jishushell 0.5.22 → 0.6.18

package/scripts/build-local.sh

@@ -2,7 +2,7 @@
 # scripts/build-local.sh — Build Docker images locally for development/testing.
 # Usage:
 #   ./scripts/build-local.sh openclaw           # Build OpenClaw runtime image
-#   ./scripts/build-local.sh hermes             # Build Hermes Agent + Open WebUI image
+#   ./scripts/build-local.sh hermes             # Build Hermes runtime image
 #   ./scripts/build-local.sh all                # Build all images
 #   PLATFORM=linux/arm64 ./scripts/build-local.sh openclaw  # Build for specific platform
 set -euo pipefail
@@ -24,18 +24,17 @@ build_openclaw() {
 }
 
 build_hermes() {
-  local hermes_ver="${HERMES_VERSION:-latest}"
-  local webui_ver="${OPEN_WEBUI_VERSION:-latest}"
-  echo "==> Building Hermes Agent + Open WebUI image (hermes=${hermes_ver}, webui=${webui_ver}, platform=${PLATFORM})"
+  local hermes_ref="${HERMES_REF:-main}"
+  local tag="${HERMES_TAG:-local}"
+  echo "==> Building Hermes runtime image (ref=${hermes_ref}, tag=${tag}, platform=${PLATFORM})"
   docker build \
-    -f Dockerfile.hermes-agent \
-    --build-arg "HERMES_VERSION=${hermes_ver}" \
-    --build-arg "OPEN_WEBUI_VERSION=${webui_ver}" \
+    -f Dockerfile.hermes-slim \
+    --build-arg "HERMES_REF=${hermes_ref}" \
     --platform "${PLATFORM}" \
-    -t "jishushell-hermes:${hermes_ver}" \
+    -t "jishushell-hermes:${tag}" \
     -t "jishushell-hermes:latest" \
     .
-  echo "==> Done: jishushell-hermes:${hermes_ver}"
+  echo "==> Done: jishushell-hermes:${tag}"
 }
 
 case "${1:-all}" in
@@ -47,8 +46,8 @@ case "${1:-all}" in
     echo "Environment variables:"
     echo "  PLATFORM              Target platform (default: auto-detect)"
     echo "  OPENCLAW_VERSION      OpenClaw version (default: latest)"
-    echo "  HERMES_VERSION        Hermes Agent version (default: latest)"
-    echo "  OPEN_WEBUI_VERSION    Open WebUI version (default: latest)"
+    echo "  HERMES_REF            Hermes git ref (default: main)"
+    echo "  HERMES_TAG            Local image tag (default: local)"
     exit 1
     ;;
 esac

package/scripts/check-app-path-boundaries.mjs

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+/**
+ * Enforce the canonical instance path boundary.
+ *
+ * Normal service code must resolve instance directories through
+ * src/services/app-common/paths.ts. Migration and repair code are excluded
+ * because they intentionally inspect historical or partially broken layouts.
+ */
+
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { relative, resolve, sep } from "node:path";
+
+const REPO_ROOT = resolve(import.meta.dirname ?? ".", "..");
+const SERVICES_ROOT = resolve(REPO_ROOT, "src/services");
+const PATHS_MODULE = "src/services/app-common/paths.ts";
+
+const EXCLUDED_SEGMENTS = new Set(["legacy-migrator", "repair"]);
+const ALLOWED_DIR_RESOLVERS = new Set([
+  "resolveAppDir",
+  "resolveInstalledAppDir",
+]);
+
+const PATH_JOIN_PATTERN = /join\s*\(\s*APPS_DIR\s*,\s*([A-Za-z_$][\w$]*)\s*\)/g;
+const CONFIG_INSTANCE_DIR_PATTERN = /\bgetInstanceDir\s*\(\s*(?:instanceId|id)\s*\)/g;
+const DIR_RESOLVER_PATTERNS = [
+  /\b(?:export\s+)?function\s+([A-Za-z_$][\w$]*(?:AppDir|InstanceDir))\s*\(\s*(?:instanceId|id)\b/g,
+  /\b(?:export\s+)?const\s+([A-Za-z_$][\w$]*(?:AppDir|InstanceDir))\s*=\s*(?:async\s*)?\(?\s*(?:instanceId|id)\b/g,
+];
+
+function isSourceFile(path) {
+  return path.endsWith(".ts") && !path.endsWith(".d.ts");
+}
+
+function isExcluded(path) {
+  const rel = relative(SERVICES_ROOT, path);
+  if (rel.startsWith("..")) return true;
+  return rel.split(sep).some((segment) => EXCLUDED_SEGMENTS.has(segment));
+}
+
+function* walk(dir) {
+  for (const entry of readdirSync(dir)) {
+    const full = resolve(dir, entry);
+    const stat = statSync(full);
+    if (stat.isDirectory()) {
+      yield* walk(full);
+    } else if (stat.isFile() && isSourceFile(full) && !isExcluded(full)) {
+      yield full;
+    }
+  }
+}
+
+function lineForIndex(content, index) {
+  return content.slice(0, index).split("\n").length;
+}
+
+function isCommentLine(content, index) {
+  const lineStart = content.lastIndexOf("\n", index) + 1;
+  const lineEnd = content.indexOf("\n", index);
+  const line = content.slice(lineStart, lineEnd === -1 ? content.length : lineEnd).trimStart();
+  return line.startsWith("//") || line.startsWith("*") || line.startsWith("/*");
+}
+
+const violations = [];
+
+for (const abs of walk(SERVICES_ROOT)) {
+  const rel = relative(REPO_ROOT, abs).split(sep).join("/");
+  const content = readFileSync(abs, "utf-8");
+  const isPathsModule = rel === PATHS_MODULE;
+
+  if (!isPathsModule) {
+    let match;
+    const pathJoinPattern = new RegExp(PATH_JOIN_PATTERN.source, "g");
+    while ((match = pathJoinPattern.exec(content)) !== null) {
+      if (isCommentLine(content, match.index)) continue;
+      violations.push({
+        file: rel,
+        line: lineForIndex(content, match.index),
+        rule: "instance-path-join",
+        text: match[0],
+      });
+    }
+
+    const configInstanceDirPattern = new RegExp(CONFIG_INSTANCE_DIR_PATTERN.source, "g");
+    while ((match = configInstanceDirPattern.exec(content)) !== null) {
+      if (isCommentLine(content, match.index)) continue;
+      violations.push({
+        file: rel,
+        line: lineForIndex(content, match.index),
+        rule: "config-instance-dir",
+        text: match[0],
+      });
+    }
+  }
+
+  for (const pattern of DIR_RESOLVER_PATTERNS) {
+    let match;
+    const dirResolverPattern = new RegExp(pattern.source, "g");
+    while ((match = dirResolverPattern.exec(content)) !== null) {
+      if (isCommentLine(content, match.index)) continue;
+      const name = match[1];
+      if (isPathsModule && name === "resolveAppDir") continue;
+      if (ALLOWED_DIR_RESOLVERS.has(name)) continue;
+      violations.push({
+        file: rel,
+        line: lineForIndex(content, match.index),
+        rule: "duplicate-dir-resolver",
+        text: name,
+      });
+    }
+  }
+}
+
+if (violations.length > 0) {
+  console.error(`check-app-path-boundaries FAILED: ${violations.length} violation(s)\n`);
+  for (const violation of violations) {
+    console.error(`  ${violation.file}:${violation.line} [${violation.rule}] ${violation.text}`);
+  }
+  process.exit(1);
+}
+
+console.log("check-app-path-boundaries OK");

package/scripts/check-app-spec.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 /**
- * Validates `apps/*.yaml` against the Provider Authoring Contract
- * (docs/app-interconnect-design.md §13.2.3).
+ * Validates `apps/*.yaml` against the provider authoring contract.
  *
  * Three provide classes:
  *   A. Bindable category   — capability has CAPABILITY_CATEGORIES prefix
@@ -31,27 +30,35 @@ const APPS_DIR = process.env.APPS_DIR_OVERRIDE ?? join(__dirname, "..", "apps");
 
 // ── Allowlists (kept here so check-app-spec stays mechanically driven) ──
 
-// Keep in sync with CAPABILITY_CATEGORIES in
-// src/services/connection-resolver.ts. `files` (W1-W2) and `knowledge`
-// (W2, AnythingLLM) are full categories with adapter hooks and slot UX.
+// Keep in sync with src/services/capabilities/contract.ts. These values are
+// deliberately small and closed: provider app ids stay free-form, but
+// matching protocol must be explicit and statically checkable.
 const CAPABILITY_CATEGORIES = new Set([
-  "llm", "search", "browser", "mcp", "files", "knowledge",
+  "llm", "search", "browser", "mcp", "files", "knowledge", "ui", "terminal",
 ]);
 
+const INTERFACES_BY_KIND = {
+  llm: new Set(["openai-compatible"]),
+  search: new Set(["searxng-json"]),
+  browser: new Set(["cdp-ws"]),
+  mcp: new Set(["mcp-http", "mcp-sse", "mcp-stdio"]),
+  files: new Set(["web-file-manager"]),
+  knowledge: new Set(["kb-search"]),
+  ui: new Set(["web-ui"]),
+  terminal: new Set(["terminal"]),
+};
+
 const LEGACY_BINDABLE_EXACT_ALLOWLIST = new Set([
   "ollama-api",
   "browserless-api",
 ]);
 
 const UI_LEGACY_ALLOWLIST = new Set([
-  "openwebui-web",
   "hollama-web",
-  "playwright-ui",
   "openclaw-dashboard",
   "ollama-terminal",
   "web-ui",
   "web-searxng",
-  "web-openwebui",
   "web-hermes",
   "browserless-debugger",
   "browserless-docs",
@@ -68,18 +75,116 @@ const PROTOCOL_WHITELIST = {
   // AnythingLLM exposes an OpenAI-compatible HTTP API for kb_search; baseUrl
   // is always http(s) regardless of LAN vs container host topology.
   knowledge: new Set(["http", "https"]),
+  ui: new Set(["http", "https"]),
+  terminal: new Set(["tcp"]),
   default: new Set(["http", "https", "ws", "wss", "tcp"]),
 };
 
 // ── Helpers ──
 
 function categoryOf(capability) {
+  if (CAPABILITY_CATEGORIES.has(capability)) return capability;
   const dashIdx = capability.indexOf("-");
   if (dashIdx <= 0) return null;
   const head = capability.slice(0, dashIdx);
   return CAPABILITY_CATEGORIES.has(head) ? head : null;
 }
 
+function inferLegacyInterface(kind, capability, protocol) {
+  switch (kind) {
+    case "llm": return "openai-compatible";
+    case "search": return capability === "search" || capability === "search-searxng" ? "searxng-json" : null;
+    case "browser": return "cdp-ws";
+    case "files": return "web-file-manager";
+    case "knowledge": return "kb-search";
+    case "ui": return "web-ui";
+    case "terminal": return "terminal";
+    case "mcp": {
+      const normalized = typeof protocol === "string" ? protocol.trim().toLowerCase() : "";
+      if (normalized === "sse") return "mcp-sse";
+      if (normalized === "stdio") return "mcp-stdio";
+      return "mcp-http";
+    }
+    default: return null;
+  }
+}
+
+function capabilityContract(obj) {
+  const capability = typeof obj?.capability === "string" ? obj.capability : "";
+  const explicitKind = typeof obj?.kind === "string" && CAPABILITY_CATEGORIES.has(obj.kind) ? obj.kind : null;
+  const kind = explicitKind ?? categoryOf(capability);
+  if (!kind) return null;
+  const iface = typeof obj?.interface === "string" && INTERFACES_BY_KIND[kind]?.has(obj.interface)
+    ? obj.interface
+    : inferLegacyInterface(kind, capability, obj?.protocol);
+  return iface ? { kind, interface: iface } : null;
+}
+
+function isContractRequire(req) {
+  // Keep mirrored with src/services/capabilities/contract.ts. The checker runs
+  // as a standalone Node script, so this local copy must preserve the same
+  // domain rule: category tokens (`llm`, `search`) use kind/interface
+  // matching; concrete provider capabilities (`llm-ollama`) remain exact.
+  return typeof req?.capability === "string" && CAPABILITY_CATEGORIES.has(req.capability);
+}
+
+function capabilityMatchesRequire(req, provider) {
+  if (!isContractRequire(req)) {
+    return provider?.capability === req?.capability;
+  }
+  const reqContract = capabilityContract(req);
+  const providerContract = capabilityContract(provider);
+  if (reqContract && providerContract) {
+    return providerContract.kind === reqContract.kind && providerContract.interface === reqContract.interface;
+  }
+  return provider?.capability === req?.capability;
+}
+
+function validateStructuredContract(file, label, item) {
+  const hasKind = item.kind !== undefined;
+  const hasInterface = item.interface !== undefined;
+  if (!hasKind && !hasInterface) return;
+  if (typeof item.kind !== "string" || !CAPABILITY_CATEGORIES.has(item.kind)) {
+    err(file, `${label} kind must be one of ${[...CAPABILITY_CATEGORIES].join("|")}`);
+    return;
+  }
+  if (typeof item.interface !== "string" || !INTERFACES_BY_KIND[item.kind]?.has(item.interface)) {
+    err(file, `${label} interface '${item.interface}' is not valid for kind '${item.kind}'`);
+  }
+}
+
+function validateEndpoint(file, spec, cap, provide) {
+  if (provide.endpoint === undefined) return;
+  if (typeof provide.endpoint !== "object" || provide.endpoint === null || Array.isArray(provide.endpoint)) {
+    err(file, `provide '${cap}' endpoint must be an object`);
+    return;
+  }
+  if (typeof provide.endpoint.portName !== "string" || !provide.endpoint.portName) {
+    err(file, `provide '${cap}' endpoint.portName is required when endpoint is declared`);
+  }
+  if ("hostPort" in provide.endpoint || "host" in provide.endpoint) {
+    err(file, `provide '${cap}' endpoint must not declare host/hostPort; use runtime.ports[].hostPort`);
+  }
+  for (const key of Object.keys(provide.endpoint)) {
+    if (key !== "portName") {
+      err(file, `provide '${cap}' endpoint.${key} is not supported; keep protocol/path as top-level provide fields`);
+    }
+  }
+  if (typeof provide.task !== "string" || !provide.task) {
+    err(file, `provide '${cap}' endpoint.portName requires provide.task so it can be checked against task ports[]`);
+    return;
+  }
+  const task = findTask(spec, provide.task);
+  if (!task) return;
+  if (
+    typeof provide.endpoint.portName === "string"
+    && provide.endpoint.portName
+    && !findNamedPortInTask(task, provide.endpoint.portName)
+  ) {
+    err(file, `provide '${cap}' endpoint.portName '${provide.endpoint.portName}' not in task '${provide.task}' ports[]`);
+  }
+}
+
 function isUILegacy(capability) {
   if (UI_LEGACY_ALLOWLIST.has(capability)) return true;
   if (capability.startsWith("web-")) return true;
@@ -172,6 +277,10 @@ function findPortInTask(task, providePort) {
   return (task?.ports ?? []).find((p) => hostPortOf(p) === providePort);
 }
 
+function findNamedPortInTask(task, portName) {
+  return (task?.ports ?? []).find((p) => p?.name === portName);
+}
+
 // ── Main ──
 
 const errors = [];
@@ -219,27 +328,16 @@ const allowedRequiresExact = new Set([
 ]);
 
 // Index every provide capability across the repo for orphan-require check.
-const providersByCapability = new Map();
+const allProviders = [];
 for (const { spec } of specs) {
   for (const provide of spec.provides ?? []) {
     if (typeof provide?.capability !== "string") continue;
-    if (!providersByCapability.has(provide.capability)) {
-      providersByCapability.set(provide.capability, []);
-    }
-    providersByCapability.get(provide.capability).push({ spec });
+    allProviders.push(provide);
   }
 }
 
 function hasProviderForRequire(req) {
-  // A path: prefix match against any provide name starting with `${req}-`.
-  if (CAPABILITY_CATEGORIES.has(req)) {
-    for (const cap of providersByCapability.keys()) {
-      if (cap.startsWith(req + "-")) return true;
-    }
-    return false;
-  }
-  // B path: exact match.
-  return providersByCapability.has(req);
+  return allProviders.some((provider) => capabilityMatchesRequire(req, provider));
 }
 
 // Second pass: validate each spec.
@@ -254,6 +352,7 @@ for (const { file, spec } of specs) {
     }
     const cap = provide.capability;
     const cat = categoryOf(cap);
+    validateStructuredContract(file, `provide '${cap}'`, provide);
     const isB =
       !cat &&
       (LEGACY_BINDABLE_EXACT_ALLOWLIST.has(cap) || exactRequiresInRepo.has(cap)) &&
@@ -267,6 +366,7 @@ for (const { file, spec } of specs) {
       }
       continue;
     }
+    validateEndpoint(file, spec, cap, provide);
 
     if (cat) {
       // Class A
@@ -321,6 +421,7 @@ for (const { file, spec } of specs) {
       if (provide.auth !== undefined) {
         err(file, `provide '${cap}' auth is not allowed on UI-only or url-only provides`);
       }
+
       if (typeof provide.port === "number") {
         if (typeof provide.task === "string" && provide.task) {
           const task = findTask(spec, provide.task);
@@ -338,7 +439,7 @@ for (const { file, spec } of specs) {
     }
 
     // ── §17 (PR 8): tool_schema validation — applies to any bindable
-    //    capability that an LLM-binding adapter may turn into an MCP
+    //    capability that an LLM integration hook may turn into an MCP
     //    server entry (i.e. category A search-/mcp-, plus any future
     //    bindable cap). Warn-only this release; promoted to err in v0.5.
     if (provide.tool_schema !== undefined) {
@@ -388,6 +489,7 @@ for (const { file, spec } of specs) {
     }
     const isCategory = CAPABILITY_CATEGORIES.has(req.capability);
     const isExact = allowedRequiresExact.has(req.capability);
+    validateStructuredContract(file, `require '${req.capability}'`, req);
     if (!isCategory && !isExact) {
       err(
         file,
@@ -422,7 +524,7 @@ for (const { file, spec } of specs) {
     }
 
     // Orphan-require check: at least one provider in the repo must satisfy.
-    if (!hasProviderForRequire(req.capability)) {
+    if (!hasProviderForRequire(req)) {
       const isRequired = req.required !== false; // default true
       if (isRequired) {
         err(

package/scripts/check-colima-launchd.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Static validator for the macOS Colima/Nomad/Panel launchd artifacts
+ * Static validator for the macOS Colima/Nomad/Core launchd artifacts
  * produced by install/jishu-install.sh and the doctor self-heal checks.
  * Mirrors the text-assertion style of scripts/check-app-spec.mjs — runs
  * in CI without a Mac. Exits non-zero on any failed assertion.
@@ -42,11 +42,11 @@ must(/SuccessfulExit<\/key>\s*<false\/>/.test(installer),
 must(/<key>ThrottleInterval<\/key>\s*<integer>30<\/integer>/.test(installer),
   "colima plist must set ThrottleInterval=30");
 
-// Task 4 — panel 60s docker gate
-must(/panel-launchd-wrapper\.sh/.test(installer),
-  "installer must generate panel-launchd-wrapper.sh (60s docker gate)");
-must(/PANEL_DOCKER_WAIT_DEADLINE=60\b/.test(installer),
-  "panel gate deadline must be 60s");
+// Task 4 — core 60s docker gate
+must(/core-launchd-wrapper\.sh/.test(installer),
+  "installer must generate core-launchd-wrapper.sh (60s docker gate)");
+must(/CORE_DOCKER_WAIT_DEADLINE=60\b/.test(installer),
+  "core gate deadline must be 60s");
 
 // Task 5 — autologin opt-in + FileVault guard + flags
 must(/_enable_autologin\(\)/.test(installer),
@@ -71,20 +71,20 @@ must(/checkColimaLaunchd[,\s]/.test(doctor) && /ALL_CHECKS/.test(doctor),
 
 // ─────────────────────────────────────────────────────────────────────
 // Follow-up #14 — TypeScript install path parity. `jishushell install`
-// and the Setup wizard go through src/services/setup-manager.ts, which
+// and the Setup wizard go through src/services/setup/setup-manager.ts, which
 // must produce the SAME hardened launchd artifacts as the bash installer
 // (otherwise any reinstall/update reverts the headless-reboot fix).
 // These assertions read the canonical TS builders in macos-launchd.ts.
-const tsLaunchd = readFileSync(join(ROOT, "src/services/macos-launchd.ts"), "utf8");
-const setupMgr = readFileSync(join(ROOT, "src/services/setup-manager.ts"), "utf8");
+const tsLaunchd = readFileSync(join(ROOT, "src/services/system/macos-launchd.ts"), "utf8");
+const setupMgr = readFileSync(join(ROOT, "src/services/setup/setup-manager.ts"), "utf8");
 const tsLaunchdNoComments = tsLaunchd.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "");
 
 // setup-manager must import + use the canonical builders.
-must(/from\s+"\.\/macos-launchd\.js"/.test(setupMgr),
-  "setup-manager.ts must import the canonical builders from ./macos-launchd.js");
+must(/from\s+"\.\.\/system\/macos-launchd\.js"/.test(setupMgr),
+  "setup-manager.ts must import the canonical builders from ../system/macos-launchd.js");
 must(/buildColimaWrapperScript\(/.test(setupMgr) && /buildColimaPlist\(/.test(setupMgr)
   && /buildNomadWaitWrapper\(/.test(setupMgr) && /buildNomadPlist\(/.test(setupMgr)
-  && /buildPanelGateWrapper\(/.test(setupMgr) && /buildPanelPlist\(/.test(setupMgr),
+  && /buildCoreGateWrapper\(/.test(setupMgr) && /buildCorePlist\(/.test(setupMgr),
   "setup-manager.ts must call all six macos-launchd builders");
 must(/appleSiliconGuard\(/.test(setupMgr),
   "setup-manager.ts must gate the macOS branch with appleSiliconGuard()");
@@ -119,9 +119,13 @@ must(/<key>SuccessfulExit<\/key>\s*<false\/>/.test(tsLaunchd),
 must(/<key>ThrottleInterval<\/key>\s*<integer>30<\/integer>/.test(tsLaunchd),
   "TS colima plist must set ThrottleInterval=30");
 
-// Panel 60s docker gate; nomad waits for docker before exec.
-must(/PANEL_DOCKER_WAIT_DEADLINE=60\b/.test(tsLaunchd),
-  "TS panel gate deadline must be 60s");
+// Core 60s docker gate; nomad waits for docker before exec.
+must(/CORE_DOCKER_WAIT_DEADLINE_SECONDS\s*=\s*60\b/.test(tsLaunchd),
+  "TS core gate deadline constant must be 60s");
+must(/CORE_DOCKER_WAIT_DEADLINE=\$\{CORE_DOCKER_WAIT_DEADLINE_SECONDS\}/.test(tsLaunchd),
+  "TS core gate wrapper must interpolate CORE_DOCKER_WAIT_DEADLINE_SECONDS");
+must(/exec "\$\{coreStartWrapper\}"/.test(tsLaunchd) && !/exec \/bin\/sh "\$\{coreStartWrapper\}"/.test(tsLaunchd),
+  "TS core gate wrapper must exec jishushell-core-start directly so its bash shebang is honored");
 must(/docker info/.test(tsLaunchd) && /exec "\$\{nomadBin\}" agent/.test(tsLaunchd),
   "TS nomad wait wrapper must poll docker then exec nomad");
 
@@ -144,14 +148,14 @@ const crossLink = (label, bashRe, tsRe) => {
   if (b !== null && t !== null) {
     must(b === t,
       `${label} budget drift: bash=${b} != TS=${t} ` +
-      `(install/jishu-install.sh vs src/services/macos-launchd.ts must stay lockstep)`);
+      `(install/jishu-install.sh vs src/services/system/macos-launchd.ts must stay lockstep)`);
   }
 };
 
-// panel docker-wait deadline (PANEL_DOCKER_WAIT_DEADLINE=60).
-crossLink("PANEL_DOCKER_WAIT_DEADLINE",
-  /PANEL_DOCKER_WAIT_DEADLINE=(\d+)\b/,
-  /PANEL_DOCKER_WAIT_DEADLINE=(\d+)\b/);
+// core docker-wait deadline (CORE_DOCKER_WAIT_DEADLINE=60).
+crossLink("CORE_DOCKER_WAIT_DEADLINE",
+  /CORE_DOCKER_WAIT_DEADLINE=(\d+)\b/,
+  /CORE_DOCKER_WAIT_DEADLINE_SECONDS\s*=\s*(\d+)\b/);
 
 // nomad docker-wait budget (deadline = now + 180, echoed "after 180s").
 crossLink("nomad docker-wait seconds",
@@ -194,7 +198,7 @@ must(staleReclaimRe.test(installer),
   "bash colima-wrapper heredoc (install/jishu-install.sh) must reclaim a stale mkdir-lock " +
   'before acquiring it ([ -d "$LOCKDIR" ] && find ... -mmin +N -exec rmdir {} \\;)');
 must(staleReclaimRe.test(tsLaunchd),
-  "TS buildColimaWrapperScript (src/services/macos-launchd.ts) must reclaim a stale " +
+  "TS buildColimaWrapperScript (src/services/system/macos-launchd.ts) must reclaim a stale " +
   'mkdir-lock before acquiring it ([ -d "$LOCKDIR" ] && find ... -mmin +N -exec rmdir {} \\;)');
 
 // staleness budget literal (-mmin +10) must match bash↔TS.
@@ -218,7 +222,7 @@ must(lockRefreshRe.test(installer),
   'lock mtime each retry attempt (touch "$LOCKDIR" 2>/dev/null || true) so a ' +
   "long in-progress start is never reclaimed as stale");
 must(lockRefreshRe.test(tsLaunchd),
-  "TS buildColimaWrapperScript (src/services/macos-launchd.ts) must refresh its own " +
+  "TS buildColimaWrapperScript (src/services/system/macos-launchd.ts) must refresh its own " +
   'lock mtime each retry attempt (touch "$LOCKDIR" 2>/dev/null || true) so a ' +
   "long in-progress start is never reclaimed as stale");