jishushell 0.5.22 → 0.6.18

package/dist/server.js

@@ -1,45 +1,51 @@
 import Fastify from "fastify";
-import fastifyStatic from "@fastify/static";
 import multipart from "@fastify/multipart";
-import { basename, dirname, join } from "path";
-import { existsSync, realpathSync } from "fs";
-import { fileURLToPath } from "url";
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-import { ensureDirs, ensurePanelConfig, getPanelConfig, migrateCatalogSchemaIfNeeded, migrateHermesShimOutIfNeeded, migrateOpenclawCatalogIfNeeded, migrateOpenclawImageTagIfNeeded, getInternalMcpToken, } from "./config.js";
+import { ensureDirs, ensureCoreConfig, getCoreConfig, migrateIntegrationRuntimeSchemaIfNeeded, migrateHermesShimOutIfNeeded, removeFlatOpenclawImageIfNeeded, getInternalMcpToken, } from "./config.js";
 import { timingSafeEqual } from "node:crypto";
-import { runStartupMigrations } from "./services/runtime/index.js";
+import { listRegisteredIntegrations, normalizeIntegrationCoreConfigOnStartup } from "./services/integrations/index.js";
 import { verifyToken } from "./auth.js";
 import { authRoutes } from "./routes/auth.js";
 import { instanceRoutes } from "./routes/instances.js";
 import { systemRoutes } from "./routes/system.js";
 import { setupRoutes } from "./routes/setup.js";
-import { runtimeCatalogRoutes } from "./routes/runtime.js";
+import { integrationsRoutes } from "./routes/integrations.js";
 import { appRoutes } from "./routes/apps.js";
-import { agentAppRoutes } from "./routes/agent-apps.js";
+import { integrationAppRoutes } from "./routes/integration-apps.js";
 import { llmRoutes } from "./routes/llm.js";
 import { filesRoutes } from "./routes/files.js";
-import { internalRoutes } from "./routes/internal.js";
 import { organizeRoutes } from "./routes/files-organize.js";
 import { fileMountsRoutes } from "./routes/file-mounts.js";
+import { registerProxyRoutes } from "./routes/llm-proxy.js";
 import { webdavRoutes } from "./routes/webdav.js";
 import { externalMountsRoutes } from "./routes/external-mounts.js";
-import { FilesManager } from "./services/files-manager.js";
-import * as appManager from "./services/app/app-manager.js";
-import * as capabilityRegistry from "./services/capability-registry.js";
-import { getAdvertisedHostForPort, getStoredConfig as getNativeStoredConfig, } from "./services/instance-manager.js";
+import { FilesManager } from "./services/files/files-manager.js";
+import { registerAppModuleRoutes } from "./services/app-modules/routes.js";
+import { registerIntegrationOwnedRoutes } from "./services/integrations/routes.js";
+import * as appService from "./services/app-common/service.js";
+import * as appLifecycle from "./services/app-common/lifecycle-service.js";
+import * as capabilityRegistry from "./services/capabilities/registry.js";
+import { getConnectHostForPort } from "./services/instances/manager.js";
 import backupRoutes from "./routes/backup.js";
 import * as llmProxy from "./services/llm-proxy/index.js";
-import * as nomadManager from "./services/nomad-manager.js";
-import * as instanceManager from "./services/app/app-manager.js";
-import * as setupManager from "./services/setup-manager.js";
-import { startTmpCleanupScheduler, initAutoBackup } from "./services/backup-manager.js";
-import { checkUpdate } from "./services/panel-manager.js";
+import * as nomadDriver from "./services/runtime/drivers/nomad.js";
+import * as setupManager from "./services/setup/setup-manager.js";
+import { shutdownTaskRegistry } from "./services/tasks/registry.js";
+import { startTmpCleanupScheduler, stopTmpCleanupScheduler, initAutoBackup, shutdownAutoBackup, } from "./services/backup/backup-manager.js";
+import { checkUpdate, getUpdateStatus } from "./services/system/update-manager.js";
+import { inspectSystemDrift } from "./services/system/system-reconciler.js";
 import { PROXY_IDENTITY_HEADERS } from "./constants.js";
-import { supportsGatewayWebsocket } from "./services/runtime/instance.js";
-const PUBLIC_PATHS = new Set(["/api/auth/status", "/api/auth/init", "/api/auth/login", "/api/setup/status", "/api/apps/validate-sudo-password"]);
+const PUBLIC_PATHS = new Set([
+    "/api/auth/status",
+    "/api/auth/init",
+    "/api/auth/login",
+    "/api/setup/status",
+    // Public by product decision: this only validates a one-shot sudo password
+    // before install/upgrade flows. The actual privileged operation must still
+    // receive the password in its own request or run through a sudo CLI command.
+    "/api/apps/validate-sudo-password",
+]);
 /** Slug charset for /apps/:slug — same as instance ids. */
 const SLUG_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;
 /** Regex for top-level app WebSocket upgrades (AI-FS v1 W2.5 PR-8). */
@@ -57,9 +63,9 @@ function resolveAppSlugUpstream(slug) {
         const providers = capabilityRegistry.listProviders(cap);
         const running = providers.find((p) => p.status === "running");
         if (running) {
-            // Fresh-resolve the host to avoid stale registry entries on macOS/Colima
-            // where the advertised host can drift across network interface changes.
-            const freshHost = getAdvertisedHostForPort(running.hostPort);
+            // Fresh-resolve the host for core's own upstream connection. Do not use
+            // advertised/public host here; that is only for browser-visible URLs.
+            const freshHost = getConnectHostForPort(running.hostPort);
             return { host: freshHost, port: running.hostPort };
         }
     }
@@ -123,6 +129,45 @@ export function buildCapabilityWebSocketHeaders(headers, upstreamOrigin) {
     }
     return upstreamHeaders;
 }
+function matchIntegrationPublicProxy(path, options = {}) {
+    for (const integration of listRegisteredIntegrations()) {
+        const descriptor = integration.publicProxy;
+        if (!descriptor)
+            continue;
+        if (options.authBypass === true && descriptor.authBypass !== true)
+            continue;
+        if (options.websocket === true && descriptor.websocket !== true)
+            continue;
+        descriptor.basePathPattern.lastIndex = 0;
+        const matched = descriptor.basePathPattern.exec(path);
+        if (!matched)
+            continue;
+        return {
+            integration,
+            match: {
+                instanceId: matched[1] ?? "",
+                suffix: matched[2] ?? "",
+            },
+        };
+    }
+    return null;
+}
+function buildPublicProxyWebSocketHeaders(headers, descriptorHeaders) {
+    const upstreamHeaders = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (value === undefined)
+            continue;
+        const lower = key.toLowerCase();
+        if (lower === "host" ||
+            lower === "cookie" ||
+            lower === "authorization" ||
+            PROXY_IDENTITY_HEADERS.has(lower)) {
+            continue;
+        }
+        upstreamHeaders[key] = value;
+    }
+    return { ...upstreamHeaders, ...descriptorHeaders };
+}
 function forwardWebSocketRejection(socket, res) {
     const statusCode = res.statusCode || 502;
     const statusMessage = res.statusMessage || "Bad Gateway";
@@ -144,9 +189,54 @@ export function selectRefererWebSocketCapability(capabilities, refererCapability
         ?? matches.find((capability) => capability.capability === refererCapability)
         ?? null;
 }
+async function convergeInstanceDesiredStateOnBoot() {
+    for (const inst of appService.listInstances()) {
+        const instanceId = typeof inst?.id === "string" ? inst.id : "";
+        if (!instanceId)
+            continue;
+        const desiredState = inst.desiredState;
+        if (desiredState !== "running" && desiredState !== "stopped") {
+            console.warn(`[startup] Skipping ${instanceId}: invalid desiredState '${String(desiredState)}'`);
+            continue;
+        }
+        try {
+            const status = await appService.getInstanceInstallRecordStatus(instanceId);
+            const actualStatus = String(status?.status ?? "unknown");
+            if (desiredState === "running") {
+                if (actualStatus === "running" || actualStatus === "pending" || actualStatus === "installing") {
+                    continue;
+                }
+                if (actualStatus === "unknown") {
+                    console.warn(`[startup] Skipping start convergence for ${instanceId}: runtime status unknown`);
+                    continue;
+                }
+                console.log(`[startup] Starting ${instanceId} from Core desiredState=running (actual=${actualStatus})...`);
+                const result = await appLifecycle.startInstance(instanceId);
+                if (!result.ok) {
+                    console.warn(`[startup] Start convergence failed for ${instanceId}: ${result.error ?? "unknown error"}`);
+                }
+                continue;
+            }
+            if (actualStatus === "running" || actualStatus === "pending") {
+                console.log(`[startup] Stopping ${instanceId} from Core desiredState=stopped (actual=${actualStatus})...`);
+                const result = await appLifecycle.stopInstance(instanceId);
+                if (!result.ok) {
+                    console.warn(`[startup] Stop convergence failed for ${instanceId}: ${result.error ?? "unknown error"}`);
+                }
+            }
+        }
+        catch (error) {
+            console.warn(`[startup] Desired-state convergence skipped for ${instanceId}: ${error?.message ?? error}`);
+        }
+    }
+}
 export async function createServer(options = {}) {
-    const port = options.port ?? 8090;
+    const port = options.port ?? 8091;
     const host = options.host || "0.0.0.0";
+    let startupTimer = null;
+    let delayedSystemDriftTimer = null;
+    let backgroundUpdateInitial = null;
+    let backgroundUpdateInterval = null;
     ensureDirs();
     startTmpCleanupScheduler();
     initAutoBackup().catch((e) => console.error("[auto-backup] Init error:", e.message));
@@ -156,6 +246,19 @@ export async function createServer(options = {}) {
         logger: true,
         bodyLimit: 1048576,
     });
+    app.addHook("onClose", async () => {
+        if (startupTimer)
+            clearTimeout(startupTimer);
+        if (delayedSystemDriftTimer)
+            clearTimeout(delayedSystemDriftTimer);
+        if (backgroundUpdateInitial)
+            clearTimeout(backgroundUpdateInitial);
+        if (backgroundUpdateInterval)
+            clearInterval(backgroundUpdateInterval);
+        shutdownTaskRegistry();
+        stopTmpCleanupScheduler();
+        shutdownAutoBackup();
+    });
     // Allow empty JSON body for POST requests
     app.addContentTypeParser("application/json", { parseAs: "string" }, (_req, body, done) => {
         if (!body || body.length === 0) {
@@ -186,7 +289,7 @@ export async function createServer(options = {}) {
     // any agent container starts and tries to read it via env injection.
     // Lazy-init would only fire on the first request that carries an
     // X-Jishushell-Internal-Token header, which is too late for the
-    // adapter onBeforeStart that mounts the value into the container.
+    // integration onBeforeStart hook that mounts the value into the container.
     try {
         getInternalMcpToken();
     }
@@ -194,7 +297,7 @@ export async function createServer(options = {}) {
         console.warn(`[server] internal MCP token init skipped: ${e?.message ?? e}`);
     }
     // ── Auth middleware for /apps/* (AI-FS v1 W2.5 PR-8) ──────────────────
-    // Top-level reverse proxy for installed apps. Added in AI-FS v1 W2.5 PR-8.
+    // Top-level reverse proxy for instance UI capabilities.
     // Pairs with `/api/instances/:id/provides/:cap/*` which is instance-scoped.
     // This hook is scoped to /apps/* only so it does not double-fire with the
     // existing /api/* hook below.
@@ -219,41 +322,32 @@ export async function createServer(options = {}) {
         const path = request.url.split("?")[0];
         if (!path.startsWith("/api/") || PUBLIC_PATHS.has(path))
             return;
-        // Allow gateway proxy without panel auth (gateway has its own auth),
-        // but verify the instance actually exists to prevent probing.
-        if (/^\/api\/instances\/[^/]+\/gateway(\/|$)/.test(path)) {
-            const id = path.match(/^\/api\/instances\/([^/]+)\/gateway/)?.[1];
-            if (!id || !instanceManager.getInstance(id)) {
+        // Allow integration-owned public proxies without panel auth when the
+        // integration declares its own upstream auth, but verify the instance
+        // actually exists to prevent probing.
+        const publicProxy = matchIntegrationPublicProxy(path, { authBypass: true });
+        if (publicProxy) {
+            const id = publicProxy.match.instanceId;
+            if (!id || !appService.getInstance(id)) {
                 return reply.status(404).send({ detail: "Instance not found" });
             }
             return;
         }
-        // Internal token path — used by:
-        //   (a) MCP shims spawned inside agent containers
-        //       (need BOTH X-Jishushell-Internal-Token + X-Jishushell-Instance)
-        //   (b) Panel app lifecycle scripts (post_start, etc.) calling back into
-        //       /api/internal/* on the same host
-        //       (need ONLY X-Jishushell-Internal-Token; no instance binding —
-        //        apps aren't instances)
-        // Combined with the standard JWT path below; we never require both.
+        // Internal token path — used by MCP/runtime shims spawned inside managed
+        // instances. These callers must present BOTH
+        // X-Jishushell-Internal-Token + X-Jishushell-Instance so Core can bind
+        // the request to a canonical instance. Combined with the standard JWT
+        // path below; we never require both.
         const internalToken = request.headers["x-jishushell-internal-token"];
         if (typeof internalToken === "string" && internalToken.length >= 32) {
             const expected = getInternalMcpToken();
             if (internalToken.length === expected.length &&
                 timingSafeEqual(Buffer.from(internalToken), Buffer.from(expected))) {
                 const instanceId = request.headers["x-jishushell-instance"];
-                if (typeof instanceId === "string" && instanceManager.getInstance(instanceId)) {
+                if (typeof instanceId === "string" && appService.getInstance(instanceId)) {
                     request.internalCallerInstance = instanceId;
                     return;
                 }
-                // Path (b): app-lifecycle / internal-only routes. Allowed without
-                // an instance header. The route is responsible for asserting the
-                // (request as any).internalCallerScope === "panel" tag before
-                // returning sensitive data.
-                if (path.startsWith("/api/internal/")) {
-                    request.internalCallerScope = "panel";
-                    return;
-                }
             }
             return reply.status(401).send({ detail: "Unauthorized" });
         }
@@ -288,29 +382,25 @@ export async function createServer(options = {}) {
         },
     });
     // Register proxy routes before auth middleware (proxy uses its own token auth)
-    await llmProxy.registerProxyRoutes(app);
+    registerProxyRoutes(app);
     // Register routes
-    // authRoutes needs a rebind callback so /api/auth/init can switch from 127.0.0.1 → 0.0.0.0
-    // without calling process.exit(). We define the callback after listen() and patch it in below.
-    let _rebind = null;
-    await app.register(authRoutes, {
-        getRebind: () => _rebind,
-    });
+    await app.register(authRoutes);
     await app.register(instanceRoutes);
     await app.register(systemRoutes);
     await app.register(setupRoutes);
-    await app.register(runtimeCatalogRoutes);
+    await app.register(integrationsRoutes);
     await app.register(appRoutes);
-    await app.register(agentAppRoutes);
+    await app.register(integrationAppRoutes);
+    registerAppModuleRoutes(app);
+    await registerIntegrationOwnedRoutes(app);
     await app.register(llmRoutes);
     await app.register(backupRoutes);
-    await app.register(internalRoutes);
     // Single FilesManager instance shared across /api/files, /webdav, and
     // /api/files/external-mounts so a mutation on the mount list (PUT
     // /external-mounts) is visible to every layer immediately.
-    const panelCfgForFiles = getPanelConfig();
-    const initialExternalMounts = Array.isArray(panelCfgForFiles.external_mounts)
-        ? panelCfgForFiles.external_mounts
+    const coreCfgForFiles = getCoreConfig();
+    const initialExternalMounts = Array.isArray(coreCfgForFiles.external_mounts)
+        ? coreCfgForFiles.external_mounts
         : [];
     const sharedFilesManager = new FilesManager({
         externalMounts: initialExternalMounts,
@@ -331,7 +421,7 @@ export async function createServer(options = {}) {
         await webdavRoutes(scope, { filesManager: sharedFilesManager });
     });
     // ── Top-level /apps/:slug/* reverse proxy (AI-FS v1 W2.5 PR-8) ───────────
-    // Reverse-proxies HTTP requests for installed apps to their capability
+    // Reverse-proxies HTTP requests for instance UI capabilities to their
     // upstream. Auth is handled by the onRequest hook above. The /apps/:slug
     // prefix is NOT stripped — apps like Filebrowser are configured with
     // --baseURL=/apps/filebrowser and expect the full path.
@@ -339,7 +429,7 @@ export async function createServer(options = {}) {
     // Resolution order: `<slug>-ui` → `web-<slug>` (first running entry wins).
     // 503 if no running provider found. 400 if slug is malformed.
     //
-    // Registered BEFORE the SPA static fallback so explicit routes win.
+    // Core owns app capability proxying; the Panel package owns SPA serving.
     const appsProxyHandler = async (req, reply) => {
         const rawSlug = req.params.slug ?? "";
         if (!SLUG_RE.test(rawSlug)) {
@@ -353,7 +443,7 @@ export async function createServer(options = {}) {
         // Pass the full original path unchanged (including /apps/<slug> prefix).
         const rawUrl = req.raw.url ?? "/";
         const targetPath = rawUrl;
-        const hostHeader = `${upstreamHost}:${upstreamPort}`;
+        const hostHeader = `${appService.urlHost(upstreamHost)}:${upstreamPort}`;
         // Build forwarded headers: strip cookie and authorization to avoid
         // leaking panel session credentials to third-party apps.
         const forwardHeaders = {};
@@ -420,98 +510,82 @@ export async function createServer(options = {}) {
     };
     app.all("/apps/:slug", appsProxyHandler);
     app.all("/apps/:slug/*", appsProxyHandler);
-    // Serve frontend static files
-    // Look for frontend dist in multiple locations
-    const resolvedDir = existsSync(__dirname) ? realpathSync(__dirname) : __dirname;
-    const frontendCandidates = [
-        join(resolvedDir, "..", "public"), // npm package: dist/ + public/ siblings
-        join(resolvedDir, "..", "frontend", "dist"), // dev: project root legacy path
-    ];
-    let frontendDir = "";
-    for (const candidate of frontendCandidates) {
-        if (existsSync(join(candidate, "index.html"))) {
-            frontendDir = candidate;
-            break;
-        }
-    }
-    if (frontendDir) {
-        // Serve /assets/ directory
-        const assetsDir = join(frontendDir, "assets");
-        if (existsSync(assetsDir)) {
-            await app.register(fastifyStatic, {
-                root: assetsDir,
-                prefix: "/assets/",
-                decorateReply: false,
-                cacheControl: false,
-                setHeaders: (res) => {
-                    res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
-                },
-            });
-        }
-        // Serve other static files and SPA fallback
-        await app.register(fastifyStatic, {
-            root: frontendDir,
-            prefix: "/",
-            decorateReply: true,
-            wildcard: false,
-            globIgnore: ["assets/**"],
-            cacheControl: false,
-            setHeaders: (res, filePath) => {
-                if (basename(filePath) === "index.html") {
-                    res.setHeader("Cache-Control", "no-store");
-                }
-                else {
-                    res.setHeader("Cache-Control", "public, max-age=0");
-                }
-            },
-        });
-        // SPA fallback: serve index.html for non-API, non-asset routes
-        app.setNotFoundHandler(async (request, reply) => {
-            const path = request.url.split("?")[0];
-            if (path.startsWith("/api/")) {
-                return reply.status(404).send({ detail: "Not found" });
-            }
-            if (path.startsWith("/proxy/")) {
-                return reply.status(404).send({
-                    error: { message: "proxy route not found", type: "server_error" },
-                });
-            }
-            if (path.startsWith("/assets/")) {
-                return reply.status(404).type("text/plain").send("Asset not found");
-            }
-            reply.header("Cache-Control", "no-store");
-            return reply.sendFile("index.html");
-        });
-    }
     // Auto-start Nomad-managed instances on startup
     app.addHook("onReady", async () => {
-        setTimeout(async () => {
+        startupTimer = setTimeout(async () => {
+            startupTimer = null;
             try {
-                ensurePanelConfig();
-                // One-shot: if panel.json only has the legacy `openclaw_image` field
-                // (older release, OpenClaw pre-runtime-catalog), mirror it into
-                // `runtime_catalog.openclaw` so the unified read path sees it.
-                migrateOpenclawCatalogIfNeeded();
+                if (process.env.JISHUSHELL_SKIP_STARTUP_MAINTENANCE === "1") {
+                    console.log("[startup] Maintenance tasks skipped by JISHUSHELL_SKIP_STARTUP_MAINTENANCE");
+                    return;
+                }
+                ensureCoreConfig();
+                removeFlatOpenclawImageIfNeeded();
                 // One-shot: drop runtime_catalog.hermes.shimPath and delete the
                 // orphaned ~/.jishushell/runtimes/hermes/ dir. The Hermes shim is
-                // now baked into the image (PR3c) and the adapter verifies the
+                // now baked into the image (PR3c) and the integration verifies the
                 // official image RepoDigest before launch, so the host shim is dead weight.
                 migrateHermesShimOutIfNeeded();
-                // Stamp the runtime_catalog schema version so panel.json carries a
-                // provenance marker. Warns (but doesn't crash) on detected panel
-                // downgrade where the stored version exceeds what we support.
-                migrateCatalogSchemaIfNeeded();
-                // One-shot: if panel.json still stores a mutable image tag (:latest
-                // or :slim) from an older release, rewrite it to the pinned
-                // :${version} form so Nomad stops re-pulling on each restart.
-                migrateOpenclawImageTagIfNeeded();
-                // Same one-shot for per-adapter migrations (Hermes rewrites
-                // runtime_catalog.hermes.defaultImage from `:latest` to the pinned
-                // :${LABEL org.opencontainers.image.version} form). Runs every
-                // registered adapter's migrateStartup() hook so server.ts never
-                // imports a specific adapter (check-adapter-isolation §32.2.1).
-                runStartupMigrations();
-                const config = getPanelConfig();
+                // Stamp the historical runtime_catalog schema version so core.json
+                // carries a provenance marker. Warns (but doesn't crash) on detected
+                // core downgrade where the stored version exceeds what we support.
+                migrateIntegrationRuntimeSchemaIfNeeded();
+                // Step 13: startup no longer runs implicit instance-schema
+                // migrations. The dedicated `jishushell migrate legacy` command
+                // owns all legacy normalisation; reconcile / doctor only touch
+                // system/runtime state.
+                // Let Integrations normalize only their Core-owned global config. For
+                // example, OpenClaw pins runtime_catalog.openclaw.defaultImage and
+                // Hermes pins runtime_catalog.hermes.defaultImage. This hook
+                // must never migrate instance directories, facts, config, or jobs.
+                if (process.env.JISHUSHELL_SKIP_STARTUP_MIGRATIONS === "1") {
+                    console.log("[startup] Integration Core config normalization skipped by JISHUSHELL_SKIP_STARTUP_MIGRATIONS");
+                }
+                else {
+                    normalizeIntegrationCoreConfigOnStartup();
+                }
+                getUpdateStatus();
+                // Inspect system-level drift (systemd units, Docker images, Nomad
+                // config) against the currently installed code. Startup is an
+                // observation point only: applying host-level fixes, sudo, reload, or
+                // service restarts must happen through explicit Panel/CLI reconcile
+                // actions after user confirmation.
+                if (process.env.JISHUSHELL_SKIP_STARTUP_RECONCILE === "1") {
+                    console.log("[startup] System drift inspection skipped by JISHUSHELL_SKIP_STARTUP_RECONCILE");
+                }
+                else {
+                    try {
+                        const reconcileResult = await inspectSystemDrift();
+                        const updated = reconcileResult.items.filter(i => i.status === "updated");
+                        const errors = reconcileResult.items.filter(i => i.status === "error");
+                        const needsSudo = reconcileResult.items.filter(i => i.requiresSudo && i.status !== "ok" && i.status !== "updated");
+                        if (updated.length > 0) {
+                            console.warn(`[startup] Unexpected system drift inspection update(s): ${updated.map(i => i.component).join(", ")}`);
+                        }
+                        if (errors.length > 0) {
+                            console.warn(`[startup] System drift inspection errors: ${errors.map(i => `${i.component}: ${i.message}`).join("; ")}`);
+                        }
+                        if (needsSudo.length > 0) {
+                            console.warn(`[startup] ${needsSudo.length} item(s) need sudo to fix. Run: ${reconcileResult.command}`);
+                        }
+                        else if (reconcileResult.reloadRequired) {
+                            console.warn(`[startup] System files changed and services should be reloaded. Run: ${reconcileResult.command}`);
+                        }
+                        if (errors.length > 0 || reconcileResult.reloadRequired) {
+                            delayedSystemDriftTimer = setTimeout(() => {
+                                delayedSystemDriftTimer = null;
+                                inspectSystemDrift().catch((e) => {
+                                    console.warn(`[startup] Delayed system reconciliation check skipped: ${e.message}`);
+                                });
+                            }, 15_000);
+                            delayedSystemDriftTimer.unref();
+                        }
+                    }
+                    catch (e) {
+                        console.warn(`[startup] System drift inspection skipped: ${e.message}`);
+                    }
+                }
+                const config = getCoreConfig();
                 if (config.service_manager === "nomad") {
                     const nomadResult = await setupManager.startNomad();
                     if (!nomadResult.ok) {
@@ -519,65 +593,30 @@ export async function createServer(options = {}) {
                     }
                     else {
                         console.log(`[startup] Nomad: ${nomadResult.message}`);
-                    }
-                    // Auto-start stopped instances that were running before jishushell was restarted.
-                    // Running instances are left alone — no forced restart to avoid unnecessary disruption.
-                    try {
-                        for (const inst of instanceManager.listInstances()) {
-                            if (!inst.id)
-                                continue;
-                            const status = await nomadManager.getStatus(inst.id);
-                            if (status.status === "running") {
-                                continue;
-                            }
-                            else if (status.status === "pending" || status.status === "stopped") {
-                                const shouldStart = await nomadManager.shouldAutoStart(inst.id);
-                                if (shouldStart) {
-                                    console.log(`[startup] Auto-starting Nomad instance ${inst.id} (was running before restart)...`);
-                                    await nomadManager.startInstance(inst.id);
-                                }
-                            }
+                        try {
+                            await convergeInstanceDesiredStateOnBoot();
+                            console.log("[startup] Desired-state convergence completed.");
+                        }
+                        catch (e) {
+                            console.error("[startup] Desired-state convergence failed:", e);
                         }
-                        console.log("[startup] Nomad instances started/restarted.");
-                    }
-                    catch (e) {
-                        console.error("[startup] Nomad restart failed:", e);
                     }
-                    // Second migration attempt: the first call above runs before Nomad
-                    // auto-starts instances, so for 0.4.2-beta2 upgrades the image is
-                    // not yet locally present then. After auto-start (which may have
-                    // triggered the one-time pull), retry the pin so panel.json moves
-                    // from :latest → :${version} within the same startup cycle.
-                    try {
-                        migrateOpenclawImageTagIfNeeded();
+                    // Retry Core config normalization after workload convergence because
+                    // a newly available local image may now provide a pinnable version.
+                    // This still must not mutate any instance-owned state.
+                    if (process.env.JISHUSHELL_SKIP_STARTUP_MIGRATIONS === "1") {
+                        console.log("[startup] Integration Core config normalization skipped by JISHUSHELL_SKIP_STARTUP_MIGRATIONS");
                     }
-                    catch (e) {
-                        console.warn("[startup] openclaw image tag migration skipped:", e);
+                    else {
+                        normalizeIntegrationCoreConfigOnStartup();
                     }
-                    // Second adapter-migration sweep — after Nomad auto-start the
-                    // runtime images may finally be locally present so `:latest` →
-                    // pinned digest tag rewrite can now succeed.
-                    runStartupMigrations();
                 }
-                // Rebuild capability registry from app instances. PR 3 sub-step 3f
-                // of the app-interconnect design drops the legacy `portOverride`
-                // arg — each provide now resolves through `resolveProvideEndpoint`
-                // which reads the actual allocated port from runtime metadata, so
-                // multi-provide apps no longer collapse all entries onto the
-                // gateway port. For instances whose underlying job is currently
-                // not running, we still re-register the entries (so the
-                // Connections UI keeps them as greyed candidates) and immediately
-                // mark them stopped via `setProviderStatus` (§5.4 of the design).
+                // Authoritative boot-time capability-registry rebuild. This
+                // populates reverse-proxy and connection routes immediately after
+                // Core restart. After boot, registry updates are event-driven through
+                // lifecycle/API status observations and uninstall cleanup.
                 try {
-                    for (const appData of appManager.listApps()) {
-                        if (!appData.spec.provides?.length)
-                            continue;
-                        appManager.registerCapabilities(appData.manifest.id, appData.spec);
-                        const status = await nomadManager.getStatus(appData.manifest.id);
-                        if (status.status === "stopped") {
-                            capabilityRegistry.setProviderStatus(appData.manifest.id, "stopped");
-                        }
-                    }
+                    await appService.refreshCapabilityRegistry({ force: true });
                 }
                 catch (e) {
                     console.error("[startup] Capability registry rebuild failed:", e);
@@ -589,33 +628,15 @@ export async function createServer(options = {}) {
         }, 0);
     });
     await app.listen({ port, host });
-    // Assign the rebind implementation now that the server is listening.
-    // Called by /api/auth/init to switch from 127.0.0.1 → 0.0.0.0 in-process.
-    _rebind = async (newHost) => {
-        if (host === newHost)
-            return;
-        const addr = app.server.address();
-        const boundPort = addr && typeof addr === "object" ? addr.port : port;
-        await new Promise((resolve, reject) => {
-            app.server.close((err) => { if (err)
-                reject(err);
-            else
-                resolve(); });
-        });
-        await new Promise((resolve, reject) => {
-            app.server.listen(boundPort, newHost, () => {
-                console.log(`[server] Rebound to http://${newHost}:${boundPort}`);
-                resolve();
-            });
-            app.server.once("error", reject);
-        });
-    };
+    const address = app.server.address();
+    const actualPort = typeof address === "object" && address !== null
+        ? address.port
+        : port;
     // Track active WebSocket proxy sockets for graceful shutdown
     const activeWsSockets = new Set();
     // Handle WebSocket upgrades directly on the HTTP server, bypassing Fastify's
     // request lifecycle. Fastify's internal headersTimeout (73s) kills hijacked
     // sockets, so we intercept upgrades before Fastify sees them.
-    const GATEWAY_WS_RE = /^\/api\/instances\/([a-z0-9][a-z0-9-]{0,62})\/gateway(?:\/(.*))?$/;
     const CAPABILITY_WS_RE = /^\/api\/instances\/([a-z0-9][a-z0-9-]{0,62})\/provides\/([^/?]+)(?:\/(.*))?$/;
     // Match Referer pointing at a capability proxy page (used to resolve
     // root-level WS upgrades initiated by embedded pages like Browserless debugger
@@ -624,12 +645,12 @@ export async function createServer(options = {}) {
     app.server.on("upgrade", async (req, socket, head) => {
         const url = req.url || "";
         const path = url.split("?")[0];
-        const gatewayMatch = path.match(GATEWAY_WS_RE);
+        const publicProxyMatch = matchIntegrationPublicProxy(path, { websocket: true });
         const capabilityMatch = path.match(CAPABILITY_WS_RE);
         // ── /apps/:slug/* WebSocket upgrade (AI-FS v1 W2.5 PR-8) ──────────────
-        // Proxy WS upgrades for top-level installed apps. Same auth gate as HTTP.
+        // Proxy WS upgrades for top-level instance UI capabilities. Same auth gate as HTTP.
         const appSlugWsMatch = path.match(APP_SLUG_WS_RE);
-        if (appSlugWsMatch && !gatewayMatch && !capabilityMatch) {
+        if (appSlugWsMatch && !publicProxyMatch && !capabilityMatch) {
             const slug = appSlugWsMatch[1];
             // Auth gate: same JWT cookie/bearer check as the HTTP handler above.
             if (!hasValidPanelUpgradeToken(req)) {
@@ -644,7 +665,7 @@ export async function createServer(options = {}) {
                 return;
             }
             const { host: upstreamHost, port: upstreamPort } = upstream;
-            const hostHeader = `${upstreamHost}:${upstreamPort}`;
+            const hostHeader = `${appService.urlHost(upstreamHost)}:${upstreamPort}`;
             const upstreamOrigin = `http://${hostHeader}`;
             const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
             const targetPath = `${path}${qs}`;
@@ -754,7 +775,7 @@ export async function createServer(options = {}) {
         // resolve the target instance via the Referer header pointing at the
         // capability proxy page that served the embedded UI.
         let refererCapabilityMatch = null;
-        if (!gatewayMatch && !capabilityMatch) {
+        if (!publicProxyMatch && !capabilityMatch) {
             const referer = req.headers.referer || "";
             try {
                 const refUrl = new URL(referer, "http://localhost");
@@ -765,8 +786,8 @@ export async function createServer(options = {}) {
             }
             catch { /* ignore malformed referer */ }
         }
-        if (!gatewayMatch && !capabilityMatch && !refererCapabilityMatch) {
-            // Not a gateway WebSocket — let it drop (Fastify doesn't handle WS natively)
+        if (!publicProxyMatch && !capabilityMatch && !refererCapabilityMatch) {
+            // Not a handled WebSocket — let it drop (Fastify doesn't handle WS natively)
             socket.destroy();
             return;
         }
@@ -806,17 +827,17 @@ export async function createServer(options = {}) {
         // instance that serves the request path (e.g. path "/" with http protocol).
         if (refererCapabilityMatch) {
             const id = refererCapabilityMatch.instanceId;
-            const appData = instanceManager.getApp(id);
+            const appData = appService.getInstanceInstallRecord(id);
             if (!appData) {
                 socket.destroy();
                 return;
             }
-            const capabilities = instanceManager.getProvidedCapabilitiesForApp(id);
+            const capabilities = appService.getProvidedCapabilitiesForApp(id);
             // Find a capability whose path prefix matches the WS request path.
             // Prefer capabilities with path "/" (root API) that aren't the debugger UI itself.
             const wsPath = path || "/";
             const capability = selectRefererWebSocketCapability(capabilities, refererCapabilityMatch.capability, wsPath);
-            if (!capability || typeof capability.port !== "number" || capability.port < 1) {
+            if (!capability) {
                 try {
                     socket.write("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
                 }
@@ -826,8 +847,29 @@ export async function createServer(options = {}) {
             }
             const protocol = String(capability.protocol || "http").toLowerCase();
             const upstreamRequest = protocol === "https" || protocol === "wss" ? httpsRequest : httpRequest;
-            const targetHost = await instanceManager.getHostForAppPort(id, capability.port);
-            const hostHeader = `${instanceManager.urlHost(targetHost)}:${capability.port}`;
+            // Use the runtime-resolved host port: Nomad's dynamic port allocator
+            // may map the container's declared port (e.g. 3000) onto a random host
+            // port (e.g. 18789) when the static port is taken at start-time. The
+            // HTTP capability proxy already does this; the WS proxy must mirror it
+            // or every WS upgrade for reallocated apps lands on a dead host port.
+            let runtimePort = null;
+            try {
+                runtimePort = appService.resolveRuntimeCapabilityPort(id, capability.capability);
+            }
+            catch (error) {
+                if (!appService.isCanonicalRuntimePortRequiredError(error))
+                    throw error;
+                socket.write("HTTP/1.1 409 Conflict\r\nConnection: close\r\n\r\n");
+                socket.destroy();
+                return;
+            }
+            if (typeof runtimePort !== "number" || runtimePort < 1) {
+                socket.write("HTTP/1.1 409 Conflict\r\nConnection: close\r\n\r\n");
+                socket.destroy();
+                return;
+            }
+            const targetHost = await appService.getHostForAppPort(id, runtimePort);
+            const hostHeader = `${appService.urlHost(targetHost)}:${runtimePort}`;
             const upstreamOrigin = `${protocol === "https" || protocol === "wss" ? "https" : "http"}://${hostHeader}`;
             const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
             const targetPath = `${joinCapabilityUpstreamPath(capability.path, path.replace(/^\/+/, ""))}${qs}`;
@@ -839,7 +881,7 @@ export async function createServer(options = {}) {
             try {
                 proxyReq = upstreamRequest({
                     hostname: targetHost,
-                    port: capability.port,
+                    port: runtimePort,
                     path: targetPath,
                     method: "GET",
                     timeout: 10_000,
@@ -933,12 +975,12 @@ export async function createServer(options = {}) {
         if (capabilityMatch) {
             const id = capabilityMatch[1];
             const capabilityName = decodeURIComponent(capabilityMatch[2] || "");
-            const appData = instanceManager.getApp(id);
+            const appData = appService.getInstanceInstallRecord(id);
             if (!appData) {
                 socket.destroy();
                 return;
             }
-            const capability = instanceManager.getProvidedCapabilitiesForApp(id).find((entry) => entry.capability === capabilityName);
+            const capability = appService.getProvidedCapabilitiesForApp(id).find((entry) => entry.capability === capabilityName);
             if (!capability || capability.visibility === "internal") {
                 try {
                     socket.write("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
@@ -947,18 +989,26 @@ export async function createServer(options = {}) {
                 socket.destroy();
                 return;
             }
-            if (typeof capability.port !== "number" || capability.port < 1) {
-                try {
-                    socket.write("HTTP/1.1 500 Internal Server Error\r\nConnection: close\r\n\r\n");
-                }
-                catch { }
+            const protocol = String(capability.protocol || "http").toLowerCase();
+            const upstreamRequest = protocol === "https" || protocol === "wss" ? httpsRequest : httpRequest;
+            let runtimePort = null;
+            try {
+                runtimePort = appService.resolveRuntimeCapabilityPort(id, capabilityName);
+            }
+            catch (error) {
+                if (!appService.isCanonicalRuntimePortRequiredError(error))
+                    throw error;
+                socket.write("HTTP/1.1 409 Conflict\r\nConnection: close\r\n\r\n");
                 socket.destroy();
                 return;
             }
-            const protocol = String(capability.protocol || "http").toLowerCase();
-            const upstreamRequest = protocol === "https" || protocol === "wss" ? httpsRequest : httpRequest;
-            const targetHost = await instanceManager.getHostForAppPort(id, capability.port);
-            const hostHeader = `${instanceManager.urlHost(targetHost)}:${capability.port}`;
+            if (typeof runtimePort !== "number" || runtimePort < 1) {
+                socket.write("HTTP/1.1 409 Conflict\r\nConnection: close\r\n\r\n");
+                socket.destroy();
+                return;
+            }
+            const targetHost = await appService.getHostForAppPort(id, runtimePort);
+            const hostHeader = `${appService.urlHost(targetHost)}:${runtimePort}`;
             const upstreamOrigin = `${protocol === "https" || protocol === "wss" ? "https" : "http"}://${hostHeader}`;
             const suffix = capabilityMatch[3] || "";
             const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
@@ -971,7 +1021,7 @@ export async function createServer(options = {}) {
             try {
                 proxyReq = upstreamRequest({
                     hostname: targetHost,
-                    port: capability.port,
+                    port: runtimePort,
                     path: targetPath,
                     method: "GET",
                     timeout: 10_000,
@@ -1064,67 +1114,47 @@ export async function createServer(options = {}) {
             proxyReq.end();
             return;
         }
-        const match = gatewayMatch;
-        const id = match[1];
-        const inst = instanceManager.getInstance(id);
+        const publicProxy = publicProxyMatch;
+        const id = publicProxy.match.instanceId;
+        const inst = appService.getInstance(id);
         if (!inst) {
             socket.destroy();
             return;
         }
-        if (!(await supportsGatewayWebsocket(id, inst))) {
-            try {
-                socket.write("HTTP/1.1 501 Not Implemented\r\nConnection: close\r\n\r\n");
+        const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
+        const descriptor = publicProxy.integration.publicProxy;
+        let target;
+        try {
+            target = await descriptor.resolveTarget({ match: publicProxy.match, query: qs });
+        }
+        catch (error) {
+            if (appService.isCanonicalRuntimePortRequiredError(error)) {
+                socket.write("HTTP/1.1 409 Conflict\r\nConnection: close\r\n\r\n");
+                socket.destroy();
+                return;
             }
-            catch { }
-            socket.destroy();
-            return;
+            throw error;
         }
-        const gwPort = instanceManager.getGatewayPort(id);
-        const gwHost = await instanceManager.getGatewayHost(id);
         // Bracket IPv6 literals for Host-header use. Node's http.request accepts
         // a bare `::1` in `hostname`, but the `host` header field is a URL-style
         // `<host>:<port>` where v6 must be bracketed.
-        const hostHeader = `${instanceManager.urlHost(gwHost)}:${gwPort}`;
-        const suffix = match[2] || "";
-        const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
-        const targetPath = `/${suffix}${qs}`;
-        const upstreamHeaders = {};
-        for (const [key, value] of Object.entries(req.headers)) {
-            if (value === undefined)
-                continue;
-            const lower = key.toLowerCase();
-            if (lower === "host" ||
-                PROXY_IDENTITY_HEADERS.has(lower) ||
-                // Strip panel auth credentials — do not leak to downstream OpenClaw gateway
-                lower === "cookie" ||
-                lower === "authorization")
-                continue;
-            upstreamHeaders[key] = value;
-        }
-        try {
-            const cfg = getNativeStoredConfig(id);
-            const token = cfg?.gateway?.auth?.token;
-            if (typeof token === "string" && token.trim()) {
-                upstreamHeaders["authorization"] = `Bearer ${token.trim()}`;
-            }
-        }
-        catch {
-            // Best effort: if the config is unavailable, OpenClaw will reject the
-            // upgrade with its normal auth error.
-        }
-        // Forward the browser's Origin unchanged. The panel auto-adds it to
-        // `gateway.controlUi.allowedOrigins` via ensureControlUiAllowedOrigin
-        // + restart; rewriting to the upstream host (as cli 94163bc did)
-        // breaks that allowlist match.
+        const hostHeader = `${appService.urlHost(target.host)}:${target.port}`;
+        const targetPath = target.path;
+        const descriptorHeaders = descriptor.buildHeaders?.({
+            match: publicProxy.match,
+            incomingHeaders: req.headers,
+        }) ?? {};
+        const upstreamHeaders = buildPublicProxyWebSocketHeaders(req.headers, descriptorHeaders);
+        const upstreamRequest = target.protocol === "https" ? httpsRequest : httpRequest;
         // Prevent any HTTP-level timeouts from killing this long-lived connection
         socket.setTimeout?.(0);
         socket.setNoDelay?.(true);
         socket.setKeepAlive?.(true, 30000);
         let proxyReq;
         try {
-            proxyReq = httpRequest({
-                hostname: gwHost,
-                port: gwPort,
+            proxyReq = upstreamRequest({
+                hostname: target.host,
+                port: target.port,
                 path: targetPath,
                 method: "GET",
                 timeout: 10000, // 10s timeout for upstream upgrade handshake
@@ -1166,7 +1196,7 @@ export async function createServer(options = {}) {
             if (proxyHead.length > 0)
                 socket.write(proxyHead);
             // Bidirectional pipe: forward all WebSocket frames without interception.
-            // OpenClaw manages its own upgrades inside the container.
+            // The upstream integration manages its own WebSocket protocol.
             proxySocket.pipe(socket);
             socket.pipe(proxySocket);
             proxySocket.resume();
@@ -1219,24 +1249,25 @@ export async function createServer(options = {}) {
         });
         proxyReq.end();
     });
-    llmProxy.setProxyPort(port);
-    setupManager.setServerPort(port);
-    nomadManager.setPanelPort(port);
-    console.log(`JishuShell listening on http://${host}:${port}`);
-    // Background update check — runs the update probe (which piggybacks telemetry
-    // heartbeat + activation) so headless deployments report without the frontend.
-    // Safe by design: checkUpdate swallows all errors, has a 30s in-memory cache,
-    // and heartbeat/activation dedupe by UTC date / persisted flag.
+    llmProxy.setCorePort(actualPort);
+    setupManager.setServerPort(actualPort);
+    nomadDriver.setCorePort(actualPort);
+    console.log(`JishuShell listening on http://${host}:${actualPort}`);
+    // Background update check — runs the update probe (which probes the npm registry
+    // for new versions) so headless deployments can detect available updates.
+    // Safe by design: checkUpdate swallows all errors and has a 30s in-memory cache.
     const bgUpdateCheck = () => { checkUpdate().catch(() => { }); };
-    const bgInitial = setTimeout(bgUpdateCheck, 30_000);
-    const bgInterval = setInterval(bgUpdateCheck, 4 * 60 * 60 * 1000);
-    bgInitial.unref();
-    bgInterval.unref();
+    backgroundUpdateInitial = setTimeout(bgUpdateCheck, 30_000);
+    backgroundUpdateInterval = setInterval(bgUpdateCheck, 4 * 60 * 60 * 1000);
+    backgroundUpdateInitial.unref();
+    backgroundUpdateInterval.unref();
     // Graceful shutdown — let in-flight requests finish before exiting
     const shutdown = async () => {
         console.log("[server] Shutting down gracefully...");
-        clearTimeout(bgInitial);
-        clearInterval(bgInterval);
+        if (backgroundUpdateInitial)
+            clearTimeout(backgroundUpdateInitial);
+        if (backgroundUpdateInterval)
+            clearInterval(backgroundUpdateInterval);
         llmProxy.flushUsage();
         // Destroy all active WebSocket proxy connections
         for (const s of activeWsSockets) {