      sudo: true
 

package/apps/ollama-with-hollama-binary.yaml

@@ -102,6 +102,28 @@ lifecycle:
         owner_marker="$HOME/.jishushell/.ollama-installed-by-jishushell-${app_id}";
         legacy_owner_marker="$HOME/.jishushell/apps/${app_id}/.ollama-installed-by-jishushell";
         system_install_marker="$HOME/.jishushell/.ollama-system-install-${app_id}";
+        if [ "$(uname -s)" = "Linux" ] && ! command -v zstd >/dev/null 2>&1; then
+          echo "未检测到 zstd；Ollama v0.24+ 安装包仅提供 .tar.zst，需先安装 zstd..." >&2;
+          pm_rc=1;
+          if command -v apt-get >/dev/null 2>&1; then
+            DEBIAN_FRONTEND=noninteractive apt-get update -qq || true;
+            DEBIAN_FRONTEND=noninteractive apt-get install -y zstd && pm_rc=0;
+          elif command -v dnf >/dev/null 2>&1; then
+            dnf install -y zstd && pm_rc=0;
+          elif command -v yum >/dev/null 2>&1; then
+            yum install -y zstd && pm_rc=0;
+          elif command -v apk >/dev/null 2>&1; then
+            apk add --no-cache zstd && pm_rc=0;
+          elif command -v pacman >/dev/null 2>&1; then
+            pacman -Sy --noconfirm zstd && pm_rc=0;
+          else
+            echo "ERROR: 未找到受支持的包管理器（apt/dnf/yum/apk/pacman）来安装 zstd" >&2;
+          fi;
+          if [ "$pm_rc" != "0" ] || ! command -v zstd >/dev/null 2>&1; then
+            echo "ERROR: 自动安装 zstd 失败；请手动安装后重试。" >&2;
+            exit 1;
+          fi;
+        fi;
         for BINDIR in /usr/local/bin /usr/bin /bin; do
           echo "$PATH" | grep -q "$BINDIR" && break || continue;
         done;
@@ -113,6 +135,10 @@ lifecycle:
           ( rm -rf "$old_dir" >/dev/null 2>&1 || true ) &
         fi;
         curl -fsSL https://ollama.com/install.sh | sh;
+        if ! command -v ollama >/dev/null 2>&1; then
+          echo "ERROR: 安装脚本结束后仍未找到 ollama 命令；请检查网络、磁盘空间或 zstd 是否可用。" >&2;
+          exit 1;
+        fi;
         rm -f "$install_marker";
         rm -f "$legacy_owner_marker";
         rm -f "$system_install_marker";
@@ -134,6 +160,18 @@ lifecycle:
           : > "$owner_marker";
         fi
       ifFileExists: "~/.jishushell/apps/${app_id}/.ollama-install-needed"
+    - run: >-
+        if [ -e /usr/local/bin/ollama ]; then
+          exit 0;
+        fi;
+        if ! command -v ollama >/dev/null 2>&1; then
+          exit 0;
+        fi;
+        real_ollama="$(command -v ollama)";
+        echo "检测到 ollama 位于 $real_ollama 但 /usr/local/bin/ollama 不存在；建立兼容符号链接（用于 Apple Silicon brew 等场景）..." >&2;
+        mkdir -p /usr/local/bin;
+        ln -sf "$real_ollama" /usr/local/bin/ollama
+      sudo: true
     - run: >-
         service_active_marker="$HOME/.jishushell/apps/${app_id}/.ollama-service-active";
         rm -f "$service_active_marker";
@@ -193,4 +231,10 @@ lifecycle:
         rm -rf /Applications/Ollama.app "$HOME/Applications/Ollama.app" 2>/dev/null || true;
         rm -f "$owner_marker" "$legacy_owner_marker" "$system_install_marker" "$uninstall_marker"
       sudo: true
-      ifFileExists: "~/.jishushell/.ollama-uninstall-needed-${app_id}"
+      ifFileExists: "~/.jishushell/.ollama-uninstall-needed-${app_id}"
+    - run: >-
+        if [ -L /usr/local/bin/ollama ]; then
+          echo "清理由 JishuShell 建立的兼容性符号链接 /usr/local/bin/ollama" >&2;
+          rm -f /usr/local/bin/ollama;
+        fi
+      sudo: true

package/dist/cli/doctor.js

@@ -20,7 +20,7 @@ import { randomBytes } from "crypto";
 import { existsSync, readFileSync, unlinkSync, } from "fs";
 import * as http from "http";
 import { homedir } from "os";
-import { join } from "path";
+import { dirname, join } from "path";
 import { AUTH_FILE, DEFAULT_OPENCLAW_DOCKER_IMAGE, INSTANCES_DIR, JISHUSHELL_HOME, PANEL_CONFIG_FILE, ensureDirs, getNomadToken, getPanelConfig, } from "../config.js";
 import { buildDockerClientEnv, managedColimaDockerHost } from "../utils/docker-host.js";
 import { loadNomadToken } from "../services/setup-manager.js";
@@ -61,6 +61,37 @@ function detectNomadExternalInterface(loopbackIface) {
     }
 }
 // ── Internal helpers ────────────────────────────────────────────────────────
+const MACOS_EXEC_PATH_ENTRIES = [
+    "/opt/homebrew/bin",
+    "/opt/homebrew/sbin",
+    "/usr/local/bin",
+    "/usr/local/sbin",
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin",
+];
+function buildDeterministicPath(basePath, extraEntries = []) {
+    return [...extraEntries, basePath ?? "", ...MACOS_EXEC_PATH_ENTRIES]
+        .flatMap((entry) => entry.split(":"))
+        .map((entry) => entry.trim())
+        .filter(Boolean)
+        .filter((entry, index, entries) => entries.indexOf(entry) === index)
+        .join(":");
+}
+function buildMacosColimaEnv(colimaHome) {
+    return {
+        ...process.env,
+        COLIMA_HOME: colimaHome,
+        PATH: buildDeterministicPath(process.env.PATH, [dirname(process.execPath)]),
+    };
+}
+function buildMacosDockerEnv() {
+    return {
+        ...process.env,
+        PATH: buildDeterministicPath(process.env.PATH, [dirname(process.execPath)]),
+    };
+}
 function httpGet(url, timeoutMs = 3000) {
     return new Promise((resolve, reject) => {
         const req = http.get(url, { timeout: timeoutMs }, (res) => {
@@ -93,15 +124,25 @@ function httpGetWithHeaders(url, headers, timeoutMs = 3000) {
         req.end();
     });
 }
-function commandExists(cmd) {
+function commandExists(cmd, env = process.env) {
     try {
-        execFileSync("which", [cmd], { stdio: "ignore", timeout: 2000 });
+        execFileSync("which", [cmd], { stdio: "ignore", timeout: 2000, env });
         return true;
     }
     catch {
         return false;
     }
 }
+function buildDoctorDockerEnv() {
+    const dockerEnv = buildDockerClientEnv({ jishuHome: JISHUSHELL_HOME });
+    if (process.platform !== "darwin")
+        return dockerEnv;
+    return {
+        ...buildMacosDockerEnv(),
+        ...dockerEnv,
+        PATH: buildDeterministicPath(process.env.PATH, [dirname(process.execPath)]),
+    };
+}
 function isPortListening(port) {
     try {
         if (process.platform === "darwin") {
@@ -150,7 +191,8 @@ const checkNode = {
 const checkDockerBin = {
     id: "docker-bin", label: "Docker 已安装", category: "系统环境", severity: "error",
     async check() {
-        if (commandExists("docker"))
+        const env = process.platform === "darwin" ? buildMacosDockerEnv() : process.env;
+        if (commandExists("docker", env))
             return { ok: true, detail: "docker 命令可用" };
         return { ok: false, detail: "未找到 docker 命令", hint: "curl -fsSL https://get.docker.com | sh", fixable: false };
     },
@@ -158,7 +200,7 @@ const checkDockerBin = {
 const checkDockerDaemon = {
     id: "docker-daemon", label: "Docker 守护进程", category: "系统环境", severity: "error",
     async check() {
-        const env = buildDockerClientEnv({ jishuHome: JISHUSHELL_HOME });
+        const env = buildDoctorDockerEnv();
         try {
             execFileSync("docker", ["info"], { stdio: "ignore", timeout: 6000, env });
             const ver = execSync("docker --version 2>/dev/null", { encoding: "utf-8", timeout: 3000, env }).trim();
@@ -172,7 +214,13 @@ const checkDockerDaemon = {
         catch { }
         if (process.platform === "darwin") {
             const colimaDir = join(JISHUSHELL_HOME, "colima");
-            return { ok: false, detail: "Docker 守护进程未运行", hint: `启动 Docker Desktop，或执行 COLIMA_HOME=${colimaDir} colima start jishushell`, fixable: true };
+            const colimaPath = buildDeterministicPath(process.env.PATH, [dirname(process.execPath)]);
+            return {
+                ok: false,
+                detail: "Docker 守护进程未运行",
+                hint: `启动 Docker Desktop，或执行 PATH=${colimaPath} COLIMA_HOME=${colimaDir} colima start jishushell`,
+                fixable: true,
+            };
         }
         return { ok: false, detail: "Docker 守护进程未运行", hint: "sudo systemctl start docker", fixable: true };
     },
@@ -180,8 +228,11 @@ const checkDockerDaemon = {
         if (process.platform === "darwin") {
             try {
                 const colimaDir = join(JISHUSHELL_HOME, "colima");
-                const colimaEnv = { ...process.env, COLIMA_HOME: colimaDir };
-                const dockerEnv = { ...process.env, DOCKER_HOST: managedColimaDockerHost(JISHUSHELL_HOME) };
+                const colimaEnv = buildMacosColimaEnv(colimaDir);
+                const dockerEnv = {
+                    ...buildMacosDockerEnv(),
+                    DOCKER_HOST: managedColimaDockerHost(JISHUSHELL_HOME),
+                };
                 execFileSync("mkdir", ["-p", colimaDir], { timeout: 5000 });
                 // `--network-host-addresses` (added upstream as b8e7dd5) is the
                 // load-bearing flag on macOS: without it Colima won't expose Mac
@@ -231,10 +282,11 @@ const checkDockerDaemon = {
 const checkDockerGroup = {
     id: "docker-group", label: "Docker 用户权限", category: "系统环境", severity: "warning",
     async check() {
-        if (!commandExists("docker"))
+        const env = process.platform === "darwin" ? buildDoctorDockerEnv() : process.env;
+        if (!commandExists("docker", env))
             return { ok: true, detail: "跳过（docker 未安装）" };
         try {
-            execFileSync("docker", ["info"], { stdio: "ignore", timeout: 4000 });
+            execFileSync("docker", ["info"], { stdio: "ignore", timeout: 4000, env });
             return { ok: true, detail: "无需 sudo 即可使用 Docker" };
         }
         catch { }
@@ -652,6 +704,9 @@ ${externalHostNetworkBlock}
 plugin "docker" {
   config {
     disable_log_collection = true
+    gc {
+      image = false
+    }
     volumes {
       enabled = true
     }
@@ -900,12 +955,34 @@ const checkNomadJobs = {
             const jobs = JSON.parse(res.body);
             if (jobs.length === 0)
                 return { ok: true, detail: "暂无 Job（集群为空）" };
-            const unhealthy = jobs.filter((j) => j.Status !== "running");
-            const extras = jobs.map((j, idx) => {
-                const branch = idx === jobs.length - 1 ? "└─" : "├─";
-                const icon = j.Status === "running" ? c.green("✓") : c.yellow("!");
-                const status = j.Status === "running" ? c.green(j.Status) : c.yellow(j.Status);
-                return c.dim(`      ${branch} ${icon}  ${j.ID.padEnd(26)}`) + " " + status + c.dim(` [${j.Type}]`);
+            const runtimeJobs = await Promise.all(jobs.map(async (job) => {
+                try {
+                    const allocRes = token
+                        ? await httpGetWithHeaders(`${nomadAddr}/v1/job/${encodeURIComponent(job.ID)}/allocations`, { "X-Nomad-Token": token }, 5000)
+                        : await httpGet(`${nomadAddr}/v1/job/${encodeURIComponent(job.ID)}/allocations`, 5000);
+                    if (allocRes.status !== 200) {
+                        return { ...job, runtimeStatus: job.Status, runtimeHint: `alloc HTTP ${allocRes.status}` };
+                    }
+                    const allocs = JSON.parse(allocRes.body);
+                    const running = allocs.find((alloc) => alloc.ClientStatus === "running");
+                    if (running)
+                        return { ...job, runtimeStatus: "running", runtimeHint: "" };
+                    const latest = [...allocs].sort((a, b) => ((b.ModifyIndex ?? b.CreateIndex ?? 0) - (a.ModifyIndex ?? a.CreateIndex ?? 0)))[0];
+                    const runtimeStatus = latest?.ClientStatus || job.Status || "unknown";
+                    const runtimeHint = runtimeStatus !== job.Status ? `job=${job.Status}` : "";
+                    return { ...job, runtimeStatus, runtimeHint };
+                }
+                catch (e) {
+                    return { ...job, runtimeStatus: job.Status || "unknown", runtimeHint: e?.message || "alloc query failed" };
+                }
+            }));
+            const unhealthy = runtimeJobs.filter((j) => j.runtimeStatus !== "running");
+            const extras = runtimeJobs.map((j, idx) => {
+                const branch = idx === runtimeJobs.length - 1 ? "└─" : "├─";
+                const icon = j.runtimeStatus === "running" ? c.green("✓") : c.yellow("!");
+                const status = j.runtimeStatus === "running" ? c.green(j.runtimeStatus) : c.yellow(j.runtimeStatus);
+                const hint = j.runtimeHint ? `, ${j.runtimeHint}` : "";
+                return c.dim(`      ${branch} ${icon}  ${j.ID.padEnd(26)}`) + " " + status + c.dim(` [${j.Type}${hint}]`);
             });
             if (unhealthy.length > 0)
                 return { ok: false, detail: `${jobs.length} 个 job，${unhealthy.length} 个非 running 状态`, extras };
@@ -1083,6 +1160,54 @@ const checkNetwork = {
         return { ok: false, detail: "无法连通外网（ping 及 DNS 均失败）", hint: "检查网络: ip route && cat /etc/resolv.conf", fixable: false };
     },
 };
+const COLIMA_WRAPPER = join(JISHUSHELL_HOME, "bin", "colima-launchd-wrapper.sh");
+const COLIMA_PLIST = join(homedir(), "Library/LaunchAgents/com.jishushell.colima.plist");
+const checkColimaLaunchd = {
+    id: "colima-launchd", label: "Colima 自启 Agent", category: "Nomad", severity: "warning",
+    async check() {
+        if (process.platform !== "darwin")
+            return { ok: true, detail: "非 macOS（已跳过）" };
+        if (!existsSync(COLIMA_PLIST))
+            return { ok: false, detail: "com.jishushell.colima.plist 不存在", hint: "bash jishu-install.sh --run 3", fixable: false };
+        const body = readFileSync(COLIMA_PLIST, "utf-8");
+        const oldStyle = body.includes("<string>start</string>") || body.includes("--arch</string><string>aarch64");
+        if (oldStyle)
+            return { ok: false, detail: "旧式 plist(无 wrapper / 写死 arch)", hint: "bash jishu-install.sh --run 3 重新生成", fixable: false };
+        return { ok: true, detail: "自重试 wrapper 形式" };
+    },
+};
+const checkColimaWrapper = {
+    id: "colima-wrapper", label: "Colima wrapper 脚本", category: "Nomad", severity: "warning",
+    async check() {
+        if (process.platform !== "darwin")
+            return { ok: true, detail: "非 macOS（已跳过）" };
+        if (!existsSync(COLIMA_WRAPPER))
+            return { ok: false, detail: "colima-launchd-wrapper.sh 缺失", hint: "bash jishu-install.sh --run 3", fixable: false };
+        return { ok: true, detail: COLIMA_WRAPPER };
+    },
+};
+const checkMacosAutologin = {
+    id: "macos-autologin", label: "macOS 自动登录", category: "Nomad", severity: "warning",
+    async check() {
+        if (process.platform !== "darwin")
+            return { ok: true, detail: "非 macOS（已跳过）" };
+        let fvOn = false;
+        try {
+            fvOn = execFileSync("fdesetup", ["status"], { encoding: "utf-8", timeout: 4000 }).includes("FileVault is On");
+        }
+        catch { /* treat as off */ }
+        if (fvOn)
+            return { ok: true, detail: "FileVault 开启（auto-login 不适用，已跳过）" };
+        let user = "";
+        try {
+            user = execFileSync("defaults", ["read", "/Library/Preferences/com.apple.loginwindow", "autoLoginUser"], { encoding: "utf-8", timeout: 4000 }).trim();
+        }
+        catch { /* not set */ }
+        if (!user)
+            return { ok: false, detail: "未配置(headless 重启不会触发 LaunchAgent)", hint: "bash jishu-install.sh --run 3 --enable-autologin", fixable: false };
+        return { ok: true, detail: `autoLoginUser=${user}` };
+    },
+};
 // ════════════════════════════════════════════════════════════════════════════
 // All check items (in execution order).
 // ════════════════════════════════════════════════════════════════════════════
@@ -1108,6 +1233,9 @@ export const ALL_CHECKS = [
     checkNomadConfig,
     checkNomadAgent,
     checkNomadDockerDriver,
+    checkColimaLaunchd,
+    checkColimaWrapper,
+    checkMacosAutologin,
     checkNomadSystemd,
     checkNomadJobs,
     // AI components