jishushell 0.5.15 → 0.6.5

package/dist/services/setup-manager.js

@@ -1,15 +1,17 @@
 import { execFileSync, execSync, spawn as nodeSpawn } from "child_process";
-import { chmodSync, copyFileSync, existsSync, mkdtempSync, readFileSync, renameSync, rmSync, symlinkSync, unlinkSync } from "fs";
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdtempSync, readFileSync, renameSync, rmSync, symlinkSync, unlinkSync } from "fs";
 import { userInfo, platform as osPlatform, arch as osArch, cpus as osCpus } from "node:os";
 import { randomBytes } from "node:crypto";
 import { tmpdir } from "node:os";
-import { dirname, join } from "path";
+import { basename, dirname, join } from "path";
 import { StringDecoder } from "string_decoder";
 import { fileURLToPath } from "url";
-import { JISHUSHELL_HOME, getPanelConfig, savePanelConfig, setOpenclawDockerImage, getOpenclawDockerImage, DEFAULT_OPENCLAW_DOCKER_IMAGE, getRuntimeCatalogEntry, OPENCLAW_MODULES, OPENCLAW_BIN_DIR, } from "../config.js";
+import { JISHUSHELL_HOME, getCoreConfig, saveCoreConfig, setOpenclawDockerImage, getOpenclawDockerImage, DEFAULT_OPENCLAW_DOCKER_IMAGE, getRuntimeCatalogEntry, OPENCLAW_MODULES, OPENCLAW_BIN_DIR, } from "../config.js";
 import { ensureDirContainer, ensureDirHost, writeConfigFile, writeSecretFile, writeExecutableFile, writeSystemTmpFile } from "../utils/fs.js";
-import { buildDockerClientEnv, managedColimaSocketPath, resolveDockerHost } from "../utils/docker-host.js";
+import { buildDockerClientEnv, managedColimaSocketPath, managedColimaDockerHost, resolveDockerHost } from "../utils/docker-host.js";
+import { appleSiliconGuard, buildColimaWrapperScript, buildColimaPlist, buildNomadWaitWrapper, buildNomadPlist, buildCoreGateWrapper, buildCorePlist, buildPanelPlist, } from "./macos-launchd.js";
 import { getAdapter, listRegisteredAdapters } from "./runtime/index.js";
+import { hasLlmProviderSetup } from "./llm-proxy/providers.js";
 // Internal usage of task primitives — re-exports further down preserve the
 // public import surface used by runtime/adapters/*, routes, and CLI.
 import { createTask, emitTask, getRunningTasks } from "./task-registry.js";
@@ -25,8 +27,192 @@ const _COLIMA_DIR = join(JISHUSHELL_HOME, "colima");
 const COLIMA_PROFILE = "jishushell";
 const _COLIMA_SOCKET = managedColimaSocketPath(JISHUSHELL_HOME, COLIMA_PROFILE);
 const NOMAD_VERSION = "1.6.5";
-let _serverPort = 8090;
+const DEFAULT_CORE_PORT = 8091;
+const DEFAULT_PANEL_PORT = 8090;
+const SYSTEMD_CORE_SERVICE_PATH = "/etc/systemd/system/jishushell.service";
+const SYSTEMD_PANEL_SERVICE_PATH = "/etc/systemd/system/jishushell-panel.service";
+const SYSTEMD_NOMAD_SERVICE_PATH = "/etc/systemd/system/nomad.service";
+let _serverPort = DEFAULT_CORE_PORT;
 export function setServerPort(port) { _serverPort = port; }
+function shellQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function sudoCopySystemFile(content, destination, mode) {
+    const stagingDir = mkdtempSync(join(tmpdir(), "jishushell-system-"));
+    const stagingPath = join(stagingDir, basename(destination));
+    try {
+        writeSystemTmpFile(stagingPath, content);
+        execFileSync("sudo", ["cp", stagingPath, destination], { timeout: 5000 });
+        execFileSync("sudo", ["chown", "root:root", destination], { timeout: 5000 });
+        execFileSync("sudo", ["chmod", mode, destination], { timeout: 5000 });
+    }
+    finally {
+        rmSync(stagingDir, { recursive: true, force: true });
+    }
+}
+function removeSymlinkIfPresent(path) {
+    try {
+        if (lstatSync(path).isSymbolicLink())
+            unlinkSync(path);
+    }
+    catch (e) {
+        if (e?.code !== "ENOENT")
+            throw e;
+    }
+}
+function chownToUser(path, user) {
+    if (!user)
+        return;
+    const args = [`${user}:`, path];
+    if (typeof process.getuid === "function" && process.getuid() === 0) {
+        execFileSync("chown", args, { timeout: 5000 });
+    }
+    else {
+        execFileSync("sudo", ["chown", ...args], { timeout: 5000 });
+    }
+}
+function writeManagedExecutableFile(path, content, ownerUser) {
+    try {
+        writeExecutableFile(path, content);
+    }
+    catch (e) {
+        if (e?.code !== "EACCES" || !ownerUser)
+            throw e;
+        sudoCopySystemFile(content, path, "755");
+    }
+    chownToUser(path, ownerUser);
+}
+function resolveCoreCliBin() {
+    const candidates = [
+        process.env.JISHUSHELL_CORE_BIN,
+        join(__dirname, "..", "cli.js"),
+    ]
+        .map((candidate) => candidate?.trim())
+        .filter((candidate) => Boolean(candidate));
+    for (const candidate of candidates) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    throw new Error("Cannot locate jishushell entrypoint. Set JISHUSHELL_CORE_BIN to the bundled CLI path.");
+}
+function resolveBundledPanelServerBin() {
+    const packageRoot = join(__dirname, "..", "..");
+    const candidates = [
+        process.env.JISHUSHELL_PANEL_BIN,
+        join(packageRoot, "node_modules", "jishushell-panel", "output", "dist", "server.js"),
+    ]
+        .map((candidate) => candidate?.trim())
+        .filter((candidate) => Boolean(candidate));
+    for (const candidate of candidates) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    throw new Error("Cannot locate bundled jishushell-panel entrypoint. Install the Core+Panel jishushell-gui package or set JISHUSHELL_PANEL_BIN.");
+}
+function buildWrapperEnvPrelude() {
+    return `_WRAPPER_DIR="$(cd "$(dirname "$0")" && pwd)"
+_DEFAULT_JISHUSHELL_HOME="$(cd "$_WRAPPER_DIR/.." && pwd)"
+JISHUSHELL_HOME=\${JISHUSHELL_HOME:-$_DEFAULT_JISHUSHELL_HOME}
+
+_resolve_home() {
+  if [ -n "\${SUDO_UID:-}" ] && command -v getent >/dev/null 2>&1; then
+    _entry="$(getent passwd "$SUDO_UID" 2>/dev/null || true)"
+    if [ -n "$_entry" ]; then
+      printf '%s\\n' "$_entry" | cut -d: -f6
+      return
+    fi
+  fi
+  case "$JISHUSHELL_HOME" in
+    */.jishushell) printf '%s\\n' "\${JISHUSHELL_HOME%/.jishushell}" ;;
+    *) printf '%s\\n' "\${HOME:-$PWD}" ;;
+  esac
+}
+HOME="$(_resolve_home)"
+export JISHUSHELL_HOME HOME`;
+}
+function buildCoreStartWrapperContent(opts) {
+    const pathPrefix = [
+        "/opt/homebrew/bin",
+        "/opt/homebrew/sbin",
+        "/usr/local/bin",
+        "/usr/local/sbin",
+        "/usr/bin",
+        "/bin",
+        "/usr/sbin",
+        "/sbin",
+        dirname(opts.nodeBin),
+        dirname(opts.cliBin),
+    ].join(":");
+    const cliExec = opts.cliBin.endsWith(".js")
+        ? `${shellQuote(opts.nodeBin)} ${shellQuote(opts.cliBin)}`
+        : shellQuote(opts.cliBin);
+    return `#!/bin/sh
+set -eu
+${buildWrapperEnvPrelude()}
+[ -f "\${JISHUSHELL_HOME}/nomad.env" ] && . "\${JISHUSHELL_HOME}/nomad.env"
+export JISHUSHELL_CORE_BIN=${shellQuote(opts.cliBin)}
+export JISHUSHELL_CORE_PORT=${opts.port}
+export NODE_ENV=production
+export PATH=${shellQuote(pathPrefix)}\${PATH:+:\$PATH}
+if command -v ss >/dev/null 2>&1 && ss -tln 2>/dev/null | grep -Eq '(^|[[:space:]])[^[:space:]]*:${opts.port}[[:space:]]'; then
+  echo "JishuShell core port ${opts.port} is already listening; not starting another core."
+  exit 0
+fi
+exec ${cliExec} serve --port ${opts.port}
+`;
+}
+function buildCoreCliWrapperContent(opts) {
+    const pathPrefix = [
+        "/opt/homebrew/bin",
+        "/opt/homebrew/sbin",
+        "/usr/local/bin",
+        "/usr/local/sbin",
+        "/usr/bin",
+        "/bin",
+        "/usr/sbin",
+        "/sbin",
+        dirname(opts.nodeBin),
+        dirname(opts.cliBin),
+    ].join(":");
+    const cliExec = opts.cliBin.endsWith(".js")
+        ? `${shellQuote(opts.nodeBin)} ${shellQuote(opts.cliBin)}`
+        : shellQuote(opts.cliBin);
+    return `#!/bin/sh
+set -eu
+${buildWrapperEnvPrelude()}
+[ -f "\${JISHUSHELL_HOME}/nomad.env" ] && . "\${JISHUSHELL_HOME}/nomad.env"
+export JISHUSHELL_CORE_BIN=${shellQuote(opts.cliBin)}
+export JISHUSHELL_CORE_PORT=${opts.port}
+export NODE_ENV=\${NODE_ENV:-production}
+export PATH=${shellQuote(pathPrefix)}\${PATH:+:\$PATH}
+exec ${cliExec} "$@"
+`;
+}
+function buildPanelStartWrapperContent(opts) {
+    const manageCoreDefault = opts.manageCoreDefault ? "1" : "0";
+    const pathPrefix = [
+        "/opt/homebrew/bin",
+        "/opt/homebrew/sbin",
+        "/usr/local/bin",
+        "/usr/local/sbin",
+        "/usr/bin",
+        "/bin",
+        "/usr/sbin",
+        "/sbin",
+        dirname(opts.nodeBin),
+        dirname(opts.panelBin),
+    ].join(":");
+    return `#!/bin/sh
+set -eu
+${buildWrapperEnvPrelude()}
+export NODE_ENV=\${NODE_ENV:-production}
+export JISHUSHELL_CORE_BASE_URL=\${JISHUSHELL_CORE_BASE_URL:-http://127.0.0.1:${opts.corePort}}
+export JISHUSHELL_PANEL_PORT=\${JISHUSHELL_PANEL_PORT:-${opts.panelPort}}
+export JISHUSHELL_PANEL_MANAGE_CORE=\${JISHUSHELL_PANEL_MANAGE_CORE:-${manageCoreDefault}}
+export PATH=${shellQuote(pathPrefix)}\${PATH:+:\$PATH}
+exec ${shellQuote(opts.nodeBin)} ${shellQuote(opts.panelBin)} "$@"
+`;
+}
 // ── Resolve non-root service user (board-agnostic) ─────────────────
 /**
  * Determine which user the systemd service should run as.
@@ -76,6 +262,357 @@ function resolveServiceUser() {
     catch { /* /etc/passwd unreadable */ }
     throw new Error("Cannot determine service user. Run with a non-root user or set SUDO_UID.");
 }
+function resolveRealHome() {
+    return dirname(JISHUSHELL_HOME);
+}
+function resolveLaunchAgentsDir(realHome = resolveRealHome()) {
+    return join(process.env.HOME || realHome, "Library/LaunchAgents");
+}
+function resolveNomadExecutable() {
+    if (existsSync(NOMAD_BIN))
+        return NOMAD_BIN;
+    try {
+        return execFileSync("which", ["nomad"], { encoding: "utf-8", timeout: 5000 }).trim();
+    }
+    catch {
+        return "nomad";
+    }
+}
+function resolveColimaExecutable() {
+    try {
+        return execFileSync("which", ["colima"], { encoding: "utf-8", timeout: 5000 }).trim().split("\n")[0];
+    }
+    catch {
+        if (existsSync("/opt/homebrew/bin/colima"))
+            return "/opt/homebrew/bin/colima";
+        if (existsSync("/usr/local/bin/colima"))
+            return "/usr/local/bin/colima";
+        return "colima";
+    }
+}
+function buildJishushellCoreSystemdUnit(opts) {
+    return `[Unit]
+Description=JishuShell Core
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=${opts.currentUser}
+SupplementaryGroups=docker
+Environment=HOME=${opts.realHome}
+Environment=JISHUSHELL_HOME=${JISHUSHELL_HOME}
+EnvironmentFile=-/etc/jishushell/jishushell.env
+EnvironmentFile=-/etc/jishushell/nomad.env
+ExecStart=${opts.coreStartWrapperPath}
+Restart=on-failure
+RestartSec=5
+Environment=NODE_ENV=production
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function buildJishushellPanelSystemdUnit(opts) {
+    return `[Unit]
+Description=JishuShell Panel
+After=network-online.target jishushell.service
+Wants=network-online.target jishushell.service
+
+[Service]
+Type=simple
+User=${opts.currentUser}
+Environment=HOME=${opts.realHome}
+Environment=JISHUSHELL_HOME=${JISHUSHELL_HOME}
+Environment=JISHUSHELL_CORE_BASE_URL=http://127.0.0.1:${opts.corePort}
+Environment=JISHUSHELL_PANEL_PORT=${opts.panelPort}
+Environment=JISHUSHELL_PANEL_MANAGE_CORE=0
+Environment=NODE_ENV=production
+ExecStart=${opts.panelStartWrapperPath}
+Restart=on-failure
+RestartSec=5
+ProtectSystem=strict
+PrivateTmp=true
+ReadWritePaths=${JISHUSHELL_HOME}
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function buildNomadSystemdUnit(opts) {
+    return `[Unit]
+Description=Nomad Agent
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+User=root
+Type=simple
+EnvironmentFile=-/etc/jishushell/nomad.env
+ExecStart=${opts.nomadPath} agent -config=${opts.configPath}
+Restart=on-failure
+RestartSec=3
+Delegate=yes
+TasksMax=infinity
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+export function hasBundledPanel() {
+    try {
+        resolveBundledPanelServerBin();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function getExpectedCoreSystemFiles(port = _serverPort) {
+    const nodeBin = process.execPath;
+    const cliBin = resolveCoreCliBin();
+    const realHome = resolveRealHome();
+    const coreStartWrapperPath = join(BIN_DIR, "jishushell-core-start");
+    const coreCliWrapperPath = join(BIN_DIR, "jishushell");
+    const files = [
+        {
+            component: "wrapper",
+            id: "core.start-wrapper",
+            path: coreStartWrapperPath,
+            content: buildCoreStartWrapperContent({ nodeBin, cliBin, realHome, port }),
+            installScope: "core",
+            requiresSudo: false,
+            reloadRequired: true,
+            fix: "system-reload",
+        },
+        {
+            component: "wrapper",
+            id: "core.cli-wrapper",
+            path: coreCliWrapperPath,
+            content: buildCoreCliWrapperContent({ nodeBin, cliBin, realHome, port }),
+            installScope: "core",
+            requiresSudo: false,
+            reloadRequired: true,
+            fix: "system-reload",
+        },
+    ];
+    if (process.platform === "darwin") {
+        const gateWrapperPath = join(BIN_DIR, "core-launchd-wrapper.sh");
+        files.push({
+            component: "wrapper",
+            id: "core.launchd-gate-wrapper",
+            path: gateWrapperPath,
+            content: buildCoreGateWrapper({
+                socket: managedColimaSocketPath(JISHUSHELL_HOME, COLIMA_PROFILE),
+                coreStartWrapper: coreStartWrapperPath,
+            }),
+            installScope: "core",
+            requiresSudo: false,
+            reloadRequired: true,
+            fix: "system-reload",
+        }, {
+            component: "launchd",
+            id: "core.launchd-agent",
+            path: join(resolveLaunchAgentsDir(realHome), "com.jishushell.core.plist"),
+            content: buildCorePlist({
+                gateWrapperPath,
+                logPath: join(JISHUSHELL_HOME, "jishushell-core.log"),
+            }),
+            installScope: "core",
+            requiresSudo: false,
+            reloadRequired: true,
+            fix: "system-reload",
+        });
+        return files;
+    }
+    files.push({
+        component: "systemd",
+        id: "core.systemd-unit",
+        path: SYSTEMD_CORE_SERVICE_PATH,
+        content: buildJishushellCoreSystemdUnit({
+            currentUser: resolveServiceUser(),
+            realHome,
+            coreStartWrapperPath,
+        }),
+        installScope: "core",
+        requiresSudo: true,
+        reloadRequired: true,
+        fix: "system-reload",
+    });
+    return files;
+}
+export function getExpectedPanelSystemFiles(corePort = _serverPort, panelPort = DEFAULT_PANEL_PORT) {
+    const nodeBin = process.execPath;
+    const panelBin = resolveBundledPanelServerBin();
+    const realHome = resolveRealHome();
+    const panelStartWrapperPath = join(BIN_DIR, "jishushell-panel-start");
+    const files = [
+        {
+            component: "wrapper",
+            id: "panel.start-wrapper",
+            path: panelStartWrapperPath,
+            content: buildPanelStartWrapperContent({
+                nodeBin,
+                panelBin,
+                realHome,
+                corePort,
+                panelPort,
+            }),
+            installScope: "panel",
+            requiresSudo: false,
+            reloadRequired: true,
+            fix: "system-reload",
+        },
+    ];
+    if (process.platform === "darwin") {
+        files.push({
+            component: "launchd",
+            id: "panel.launchd-agent",
+            path: join(resolveLaunchAgentsDir(realHome), "com.jishushell.panel.plist"),
+            content: buildPanelPlist({
+                panelWrapperPath: panelStartWrapperPath,
+                logPath: join(JISHUSHELL_HOME, "jishushell-panel.log"),
+                home: realHome,
+                jishuHome: JISHUSHELL_HOME,
+                corePort,
+                panelPort,
+            }),
+            installScope: "panel",
+            requiresSudo: false,
+            reloadRequired: true,
+            fix: "system-reload",
+        });
+        return files;
+    }
+    files.push({
+        component: "systemd",
+        id: "panel.systemd-unit",
+        path: SYSTEMD_PANEL_SERVICE_PATH,
+        content: buildJishushellPanelSystemdUnit({
+            currentUser: resolveServiceUser(),
+            realHome,
+            panelStartWrapperPath,
+            corePort,
+            panelPort,
+        }),
+        installScope: "panel",
+        requiresSudo: true,
+        reloadRequired: true,
+        fix: "system-reload",
+    });
+    return files;
+}
+export function getExpectedNomadSystemFiles() {
+    const configPath = join(NOMAD_CONFIG_DIR, "nomad.hcl");
+    const files = [
+        {
+            component: "nomad",
+            id: "nomad.config",
+            path: configPath,
+            content: buildExpectedNomadConfigContent(),
+            installScope: "nomad",
+            requiresSudo: false,
+            reloadRequired: true,
+            fix: "system-reload",
+        },
+    ];
+    const nomadPath = resolveNomadExecutable();
+    if (process.platform === "darwin") {
+        const laDir = resolveLaunchAgentsDir();
+        const colimaSocket = managedColimaSocketPath(JISHUSHELL_HOME, COLIMA_PROFILE);
+        const colimaDockerHost = managedColimaDockerHost(JISHUSHELL_HOME, COLIMA_PROFILE);
+        const colimaWrapperPath = join(BIN_DIR, "colima-launchd-wrapper.sh");
+        const nomadWrapperPath = join(BIN_DIR, "nomad-launchd-wrapper.sh");
+        files.push({
+            component: "wrapper",
+            id: "nomad.colima-wrapper",
+            path: colimaWrapperPath,
+            content: buildColimaWrapperScript({
+                colimaHome: _COLIMA_DIR,
+                profile: COLIMA_PROFILE,
+                socket: colimaSocket,
+                colimaBin: resolveColimaExecutable(),
+            }),
+            installScope: "nomad",
+            requiresSudo: false,
+            reloadRequired: true,
+            fix: "system-reload",
+        }, {
+            component: "launchd",
+            id: "nomad.colima-launchd-agent",
+            path: join(laDir, "com.jishushell.colima.plist"),
+            content: buildColimaPlist({
+                wrapperPath: colimaWrapperPath,
+                colimaHome: _COLIMA_DIR,
+                logPath: join(_COLIMA_DIR, "colima-launchd.log"),
+            }),
+            installScope: "nomad",
+            requiresSudo: false,
+            reloadRequired: true,
+            fix: "system-reload",
+        }, {
+            component: "wrapper",
+            id: "nomad.launchd-wrapper",
+            path: nomadWrapperPath,
+            content: buildNomadWaitWrapper({
+                dockerHost: colimaDockerHost,
+                nomadBin: nomadPath,
+                configPath,
+            }),
+            installScope: "nomad",
+            requiresSudo: false,
+            reloadRequired: true,
+            fix: "system-reload",
+        }, {
+            component: "launchd",
+            id: "nomad.launchd-agent",
+            path: join(laDir, "com.jishushell.nomad.plist"),
+            content: buildNomadPlist({
+                wrapperPath: nomadWrapperPath,
+                dockerHost: colimaDockerHost,
+                logPath: join(NOMAD_CONFIG_DIR, "nomad.log"),
+            }),
+            installScope: "nomad",
+            requiresSudo: false,
+            reloadRequired: true,
+            fix: "system-reload",
+        });
+        return files;
+    }
+    files.push({
+        component: "systemd",
+        id: "nomad.systemd-unit",
+        path: SYSTEMD_NOMAD_SERVICE_PATH,
+        content: buildNomadSystemdUnit({ nomadPath, configPath }),
+        installScope: "nomad",
+        requiresSudo: true,
+        reloadRequired: true,
+        fix: "system-reload",
+    });
+    return files;
+}
+export function getExpectedSystemFiles(options = {}) {
+    const config = getCoreConfig();
+    const envCorePort = Number(process.env.JISHUSHELL_CORE_PORT);
+    const corePort = options.corePort ??
+        (Number.isFinite(envCorePort) && envCorePort > 0 ? envCorePort : Number(config.core_port) || _serverPort);
+    const panelPort = options.panelPort ?? DEFAULT_PANEL_PORT;
+    const includePanel = options.includePanel ?? hasBundledPanel();
+    const includeNomad = options.includeNomad ?? config.service_manager === "nomad";
+    const files = getExpectedCoreSystemFiles(corePort);
+    if (includePanel)
+        files.push(...getExpectedPanelSystemFiles(corePort, panelPort));
+    if (includeNomad)
+        files.push(...getExpectedNomadSystemFiles());
+    return files;
+}
+function persistCoreServicePort(port) {
+    const config = getCoreConfig();
+    if (Number(config.core_port) === port)
+        return;
+    config.core_port = port;
+    saveCoreConfig(config);
+}
 // ── Task tracker (for SSE progress) ────────────────────────────────
 // Storage, event dispatch, and subscribe plumbing now live in
 // task-registry.ts so non-setup callers (runtime-apps/*) can publish
@@ -250,6 +787,20 @@ function isPortListening(port) {
         return false;
     }
 }
+function waitForListeningPort(port, timeoutSeconds) {
+    const deadline = Date.now() + timeoutSeconds * 1000;
+    while (Date.now() < deadline) {
+        if (isPortListening(port))
+            return true;
+        try {
+            execFileSync("sleep", ["1"], { timeout: 2000 });
+        }
+        catch {
+            return isPortListening(port);
+        }
+    }
+    return isPortListening(port);
+}
 function checkSudo() {
     try {
         execSync("sudo -n true 2>/dev/null", { timeout: 3000 });
@@ -287,14 +838,7 @@ export function ensureCgroupMemory() {
                 return false; // already in cmdline, just needs reboot
             const patched = `${content} cgroup_memory=1 cgroup_enable=memory`;
             execFileSync("sudo", ["cp", f, f + ".bak"], { timeout: 5000 });
-            // Write to tmp file then sudo cp to avoid shell interpolation of file content
-            const tmpPath = join(dirname(f), ".cmdline.tmp");
-            writeSystemTmpFile(tmpPath, patched + "\n");
-            execFileSync("sudo", ["cp", tmpPath, f], { timeout: 5000 });
-            try {
-                unlinkSync(tmpPath);
-            }
-            catch { }
+            sudoCopySystemFile(patched + "\n", f, "644");
             console.log(`[setup] enabled cgroup memory in ${f} (reboot required)`);
             return true;
         }
@@ -334,7 +878,7 @@ function getDockerVersionLine(timeout = 10000) {
 }
 export async function getSetupStatus() {
     // Fast path: if setup is already complete, do lightweight checks before returning cached result
-    const config = getPanelConfig();
+    const config = getCoreConfig();
     if (config.service_manager) {
         const localBin = join(OPENCLAW_BIN_DIR, "openclaw");
         const localBinOk = existsSync(localBin);
@@ -375,9 +919,9 @@ export async function getSetupStatus() {
                 docker: { name: "Docker", installed: true, running: true, version: dockerVer, path: "" },
                 nomad: { name: "Nomad", installed: true, running: true, version: nomadVer, path: NOMAD_BIN },
                 openclaw: { name: "OpenClaw", installed: openclawOk, running: false, version: openclawVer, path: openclawPath },
-                dockerImageReady: fastDockerImageReady,
+                runtimeImageReady: fastDockerImageReady,
                 ready,
-                providerConfigured: !!config.default_provider,
+                providerConfigured: hasLlmProviderSetup(),
                 hasSudo: true,
                 runtimes: await buildRuntimesStatus(),
             };
@@ -436,10 +980,10 @@ export async function getSetupStatus() {
             openclaw = { ok: true, version: ver, path: localBin };
         }
     }
-    const dockerImageReady = checkDockerImageExists();
+    const runtimeImageReady = checkDockerImageExists();
     // If the Docker image already exists, treat openclaw as installed even when
     // the local npm package is absent — the image is all that's needed to run instances.
-    if (!openclaw.ok && dockerImageReady) {
+    if (!openclaw.ok && runtimeImageReady) {
         const imageTag = resolveDockerImageTag();
         const tagVersion = imageTag.split(":").pop() || "local";
         openclaw = { ok: true, version: tagVersion, path: imageTag };
@@ -451,15 +995,15 @@ export async function getSetupStatus() {
         version: openclaw.version.split("\n")[0],
         path: openclaw.path,
     };
-    const ready = nodeStatus.installed && !nodeStatus.needsUpgrade && dockerStatus.installed && dockerStatus.running && nomadStatus.installed && nomadStatus.running && openclawStatus.installed && dockerImageReady;
-    const providerConfigured = !!getPanelConfig().default_provider;
+    const ready = nodeStatus.installed && !nodeStatus.needsUpgrade && dockerStatus.installed && dockerStatus.running && nomadStatus.installed && nomadStatus.running && openclawStatus.installed && runtimeImageReady;
+    const providerConfigured = hasLlmProviderSetup();
     // Read-only check: report whether cgroup memory needs fixing (actual fix is in POST install routes)
     let needsReboot;
     if (dockerStatus.installed && !isCgroupMemoryEnabled()) {
         needsReboot = true;
     }
     const runningTasks = getRunningTasks();
-    return { node: nodeStatus, docker: dockerStatus, nomad: nomadStatus, openclaw: openclawStatus, ready, providerConfigured, dockerImageReady, hasSudo: checkSudo(), needsReboot, runningTasks: runningTasks.length ? runningTasks : undefined, runtimes: await buildRuntimesStatus() };
+    return { node: nodeStatus, docker: dockerStatus, nomad: nomadStatus, openclaw: openclawStatus, ready, providerConfigured, runtimeImageReady, hasSudo: checkSudo(), needsReboot, runningTasks: runningTasks.length ? runningTasks : undefined, runtimes: await buildRuntimesStatus() };
 }
 /**
  * Build the per-runtime install status block by iterating over every
@@ -475,10 +1019,13 @@ const BUILD_RUNTIMES_PROBE_TIMEOUT_MS = 2500;
 async function buildRuntimesStatus() {
     const adapters = listRegisteredAdapters().filter((a) => typeof a.getInstallStatus === "function");
     const probes = adapters.map(async (adapter) => {
+        let timer;
         try {
             const status = await Promise.race([
                 Promise.resolve(adapter.getInstallStatus()),
-                new Promise((_, reject) => setTimeout(() => reject(new Error("install-status probe timed out")), BUILD_RUNTIMES_PROBE_TIMEOUT_MS)),
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new Error("install-status probe timed out")), BUILD_RUNTIMES_PROBE_TIMEOUT_MS);
+                }),
             ]);
             if (!status)
                 return null;
@@ -488,6 +1035,10 @@ async function buildRuntimesStatus() {
         catch {
             return null;
         }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
     });
     const out = {};
     for (const result of await Promise.all(probes)) {
@@ -569,6 +1120,17 @@ export async function upgradeNode(targetMajor = 22) {
 async function installDockerWithTask(task) {
     try {
         emitTask(task, { type: "progress", message: "开始安装 Docker...", progress: 0 });
+        // macOS short-circuit: the rest of this function targets apt/get.docker.com,
+        // both of which silently no-op or hard-fail on Darwin. Docker on macOS is
+        // provided by Colima (auto-installed by the bash installer at
+        // install/jishu-install.sh) — not by this code path. Refuse early with a
+        // clear pointer so the user doesn't see a confusing apt error.
+        if (process.platform === "darwin") {
+            const msg = "macOS Docker 需要 Colima。请运行 shell 安装器 (curl -fsSL https://raw.githubusercontent.com/nicepkg/jishushell/main/install/jishu-install.sh | bash),或参阅 docs/macos-colima.md 手动安装 Colima。";
+            emitTask(task, { type: "error", message: msg });
+            task.status = "error";
+            return { ok: false, message: msg, error: "darwin-not-supported-via-this-path" };
+        }
         const user = execSync("whoami", { encoding: "utf-8", timeout: 5000 }).trim();
         // ── Try the get.docker.com convenience script ─────────────────
         emitTask(task, { type: "log", message: "下载 Docker 安装脚本..." });
@@ -1128,11 +1690,7 @@ function fixNomadDirOwnership() {
     }
     catch { /* stat failed — dir doesn't exist yet, no action needed */ }
 }
-function writeNomadConfig() {
-    fixNomadDirOwnership();
-    ensureDirHost(NOMAD_CONFIG_DIR);
-    ensureDirContainer(NOMAD_DATA_DIR);
-    ensureDirContainer(NOMAD_ALLOC_DIR);
+export function buildExpectedNomadConfigContent() {
     const platform = osPlatform();
     const loopbackIface = platform === "darwin" ? "lo0" : "lo";
     const externalIface = detectNomadExternalInterface(loopbackIface);
@@ -1213,6 +1771,9 @@ ${externalHostNetworkBlock}${dockerBridgeHostNetworkBlock}
 
 plugin "docker" {
   config {${dockerEndpointLine}
+    gc {
+      image = false
+    }
     volumes {
       enabled = true
     }
@@ -1233,7 +1794,14 @@ limits {
   http_max_conns_per_client = 0
 }
 `;
-    writeConfigFile(join(NOMAD_CONFIG_DIR, "nomad.hcl"), config);
+    return config;
+}
+function writeNomadConfig() {
+    fixNomadDirOwnership();
+    ensureDirHost(NOMAD_CONFIG_DIR);
+    ensureDirContainer(NOMAD_DATA_DIR);
+    ensureDirContainer(NOMAD_ALLOC_DIR);
+    writeConfigFile(join(NOMAD_CONFIG_DIR, "nomad.hcl"), buildExpectedNomadConfigContent());
 }
 function detectDockerBridgeCidr() {
     // `docker network inspect bridge` returns the CIDR for docker0. The exact
@@ -1295,13 +1863,13 @@ export function loadNomadToken() {
             // no read permission, try next candidate
         }
     }
-    const legacy = getPanelConfig().nomad_token;
+    const legacy = getCoreConfig().nomad_token;
     if (legacy)
         process.env.NOMAD_TOKEN = legacy;
 }
 /** Verify the current NOMAD_TOKEN is accepted by the Nomad API. Returns false if it is missing or rejected (HTTP 403/401). */
 async function isNomadTokenValid() {
-    const token = process.env.NOMAD_TOKEN || getPanelConfig().nomad_token;
+    const token = process.env.NOMAD_TOKEN || getCoreConfig().nomad_token;
     if (!token)
         return false;
     try {
@@ -1316,7 +1884,7 @@ async function isNomadTokenValid() {
     }
 }
 function nomadApiHeaders(extra = {}) {
-    const token = process.env.NOMAD_TOKEN || getPanelConfig().nomad_token;
+    const token = process.env.NOMAD_TOKEN || getCoreConfig().nomad_token;
     return token ? { "X-Nomad-Token": token, ...extra } : extra;
 }
 export async function ensureNomadMemoryOversubscriptionEnabled() {
@@ -1359,7 +1927,7 @@ async function finalizeNomadStartup() {
 }
 async function bootstrapNomadACL() {
     // If a token is already loaded, verify it's still valid before trusting it.
-    if (process.env.NOMAD_TOKEN || getPanelConfig().nomad_token) {
+    if (process.env.NOMAD_TOKEN || getCoreConfig().nomad_token) {
         if (await isNomadTokenValid())
             return;
         console.log("[nomad] Stored ACL token is invalid — re-bootstrapping...");
@@ -1386,13 +1954,7 @@ async function bootstrapNomadACL() {
         writeSecretFile(envFile, envContent);
         try {
             execFileSync("sudo", ["-n", "mkdir", "-p", "/etc/jishushell"], { timeout: 5000, stdio: "pipe" });
-            writeSystemTmpFile("/tmp/.nomad-env-tmp", envContent);
-            execFileSync("sudo", ["-n", "cp", "/tmp/.nomad-env-tmp", "/etc/jishushell/nomad.env"], { timeout: 5000, stdio: "pipe" });
-            execFileSync("sudo", ["-n", "chmod", "600", "/etc/jishushell/nomad.env"], { timeout: 5000, stdio: "pipe" });
-            try {
-                unlinkSync("/tmp/.nomad-env-tmp");
-            }
-            catch { }
+            sudoCopySystemFile(envContent, "/etc/jishushell/nomad.env", "600");
         }
         catch (copyErr) {
             console.warn("[nomad] Could not sync token to /etc/jishushell/nomad.env:", copyErr.message);
@@ -1635,85 +2197,77 @@ export async function stopNomad() {
 // ── Install Nomad as systemd service ───────────────────────────────
 export function installNomadSystemd() {
     try {
-        let nomadPath = NOMAD_BIN;
-        if (!existsSync(NOMAD_BIN)) {
-            try {
-                nomadPath = execFileSync("which", ["nomad"], { encoding: "utf-8", timeout: 5000 }).trim();
-            }
-            catch {
-                nomadPath = "nomad";
-            }
-        }
+        const nomadPath = resolveNomadExecutable();
         const configPath = join(NOMAD_CONFIG_DIR, "nomad.hcl");
         writeNomadConfig();
         if (process.platform === "darwin") {
-            const plistLabel = "com.jishushell.nomad";
+            // macOS is Apple Silicon only — fail fast (mirrors the bash uname guard).
+            const guard = appleSiliconGuard();
+            if (!guard.ok)
+                return { ok: false, message: guard.message };
+            const laDir = join(process.env.HOME || dirname(JISHUSHELL_HOME), "Library/LaunchAgents");
+            // Always use JishuShell's private Colima socket — hardcoded, not
+            // runtime-detected. Colima may not be running yet when the plist is
+            // written; runtime fallback would pick the wrong socket (Docker
+            // Desktop or /var/run/docker.sock). Mirrors the bash _COLIMA_SOCKET use.
+            const colimaSocket = managedColimaSocketPath(JISHUSHELL_HOME, COLIMA_PROFILE);
+            const colimaDockerHost = managedColimaDockerHost(JISHUSHELL_HOME, COLIMA_PROFILE);
+            // ── 1. Colima self-retrying launchd agent ───────────────────────
+            // colima binary: prefer PATH, fall back to both Homebrew prefixes
+            // (mirrors the bash COLIMA_BIN resolution).
+            const colimaBin = resolveColimaExecutable();
+            const colimaWrapperPath = join(BIN_DIR, "colima-launchd-wrapper.sh");
+            writeExecutableFile(colimaWrapperPath, buildColimaWrapperScript({
+                colimaHome: _COLIMA_DIR,
+                profile: COLIMA_PROFILE,
+                socket: colimaSocket,
+                colimaBin,
+            }));
+            const colimaPlistPath = join(laDir, "com.jishushell.colima.plist");
+            writeConfigFile(colimaPlistPath, buildColimaPlist({
+                wrapperPath: colimaWrapperPath,
+                colimaHome: _COLIMA_DIR,
+                logPath: join(_COLIMA_DIR, "colima-launchd.log"),
+            }));
+            try {
+                execSync(`launchctl unload "${colimaPlistPath}" 2>/dev/null`);
+            }
+            catch { }
+            try {
+                execSync(`launchctl load -w "${colimaPlistPath}"`, { timeout: 15000 });
+            }
+            catch { }
+            // ── 2. Nomad gated behind a docker-readiness wrapper ────────────
             const logPath = join(NOMAD_CONFIG_DIR, "nomad.log");
-            const dockerHost = resolveDockerHost({
-                jishuHome: JISHUSHELL_HOME,
-                colimaProfile: COLIMA_PROFILE,
+            const nomadWrapperPath = join(BIN_DIR, "nomad-launchd-wrapper.sh");
+            writeExecutableFile(nomadWrapperPath, buildNomadWaitWrapper({
+                dockerHost: colimaDockerHost,
+                nomadBin: nomadPath,
+                configPath,
+            }));
+            const plistContent = buildNomadPlist({
+                wrapperPath: nomadWrapperPath,
+                dockerHost: colimaDockerHost,
+                logPath,
             });
-            const dockerHostEntry = dockerHost
-                ? `
-    <key>DOCKER_HOST</key><string>${dockerHost}</string>`
-                : "";
-            const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key><string>${plistLabel}</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>${nomadPath}</string>
-    <string>agent</string>
-    <string>-config=${configPath}</string>
-  </array>
-  <key>EnvironmentVariables</key>
-  <dict>${dockerHostEntry}
-    <key>PATH</key><string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
-  </dict>
-  <key>RunAtLoad</key><true/>
-  <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key><string>${logPath}</string>
-  <key>StandardErrorPath</key><string>${logPath}</string>
-</dict>
-</plist>`;
-            const plistPath = join(process.env.HOME || dirname(JISHUSHELL_HOME), `Library/LaunchAgents/${plistLabel}.plist`);
+            const plistPath = join(laDir, "com.jishushell.nomad.plist");
             writeConfigFile(plistPath, plistContent);
             try {
                 execSync(`launchctl unload "${plistPath}" 2>/dev/null`);
             }
             catch { }
             execSync(`launchctl load -w "${plistPath}"`, { timeout: 15000 });
-            return { ok: true, message: "Nomad launchd agent installed and started" };
+            return { ok: true, message: "Nomad launchd agent installed and started (Colima gated)" };
         }
         // Nomad 1.6.5's docker driver fingerprint requires euid==0 — PR #18197 lifted
         // that restriction only in 1.7+, and we intentionally stay on the 1.6 MPL line.
-        // The panel stays as the installing user via a separate jishushell.service unit;
+        // The core server stays as the installing user via a separate jishushell.service unit;
         // it talks to this agent over HTTP, so no files under ~/.jishushell/nomad/data/
-        // are read directly by the panel.
-        const serviceContent = `[Unit]
-Description=Nomad Agent
-After=network-online.target docker.service
-Wants=network-online.target
-
-[Service]
-User=root
-Type=simple
-EnvironmentFile=-/etc/jishushell/nomad.env
-ExecStart=${nomadPath} agent -config=${configPath}
-Restart=on-failure
-RestartSec=3
-Delegate=yes
-TasksMax=infinity
-
-[Install]
-WantedBy=multi-user.target
-`;
-        const servicePath = "/etc/systemd/system/nomad.service";
+        // are read directly by the core process.
+        const serviceContent = buildNomadSystemdUnit({ nomadPath, configPath });
+        const servicePath = SYSTEMD_NOMAD_SERVICE_PATH;
         execFileSync("sudo", ["mkdir", "-p", "/etc/jishushell"], { timeout: 5000 });
-        writeSystemTmpFile("/tmp/nomad.service", serviceContent);
-        execFileSync("sudo", ["cp", "/tmp/nomad.service", servicePath], { timeout: 5000 });
+        sudoCopySystemFile(serviceContent, servicePath, "644");
         execFileSync("sudo", ["systemctl", "daemon-reload"], { timeout: 5000 });
         execFileSync("sudo", ["systemctl", "enable", "--now", "nomad"], { timeout: 15000 });
         // Also restart if already running so it picks up the new User= directive
@@ -1728,93 +2282,177 @@ WantedBy=multi-user.target
     }
 }
 // ── Install JishuShell as systemd service ─────────────────────────
-export function installJishushellSystemd(port) {
+export function installJishushellSystemd(port, startNow = false) {
     try {
         const resolvedPort = port || _serverPort;
+        persistCoreServicePort(resolvedPort);
+        const serviceUser = process.platform === "darwin" ? undefined : resolveServiceUser();
         // Use the node binary that is currently running this process — avoids
         // "which node" failing when PATH doesn't include nvm's bin dir.
         const nodeBin = process.execPath;
-        // dist/cli.js lives next to this file (dist/services/setup-manager.js → dist/cli.js)
-        const cliBin = join(__dirname, "..", "cli.js");
+        const cliBin = resolveCoreCliBin();
         // The real owner home: prefer JISHUSHELL_HOME's parent so we don't rely on $HOME.
-        const realHome = dirname(JISHUSHELL_HOME);
+        const realHome = resolveRealHome();
+        const coreStartWrapperPath = join(BIN_DIR, "jishushell-core-start");
+        const coreCliWrapperPath = join(BIN_DIR, "jishushell");
+        removeSymlinkIfPresent(coreCliWrapperPath);
+        writeManagedExecutableFile(coreStartWrapperPath, buildCoreStartWrapperContent({
+            nodeBin,
+            cliBin,
+            realHome,
+            port: resolvedPort,
+        }), serviceUser);
+        writeManagedExecutableFile(coreCliWrapperPath, buildCoreCliWrapperContent({
+            nodeBin,
+            cliBin,
+            realHome,
+            port: resolvedPort,
+        }), serviceUser);
         if (process.platform === "darwin") {
-            const plistLabel = "com.jishushell.panel";
-            const logPath = join(JISHUSHELL_HOME, "panel.log");
-            const wrapperPath = join(JISHUSHELL_HOME, "bin", "jishushell-panel-start");
-            const nomadEnvPath = join(JISHUSHELL_HOME, "nomad.env");
-            const wrapperContent = `#!/bin/sh
-[ -f "${nomadEnvPath}" ] && . "${nomadEnvPath}"
-export JISHUSHELL_HOME="${JISHUSHELL_HOME}"
-export HOME="${realHome}"
-export NODE_ENV=production
-export PATH="/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin:${dirname(nodeBin)}:\${PATH}"
-exec "${nodeBin}" "${cliBin}" serve --port ${resolvedPort}
-`;
-            writeExecutableFile(wrapperPath, wrapperContent);
-            const plistContent = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key><string>${plistLabel}</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>/bin/sh</string>
-    <string>${wrapperPath}</string>
-  </array>
-  <key>RunAtLoad</key><true/>
-  <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key><string>${logPath}</string>
-  <key>StandardErrorPath</key><string>${logPath}</string>
-</dict>
-</plist>`;
-            const plistPath = join(process.env.HOME || realHome, `Library/LaunchAgents/${plistLabel}.plist`);
+            // macOS is Apple Silicon only — fail fast (mirrors the bash uname guard).
+            const guard = appleSiliconGuard();
+            if (!guard.ok)
+                return { ok: false, message: guard.message };
+            const logPath = join(JISHUSHELL_HOME, "jishushell-core.log");
+            // 60s docker-readiness gate before core starts; on timeout it starts anyway.
+            const gateWrapperPath = join(BIN_DIR, "core-launchd-wrapper.sh");
+            writeExecutableFile(gateWrapperPath, buildCoreGateWrapper({
+                socket: managedColimaSocketPath(JISHUSHELL_HOME, COLIMA_PROFILE),
+                coreStartWrapper: coreStartWrapperPath,
+            }));
+            const plistContent = buildCorePlist({
+                gateWrapperPath,
+                logPath,
+            });
+            // Symmetric with installNomadSystemd()'s laDir (realHome === dirname(JISHUSHELL_HOME),
+            // so process.env.HOME || dirname(JISHUSHELL_HOME) is provably the same path).
+            const laDir = resolveLaunchAgentsDir(realHome);
+            const plistPath = join(laDir, "com.jishushell.core.plist");
             writeConfigFile(plistPath, plistContent);
-            const panelAlreadyRunning = isPortListening(resolvedPort);
-            if (!panelAlreadyRunning) {
+            if (startNow || !isPortListening(resolvedPort)) {
                 try {
                     execSync(`launchctl unload "${plistPath}" 2>/dev/null`);
                 }
                 catch { }
                 execSync(`launchctl load -w "${plistPath}"`, { timeout: 15000 });
+                if (!waitForListeningPort(resolvedPort, 30)) {
+                    return {
+                        ok: false,
+                        message: "JishuShell core launchd agent installed, but the core port is not ready yet",
+                    };
+                }
+                return { ok: true, message: "JishuShell core launchd agent installed and started (port " + resolvedPort + ")" };
             }
-            return { ok: true, message: "JishuShell launchd agent installed and enabled (port " + resolvedPort + ")" };
+            return { ok: true, message: "JishuShell core launchd agent installed and enabled (port " + resolvedPort + ")" };
         }
-        const currentUser = resolveServiceUser();
-        const serviceContent = `[Unit]
-Description=JishuShell Panel
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=${currentUser}
-SupplementaryGroups=docker
-Environment=HOME=${realHome}
-Environment=JISHUSHELL_HOME=${JISHUSHELL_HOME}
-EnvironmentFile=-/etc/jishushell/jishushell.env
-EnvironmentFile=-/etc/jishushell/nomad.env
-ExecStart=${nodeBin} ${cliBin} serve --port ${resolvedPort}
-Restart=on-failure
-RestartSec=5
-Environment=NODE_ENV=production
-
-[Install]
-WantedBy=multi-user.target
-`;
+        const currentUser = serviceUser ?? resolveServiceUser();
+        const serviceContent = buildJishushellCoreSystemdUnit({
+            currentUser,
+            realHome,
+            coreStartWrapperPath,
+        });
         execFileSync("sudo", ["mkdir", "-p", "/etc/jishushell"], { timeout: 5000 });
-        writeSystemTmpFile("/tmp/jishushell.service", serviceContent);
-        execFileSync("sudo", ["cp", "/tmp/jishushell.service", "/etc/systemd/system/jishushell.service"], { timeout: 5000 });
+        sudoCopySystemFile(serviceContent, SYSTEMD_CORE_SERVICE_PATH, "644");
         execFileSync("sudo", ["systemctl", "daemon-reload"], { timeout: 5000 });
-        execFileSync("sudo", ["systemctl", "enable", "jishushell"], { timeout: 15000 });
-        // Don't start now — the current process is already running on this port.
-        // The service will auto-start on next reboot.
-        return { ok: true, message: "JishuShell systemd service installed and enabled (port " + resolvedPort + ")" };
+        execFileSync("sudo", ["systemctl", "enable", "jishushell"], { timeout: 15000, stdio: "pipe" });
+        if (!startNow) {
+            return { ok: true, message: "JishuShell core systemd service installed and enabled (port " + resolvedPort + ")" };
+        }
+        execFileSync("sudo", ["systemctl", "restart", "jishushell"], { timeout: 15000 });
+        if (!waitForListeningPort(resolvedPort, 30)) {
+            return {
+                ok: false,
+                message: "JishuShell core systemd service installed, but the core port is not ready yet",
+            };
+        }
+        return { ok: true, message: "JishuShell core systemd service installed and started (port " + resolvedPort + ")" };
     }
     catch (e) {
         return { ok: false, message: "Failed to install JishuShell systemd service", error: e.message };
     }
 }
+export function installJishushellPanelSystemd(corePort, panelPort = DEFAULT_PANEL_PORT, startNow = true) {
+    try {
+        const resolvedCorePort = corePort || _serverPort;
+        const serviceUser = process.platform === "darwin" ? undefined : resolveServiceUser();
+        const nodeBin = process.execPath;
+        const panelBin = resolveBundledPanelServerBin();
+        const realHome = resolveRealHome();
+        const panelStartWrapperPath = join(BIN_DIR, "jishushell-panel-start");
+        writeManagedExecutableFile(panelStartWrapperPath, buildPanelStartWrapperContent({
+            nodeBin,
+            panelBin,
+            realHome,
+            corePort: resolvedCorePort,
+            panelPort,
+        }), serviceUser);
+        if (process.platform === "darwin") {
+            const guard = appleSiliconGuard();
+            if (!guard.ok)
+                return { ok: false, message: guard.message };
+            const laDir = resolveLaunchAgentsDir(realHome);
+            const plistPath = join(laDir, "com.jishushell.panel.plist");
+            writeConfigFile(plistPath, buildPanelPlist({
+                panelWrapperPath: panelStartWrapperPath,
+                logPath: join(JISHUSHELL_HOME, "jishushell-panel.log"),
+                home: realHome,
+                jishuHome: JISHUSHELL_HOME,
+                corePort: resolvedCorePort,
+                panelPort,
+            }));
+            if (!waitForListeningPort(resolvedCorePort, 30)) {
+                return {
+                    ok: false,
+                    message: "JishuShell Panel launchd agent was written but not started because the core port is not ready",
+                };
+            }
+            try {
+                execSync(`launchctl unload "${plistPath}" 2>/dev/null`);
+            }
+            catch { }
+            execSync(`launchctl load -w "${plistPath}"`, { timeout: 15000 });
+            if (!waitForListeningPort(panelPort, 15)) {
+                return {
+                    ok: false,
+                    message: "JishuShell Panel launchd agent started, but the panel port is not ready yet",
+                };
+            }
+            return { ok: true, message: "JishuShell Panel launchd agent installed and started (port " + panelPort + ")" };
+        }
+        const currentUser = serviceUser ?? resolveServiceUser();
+        const serviceContent = buildJishushellPanelSystemdUnit({
+            currentUser,
+            realHome,
+            panelStartWrapperPath,
+            corePort: resolvedCorePort,
+            panelPort,
+        });
+        execFileSync("sudo", ["mkdir", "-p", "/etc/jishushell"], { timeout: 5000 });
+        sudoCopySystemFile(serviceContent, SYSTEMD_PANEL_SERVICE_PATH, "644");
+        execFileSync("sudo", ["systemctl", "daemon-reload"], { timeout: 5000 });
+        execFileSync("sudo", ["systemctl", "enable", "jishushell-panel"], { timeout: 15000, stdio: "pipe" });
+        if (!startNow) {
+            return { ok: true, message: "JishuShell Panel systemd service installed and enabled (port " + panelPort + ")" };
+        }
+        if (!waitForListeningPort(resolvedCorePort, 30)) {
+            return {
+                ok: false,
+                message: "JishuShell Panel systemd service was enabled but not started because the core port is not ready",
+            };
+        }
+        execFileSync("sudo", ["systemctl", "restart", "jishushell-panel"], { timeout: 15000 });
+        if (!waitForListeningPort(panelPort, 15)) {
+            return {
+                ok: false,
+                message: "JishuShell Panel systemd service started, but the panel port is not ready yet",
+            };
+        }
+        return { ok: true, message: "JishuShell Panel systemd service installed and started (port " + panelPort + ")" };
+    }
+    catch (e) {
+        return { ok: false, message: "Failed to install JishuShell Panel systemd service", error: e.message };
+    }
+}
 // ── Install OpenClaw (async with progress) ─────────────────────────
 /**
  * Install OpenClaw runtime — thin dispatch wrapper.
@@ -1909,12 +2547,12 @@ function checkDockerImageExists() {
     catch {
         // Fallback scan: list all local images and try to find any known runtime image.
         // This handles two scenarios:
-        //  1. panel.json was wiped (e.g. after `jishushell reset`) and the pinned version
+        //  1. core.json was wiped (e.g. after `jishushell reset`) and the pinned version
         //     tag is no longer stored, causing getOpenclawDockerImage() to return the default
         //     `:latest` tag which may have been removed locally during the first-run migration.
         //  2. The environment uses a locally built runtime image (e.g. jishushell-hermes:latest)
         //     that differs from the registry default.
-        // When a candidate is found we restore panel.json (self-heal) so the fast path works next time.
+        // When a candidate is found we restore core.json (self-heal) so the fast path works next time.
         try {
             const invocation = resolveDockerInvocation();
             const out = execFileSync(invocation.cmd, [...invocation.argsPrefix, "images", "--format", "{{.Repository}}:{{.Tag}}"], { encoding: "utf8", timeout: 5000 });
@@ -1934,7 +2572,7 @@ function checkDockerImageExists() {
             }
             // 2. Backward compat: older locally-built jishushell-openclaw:* image names.
             //    These use the same slim base architecture as ghcr.io/x-aijishu/openclaw-runtime:*
-            //    and are fully compatible. Self-heal panel.json so the tag stored there becomes
+            //    and are fully compatible. Self-heal core.json so the tag stored there becomes
             //    the concrete existing tag, preventing repeated DEFAULT-migration side effects.
             const legacyFound = lines.find((l) => /^jishushell-openclaw:[^\s]+/.test(l) && !l.endsWith(":<none>") && !l.endsWith(":none"));
             if (legacyFound) {
@@ -1946,7 +2584,7 @@ function checkDockerImageExists() {
         return false;
     }
 }
-// The stable tag for the JishuShell base image. Reads panel.json — framework-level.
+// The stable tag for the JishuShell base image. Reads core.json — framework-level.
 function resolveDockerImageTag() {
     return getOpenclawDockerImage();
 }
@@ -2088,10 +2726,10 @@ export async function runFullSetup(options = {}) {
     if (!allOk) {
         return { ok: false, steps };
     }
-    const config = getPanelConfig();
+    const config = getCoreConfig();
     config.service_manager = "nomad";
     config.nomad_driver = "docker";
-    savePanelConfig(config);
+    saveCoreConfig(config);
     // Install jishushell systemd service (best-effort — does not block setup completion)
     steps.push({ step: "jishushell-systemd", status: "running", message: "Configuring JishuShell auto-start..." });
     const jsResult = installJishushellSystemd();