jishushell 0.5.15 → 0.5.22

package/dist/services/runtime/adapters/openclaw.js

@@ -35,7 +35,7 @@
  */
 import { execFile, execFileSync } from "child_process";
 import { accessSync, chmodSync, chownSync, copyFileSync, cpSync, constants, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, } from "fs";
-import { randomBytes } from "crypto";
+import { createHash, randomBytes } from "crypto";
 import { homedir, userInfo } from "os";
 import { delimiter, dirname, join, resolve as pathResolve } from "path";
 import { getNomadDriver, getOpenclawDockerImage, JISHUSHELL_HOME, getPanelConfig, } from "../../../config.js";
@@ -48,7 +48,7 @@ import { getInstanceDir as framework_instanceDir, instanceMetaPath } from "../..
 import { createTask, emitTask, spawnWithTask, getDirSizeMB, npmProgressParser, dockerBuildProgressParser, resolveDockerInvocation, } from "../../setup-manager.js";
 import { DEFAULT_OPENCLAW_DOCKER_IMAGE, setOpenclawDockerImage, OPENCLAW_MODULES, OPENCLAW_PKG_DIR, } from "../../../config.js";
 import { fileURLToPath } from "node:url";
-import { bootstrapInstanceProxy } from "../../llm-proxy/index.js";
+import { bootstrapInstanceProxy, decryptApiKey, getInstanceConfig as getProxyInstanceConfig } from "../../llm-proxy/index.js";
 import { registerAdapter } from "../registry.js";
 import { registerOpenclawRoutes } from "./openclaw-routes.js";
 // ── Constants physically migrated from nomad-manager.ts ───────────────
@@ -340,6 +340,65 @@ function patchJsproxyBaseUrl(configPath) {
         console.warn(`[openclaw] Failed to patch jsproxy baseUrl in ${configPath}: ${e.message}`);
     }
 }
+/** Known private/internal hostnames used by JishuShell's local proxy. */
+const PRIVATE_NETWORK_HOSTS = ["host.docker.internal", "127.0.0.1", "localhost", "0.0.0.0"];
+export function isPrivateNetworkBaseUrl(baseUrl) {
+    try {
+        const url = new URL(baseUrl);
+        if (PRIVATE_NETWORK_HOSTS.includes(url.hostname))
+            return true;
+        if (url.hostname.startsWith("10."))
+            return true;
+        if (url.hostname.startsWith("192.168."))
+            return true;
+        // RFC 1918: 172.16.0.0/12 → 172.16.x.x through 172.31.x.x
+        const m = url.hostname.match(/^172\.(\d+)\./);
+        if (m) {
+            const second = parseInt(m[1], 10);
+            if (second >= 16 && second <= 31)
+                return true;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Ensure `request.allowPrivateNetwork: true` is set on providers whose baseUrl
+ * targets a private/internal host (e.g. host.docker.internal). Without this,
+ * OpenClaw's SSRF guard blocks requests to the JishuShell local proxy.
+ */
+export function patchPrivateNetworkAllowFlag(configPath) {
+    try {
+        const raw = readFileSync(configPath, "utf-8");
+        const config = JSON.parse(raw);
+        const providers = config?.models?.providers;
+        if (!providers || typeof providers !== "object")
+            return;
+        let changed = false;
+        for (const [, provider] of Object.entries(providers)) {
+            if (typeof provider !== "object" || provider === null)
+                continue;
+            const p = provider;
+            if (typeof p.baseUrl !== "string")
+                continue;
+            if (!isPrivateNetworkBaseUrl(p.baseUrl))
+                continue;
+            if (p.request?.allowPrivateNetwork === true)
+                continue;
+            p.request = { ...(p.request || {}), allowPrivateNetwork: true };
+            changed = true;
+        }
+        if (changed) {
+            writeConfigFile(configPath, JSON.stringify(config, null, 2));
+            console.log(`[openclaw] Patched request.allowPrivateNetwork in ${configPath} for private-network providers`);
+        }
+    }
+    catch (e) {
+        console.warn(`[openclaw] Failed to patch allowPrivateNetwork in ${configPath}: ${e.message}`);
+    }
+}
 /**
  * Docker bridge port publishing cannot reach a process that only binds the
  * container loopback. Normalize default/loopback gateway binds to `lan` so
@@ -969,7 +1028,368 @@ function ensureOpenclawUpdateSeed(openclawHome, instanceId) {
         console.warn(`[openclaw] update-seed ${instanceId}: failed to create seed: ${err?.message ?? err}`);
     }
 }
-// ── Resource helpers (migrated from nomad-manager.ts) ─────────────────
+// ── Session fence patch (OpenClaw >= 5.19 regression) ─────────────────
+/**
+ * The minimum OpenClaw version where the session fence bug exists.
+ * The bug was introduced in v2026.5.19 — `eventMayReachTranscriptWriters()`
+ * doesn't recognize `"message"` / `"custom_message"` event types, causing
+ * session writes to bypass `withSessionWriteLock`, which in turn leaves
+ * the file fingerprint stale and triggers `EmbeddedAttemptSessionTakeoverError`
+ * on the next prompt.
+ *
+ * Additionally, on virtiofs mounts (macOS → Colima VM → Docker), file
+ * metadata (mtime/ctime) can drift between `releaseForPrompt()` and
+ * `assertSessionFileFence()` even without actual writes, due to the
+ * multi-layer filesystem stack timing. Patching `assertSessionFileFence`
+ * to a no-op fully disables the flawed fence check.
+ */
+const SESSION_FENCE_BUG_MIN_VERSION = [2026, 5, 19];
+/**
+ * Maximum version (exclusive) to apply the patch. Once OpenClaw ships a fix
+ * upstream, set a concrete version here to stop patching newer releases.
+ * For now, no upper bound — patch all versions >= MIN.
+ */
+/**
+ * Safety limit: if the extracted function body exceeds this many characters,
+ * skip the patch to avoid corrupting the bundle (e.g. brace-depth counter
+ * fooled by string literals containing braces in a future refactored version).
+ */
+const MAX_PATCH_TARGET_BODY_LENGTH = 5000;
+/**
+ * Patch targets: each entry defines a function to replace.
+ * - `eventMayReachTranscriptWriters`: broad return prevents events from
+ *   bypassing the write lock (necessary but not sufficient on virtiofs).
+ * - `assertSessionFileFence`: no-op disables the fingerprint comparison
+ *   that false-triggers due to virtiofs stat drift.
+ */
+const SESSION_FENCE_PATCH_TARGETS = [
+    {
+        fnName: "function assertSessionFileFence()",
+        litNeedle: "sameSessionFileFingerprint",
+        replacement: "function assertSessionFileFence() { return; }",
+    },
+    {
+        fnName: "function eventMayReachTranscriptWriters",
+        litNeedle: '"message_update"',
+        replacement: 'function eventMayReachTranscriptWriters(session, event) { return typeof event?.type === "string"; }',
+    },
+];
+/**
+ * Patch the session fence bug in OpenClaw >= 5.19 by replacing the
+ * `eventMayReachTranscriptWriters` function in the minified bundle.
+ *
+ * Idempotent: uses a marker file containing the SHA-256 of the patched
+ * file. Skips if already patched or if the pattern is not found (future
+ * fixed version or different bundle layout).
+ *
+ * Docker-only: the bug manifests through the virtiofs mount timing
+ * discrepancy between container and host — raw_exec/process modes are
+ * unaffected in practice.
+ */
+export function patchSessionFenceBug(openclawHome, instanceId) {
+    if (getNomadDriver() !== "docker")
+        return;
+    // 1. Read installed version from npm-global package.json
+    const pkgPath = join(openclawHome, ".npm-global", "lib", "node_modules", "openclaw", "package.json");
+    let versionStr;
+    try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+        versionStr = pkg.version || "";
+    }
+    catch {
+        return; // no npm-global install or unreadable — skip
+    }
+    // 2. Parse version and check minimum threshold
+    const parts = versionStr.split(".").map(Number);
+    if (parts.length < 3 || parts.some(Number.isNaN))
+        return;
+    const [major, minor, patch] = parts;
+    const [minMajor, minMinor, minPatch] = SESSION_FENCE_BUG_MIN_VERSION;
+    if (major < minMajor ||
+        (major === minMajor && minor < minMinor) ||
+        (major === minMajor && minor === minMinor && patch < minPatch)) {
+        return; // version predates the bug
+    }
+    // 3. Find the selection-*.js bundle that contains the target function.
+    //    There may be multiple selection-*.js files in dist/; only one holds
+    //    the session management code.
+    const distDir = join(openclawHome, ".npm-global", "lib", "node_modules", "openclaw", "dist");
+    let bundleFiles;
+    try {
+        const entries = readdirSync(distDir);
+        bundleFiles = entries.filter((f) => f.startsWith("selection-") && f.endsWith(".js"));
+    }
+    catch {
+        return; // dist dir missing or unreadable
+    }
+    if (bundleFiles.length === 0)
+        return;
+    // Scan each candidate for any of the patch target signatures
+    let bundlePath;
+    let bundleContent;
+    for (const file of bundleFiles) {
+        const candidatePath = join(distDir, file);
+        let content;
+        try {
+            content = readFileSync(candidatePath, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        // Match if any target's fnName or litNeedle is present
+        const hasTarget = SESSION_FENCE_PATCH_TARGETS.some((t) => content.includes(t.fnName) || content.includes(t.litNeedle));
+        if (hasTarget) {
+            bundlePath = candidatePath;
+            bundleContent = content;
+            break;
+        }
+    }
+    if (!bundlePath || !bundleContent)
+        return;
+    // 4. Check marker file for idempotency
+    const markerPath = join(distDir, `.session-fence-patched`);
+    const currentHash = createHash("sha256").update(bundleContent).digest("hex");
+    try {
+        const marker = readFileSync(markerPath, "utf-8").trim();
+        if (marker === currentHash)
+            return; // already patched, hash matches
+    }
+    catch {
+        // marker missing — proceed
+    }
+    // 5. Apply each patch target using brace-depth counting to extract and
+    //    replace function bodies. Process targets in order; earlier patches
+    //    shift offsets so we re-search after each replacement.
+    let patched = bundleContent;
+    let patchCount = 0;
+    for (const target of SESSION_FENCE_PATCH_TARGETS) {
+        let fnStart = patched.indexOf(target.fnName);
+        // Fallback for eventMayReachTranscriptWriters: locate by unique literal
+        // combination ("message_update" near "message_end" and "agent_end")
+        if (fnStart === -1 && target.litNeedle === '"message_update"') {
+            let scanPos = 0;
+            while (scanPos < patched.length) {
+                const litIdx = patched.indexOf(target.litNeedle, scanPos);
+                if (litIdx === -1)
+                    break;
+                const window = patched.slice(litIdx, litIdx + 200);
+                if (window.includes('"message_end"') && window.includes('"agent_end"')) {
+                    const searchStart = Math.max(0, litIdx - 300);
+                    const prefix = patched.slice(searchStart, litIdx);
+                    const fnKeywordIdx = prefix.lastIndexOf("function ");
+                    if (fnKeywordIdx !== -1) {
+                        fnStart = searchStart + fnKeywordIdx;
+                        break;
+                    }
+                }
+                scanPos = litIdx + 1;
+            }
+        }
+        if (fnStart === -1)
+            continue; // target not found (already patched or fixed version)
+        // Check if already patched (replacement is short and contains `return;`)
+        const peekEnd = Math.min(fnStart + target.replacement.length + 10, patched.length);
+        const peek = patched.slice(fnStart, peekEnd);
+        if (peek.startsWith(target.replacement))
+            continue;
+        // Extract function body with brace-depth counting
+        const braceStart = patched.indexOf("{", fnStart);
+        if (braceStart === -1)
+            continue;
+        let depth = 0;
+        let fnEnd = -1;
+        for (let i = braceStart; i < patched.length; i++) {
+            if (patched[i] === "{")
+                depth++;
+            else if (patched[i] === "}") {
+                depth--;
+                if (depth === 0) {
+                    fnEnd = i + 1;
+                    break;
+                }
+            }
+        }
+        if (fnEnd === -1)
+            continue;
+        // Safety: if extracted body is suspiciously large, skip to avoid corrupting
+        // the bundle (brace counter may have been fooled by string contents).
+        if (fnEnd - fnStart > MAX_PATCH_TARGET_BODY_LENGTH) {
+            console.warn(`[openclaw] session-fence-patch ${instanceId}: skipping ${target.fnName} — body too large (${fnEnd - fnStart} chars)`);
+            continue;
+        }
+        patched = patched.slice(0, fnStart) + target.replacement + patched.slice(fnEnd);
+        patchCount++;
+    }
+    if (patchCount === 0) {
+        // No targets needed patching — write marker for current state
+        try {
+            writeFileSync(markerPath, currentHash + "\n", "utf-8");
+        }
+        catch {
+            /* best effort */
+        }
+        return;
+    }
+    // 7. Atomic write: temp file → rename
+    const tmpPath = bundlePath + `.tmp.${randomBytes(4).toString("hex")}`;
+    try {
+        writeFileSync(tmpPath, patched, "utf-8");
+        renameSync(tmpPath, bundlePath);
+    }
+    catch (err) {
+        // Clean up temp file on failure
+        try {
+            unlinkSync(tmpPath);
+        }
+        catch {
+            /* ignore */
+        }
+        console.warn(`[openclaw] session-fence-patch ${instanceId}: atomic write failed: ${err?.message ?? err}`);
+        return;
+    }
+    // 8. Write marker with hash of the PATCHED file
+    const patchedHash = createHash("sha256").update(patched).digest("hex");
+    try {
+        writeFileSync(markerPath, patchedHash + "\n", "utf-8");
+    }
+    catch {
+        // Non-fatal — patch was applied, marker just helps idempotency
+    }
+    console.log(`[openclaw] session-fence-patch ${instanceId}: patched ${bundlePath.split("/").pop()} (v${versionStr})`);
+}
+// ── Container-side patch script ───────────────────────────────────────────
+/**
+ * Self-contained Node.js script that patches the session fence bug from
+ * INSIDE the container. Written to `$OPENCLAW_HOME/.jishushell/session-fence-patch.mjs`
+ * by onBeforeStart and executed by the custom entrypoint wrapper before
+ * the OpenClaw gateway starts.
+ *
+ * This covers the case where an in-container `npm install openclaw@latest`
+ * upgrades to a buggy version (>= 5.19) after the container was created
+ * with a clean image (5.7). The host-side `patchSessionFenceBug` cannot
+ * patch at onBeforeStart time because the npm-global directory may not yet
+ * contain the upgraded bundle (it's a dangling symlink to a container-only path).
+ */
+const CONTAINER_PATCH_SCRIPT = `#!/usr/bin/env node
+// Session fence patch — auto-generated by JishuShell.
+// Patches assertSessionFileFence + eventMayReachTranscriptWriters
+// in OpenClaw >= 2026.5.19 to work around virtiofs stat drift.
+import { readFileSync, writeFileSync, readdirSync, renameSync, existsSync } from "fs";
+import { join } from "path";
+import { createHash } from "crypto";
+
+const home = process.env.HOME || process.env.OPENCLAW_HOME || "/home/openclaw";
+const distDir = join(home, ".npm-global", "lib", "node_modules", "openclaw", "dist");
+const pkgPath = join(home, ".npm-global", "lib", "node_modules", "openclaw", "package.json");
+
+try {
+  const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+  const parts = (pkg.version || "").split(".").map(Number);
+  if (parts.length < 3 || parts[0] < 2026 || (parts[0] === 2026 && parts[1] < 5) ||
+      (parts[0] === 2026 && parts[1] === 5 && parts[2] < 19)) process.exit(0);
+  // No upper version cap for now — patch all versions >= 5.19
+} catch { process.exit(0); }
+
+const markerPath = join(distDir, ".session-fence-patched");
+let files;
+try { files = readdirSync(distDir).filter(f => f.startsWith("selection-") && f.endsWith(".js")); }
+catch { process.exit(0); }
+
+const targets = [
+  { fn: "function assertSessionFileFence()", repl: "function assertSessionFileFence() { return; }" },
+  { fn: "function eventMayReachTranscriptWriters", repl: 'function eventMayReachTranscriptWriters(session, event) { return typeof event?.type === "string"; }' },
+];
+
+for (const file of files) {
+  const p = join(distDir, file);
+  let src;
+  try { src = readFileSync(p, "utf-8"); } catch { continue; }
+  if (!targets.some(t => src.includes(t.fn) || src.includes("sameSessionFileFingerprint"))) continue;
+
+  const hash = createHash("sha256").update(src).digest("hex");
+  try { if (readFileSync(markerPath, "utf-8").trim() === hash) process.exit(0); } catch {}
+
+  let modified = src;
+  let count = 0;
+  for (const t of targets) {
+    const idx = modified.indexOf(t.fn);
+    if (idx === -1) continue;
+    if (modified.slice(idx, idx + t.repl.length + 5).startsWith(t.repl)) continue;
+    const braceStart = modified.indexOf("{", idx);
+    if (braceStart === -1) continue;
+    let d = 0, end = -1;
+    for (let i = braceStart; i < modified.length; i++) {
+      if (modified[i] === "{") d++;
+      else if (modified[i] === "}") { d--; if (d === 0) { end = i + 1; break; } }
+    }
+    if (end === -1) continue;
+    if (end - idx > 5000) continue; // safety: skip if body suspiciously large
+    modified = modified.slice(0, idx) + t.repl + modified.slice(end);
+    count++;
+  }
+  if (count === 0) {
+    try { writeFileSync(markerPath, hash + "\\n"); } catch {}
+    process.exit(0);
+  }
+  const tmp = p + ".tmp." + Math.random().toString(36).slice(2, 8);
+  writeFileSync(tmp, modified);
+  renameSync(tmp, p);
+  const newHash = createHash("sha256").update(modified).digest("hex");
+  try { writeFileSync(markerPath, newHash + "\\n"); } catch {}
+  console.log("[session-fence-patch] patched " + file);
+  break;
+}
+`;
+/**
+ * The custom entrypoint wrapper that executes the patch script before
+ * deferring to the image's original entrypoint.
+ */
+const CONTAINER_ENTRYPOINT_WRAPPER = `#!/bin/sh
+# JishuShell session-fence-patch entrypoint wrapper
+PATCH="$HOME/.jishushell/session-fence-patch.mjs"
+if [ -f "$PATCH" ]; then
+  node "$PATCH" 2>/dev/null || true
+fi
+exec /usr/local/bin/openclaw-entry.sh "$@"
+`;
+/**
+ * Write the container-side patch script and entrypoint wrapper to the
+ * openclaw-home directory so they are available inside the container
+ * via the bind mount.
+ *
+ * Called from onBeforeStart. Idempotent — only writes if content changed.
+ */
+export function writeContainerPatchScript(openclawHome) {
+    const scriptDir = join(openclawHome, ".jishushell");
+    try {
+        mkdirSync(scriptDir, { recursive: true });
+    }
+    catch {
+        return;
+    }
+    const scriptPath = join(scriptDir, "session-fence-patch.mjs");
+    const wrapperPath = join(scriptDir, "entrypoint.sh");
+    // Write patch script (idempotent)
+    try {
+        const existing = readFileSync(scriptPath, "utf-8");
+        if (existing === CONTAINER_PATCH_SCRIPT) {
+            // Also check wrapper
+            const existingWrapper = readFileSync(wrapperPath, "utf-8");
+            if (existingWrapper === CONTAINER_ENTRYPOINT_WRAPPER)
+                return;
+        }
+    }
+    catch {
+        // file missing — write it
+    }
+    try {
+        writeFileSync(scriptPath, CONTAINER_PATCH_SCRIPT, { mode: 0o755 });
+        writeFileSync(wrapperPath, CONTAINER_ENTRYPOINT_WRAPPER, { mode: 0o755 });
+    }
+    catch {
+        /* best effort */
+    }
+}
 function resolveUidGid(username) {
     try {
         if (!VALID_USER_RE.test(username)) {
@@ -1330,6 +1750,7 @@ class OpenClawAdapter {
                 // 3. Docker bridge patches
                 patchDockerBridgeGatewayBind(configPath);
                 patchJsproxyBaseUrl(configPath);
+                patchPrivateNetworkAllowFlag(configPath);
             }
             // Driver-agnostic: enable the OpenAI-compatible endpoints on every
             // start so the `llm-agent` capability advertised by openclaw-*.yaml
@@ -1345,6 +1766,22 @@ class OpenClawAdapter {
             catch {
                 /* best effort */
             }
+            // 4a. Patch session fence bug in OpenClaw >= 5.19
+            try {
+                const home = openclawAdapter.resolveAgentHome(instanceId);
+                if (home) {
+                    patchSessionFenceBug(home, instanceId);
+                    // Also write the container-side patch script so that even if
+                    // the host-side patch couldn't apply (e.g. symlink to container
+                    // path), the container will self-patch on startup.
+                    if (getNomadDriver() === "docker") {
+                        writeContainerPatchScript(home);
+                    }
+                }
+            }
+            catch {
+                /* best effort — patch failure must not prevent start */
+            }
             // 4b. Build the workspace symlink layout from this instance's
             //     fileMounts (M1 W2). For docker mode, the corresponding
             //     volume bindings are added in buildNomadTask below; for
@@ -2199,6 +2636,8 @@ class OpenClawAdapter {
             : [...DEFAULT_ARGS];
         const env = { ...DEFAULT_ENV };
         Object.assign(env, im.getRuntimeEnv(instanceId));
+        decryptRuntimeProviderEnv(env);
+        injectProviderHostEnv(env, instanceId);
         delete env.JSPROXY_API_KEY; // supplied via Nomad Template from Variables
         env.OPENCLAW_HOME = openclawHome;
         env.OPENCLAW_INSTANCE_ID = instanceId;
@@ -2257,6 +2696,11 @@ class OpenClawAdapter {
                 // timeout is too short for Pi-class networks pulling a 1+ GiB
                 // openclaw runtime image; bump to 15 minutes.
                 image_pull_timeout: "15m",
+                // Use the JishuShell entrypoint wrapper that applies the session
+                // fence patch before deferring to the image's original entrypoint.
+                // The wrapper script is written to $HOME/.jishushell/entrypoint.sh
+                // by onBeforeStart (writeContainerPatchScript).
+                entrypoint: [`${openclawHome}/.jishushell/entrypoint.sh`],
                 args,
                 work_dir: openclawHome,
                 volumes: buildVolumes(openclawHome, im.getInstanceRuntime(instanceId)),
@@ -3006,6 +3450,10 @@ function prepareConfigForSave(instanceId, config) {
         if (typeof p.api === "string" && p.api in LEGACY_PROVIDER_API_ALIASES) {
             p.api = LEGACY_PROVIDER_API_ALIASES[p.api];
         }
+        // Ensure allowPrivateNetwork for providers targeting the local proxy
+        if (typeof p.baseUrl === "string" && isPrivateNetworkBaseUrl(p.baseUrl)) {
+            p.request = { ...(p.request || {}), allowPrivateNetwork: true };
+        }
         if (!("apiKey" in p))
             continue;
         if (typeof p.baseUrl === "string" && p.baseUrl.includes("/proxy/"))
@@ -3013,7 +3461,7 @@ function prepareConfigForSave(instanceId, config) {
         const apiKey = p.apiKey;
         delete p.apiKey;
         if (envFiles.length) {
-            envUpdates[inferProviderApiKeyEnvName(providerId)] = String(apiKey || "");
+            envUpdates[inferProviderApiKeyEnvName(providerId)] = decryptRuntimeProviderApiKey(apiKey);
         }
         else {
             p.apiKey = apiKey;
@@ -3036,6 +3484,56 @@ function prepareConfigForSave(instanceId, config) {
     }
     return [configToWrite, envUpdates];
 }
+function decryptRuntimeProviderApiKey(apiKey) {
+    const value = String(apiKey || "");
+    return value.startsWith("enc:") ? decryptApiKey(value) : value;
+}
+function decryptRuntimeProviderEnv(env) {
+    for (const [key, value] of Object.entries(env)) {
+        if (!key.endsWith("_API_KEY"))
+            continue;
+        if (!String(value || "").startsWith("enc:"))
+            continue;
+        env[key] = decryptApiKey(value);
+    }
+}
+/**
+ * Auto-injects provider-specific host env vars that OpenClaw tools need
+ * at runtime, if the user hasn't already set them explicitly.
+ *
+ * Currently handles:
+ * - MINIMAX_API_HOST: Derived from MINIMAX_BASE_URL or upstream proxy config
+ *   to ensure the VLM tool calls the correct MiniMax API domain.
+ *
+ * Note: Only MiniMax needs this because its VLM tool reads MINIMAX_API_HOST
+ * to determine the endpoint. DeepSeek does not have a dedicated VLM tool
+ * in OpenClaw that requires a similar host env var.
+ */
+function injectProviderHostEnv(env, instanceId) {
+    // MINIMAX_API_HOST — needed by OpenClaw's VLM tool to call the correct domain
+    if (!env.MINIMAX_API_HOST) {
+        const baseUrl = env.MINIMAX_BASE_URL || "";
+        if (baseUrl) {
+            try {
+                const parsed = new URL(baseUrl);
+                env.MINIMAX_API_HOST = `${parsed.protocol}//${parsed.host}`;
+            }
+            catch { /* invalid URL, skip */ }
+        }
+        else {
+            // Infer from upstream proxy config if available
+            const config = getProxyInstanceConfig(instanceId);
+            const upstream = config?.["x-jishushell"]?.proxy?.upstream;
+            if (upstream?.providerId === "minimax" && upstream.baseUrl) {
+                try {
+                    const parsed = new URL(upstream.baseUrl);
+                    env.MINIMAX_API_HOST = `${parsed.protocol}//${parsed.host}`;
+                }
+                catch { /* invalid URL, skip */ }
+            }
+        }
+    }
+}
 /**
  * Dissociate a cloned/imported config from its source instance's IM bindings.
  * Physically migrated from `instance-manager.stripImBindings` so framework