jishushell 0.5.22 → 0.6.18

package/dist/cli/core.js

@@ -0,0 +1,1415 @@
+/**
+ * src/cli/core.ts
+ * Unified core management module — covers start/stop/restart/status/serve/
+ * onboard/reset/update/config/install/uninstall.
+ *
+ * Dependency hierarchy:
+ *   cli/core.ts  →  services/setup/core-manager.ts  (pure logic, no I/O)
+ *   cli/core.ts  →  services/runtime/drivers/nomad.ts  (runtime execution)
+ * All terminal output/formatting lives in this file.
+ */
+import { execSync, execFileSync } from "child_process";
+import { existsSync, readFileSync, unlinkSync } from "fs";
+import { dirname, join } from "path";
+import { networkInterfaces } from "os";
+import { fileURLToPath, pathToFileURL } from "url";
+import { parsePort, hasFlag } from "./helpers.js";
+import { detectRunMode, getCorePort, isPortListening, readAlivePid, systemdStatus, startCore, stopCore, restartCore, killPortProcess, waitForPortOpen, } from "../services/setup/core-manager.js";
+import { checkUpdate, } from "../services/system/update-manager.js";
+import { executeUpgradeFinalize, getUpgradeFinalizeStatus, preflightUpgradeFinalizeRequest } from "../services/system/upgrade-finalize.js";
+import { listInstanceIds, readInstanceMeta, stopIntegrationRuntimeJob, getInstanceStatus, ensureNomadToken, isAppJob, } from "../services/runtime/drivers/nomad.js";
+import { JISHUSHELL_HOME, getCoreConfig, getNomadToken, getNomadAddr, saveCoreConfig, setOpenclawDockerImage } from "../config.js";
+import { isInitialized, initPassword, resetPassword } from "../auth.js";
+const DEFAULT_PORT = 8091;
+const DEFAULT_PANEL_PORT = 8090;
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+function resolveBundledPanelServerBin() {
+    const packageRoot = join(__dirname, "..", "..");
+    const candidates = [
+        process.env.JISHUSHELL_PANEL_BIN,
+        join(packageRoot, "node_modules", "jishushell-panel", "output", "dist", "server.js"),
+    ]
+        .map((candidate) => candidate?.trim())
+        .filter((candidate) => Boolean(candidate));
+    return candidates.find((candidate) => existsSync(candidate)) ?? null;
+}
+// ── ANSI colours (CLI-only, stripped when not a TTY) ──────────────────────
+const isTTY = process.stdout.isTTY ?? false;
+const c = {
+    bold: (s) => isTTY ? `\x1b[1m${s}\x1b[0m` : s,
+    green: (s) => isTTY ? `\x1b[32m${s}\x1b[0m` : s,
+    yellow: (s) => isTTY ? `\x1b[33m${s}\x1b[0m` : s,
+    red: (s) => isTTY ? `\x1b[31m${s}\x1b[0m` : s,
+    cyan: (s) => isTTY ? `\x1b[36m${s}\x1b[0m` : s,
+    dim: (s) => isTTY ? `\x1b[2m${s}\x1b[0m` : s,
+};
+function log(msg) { process.stdout.write(msg + "\n"); }
+function warningBox(lines) {
+    const width = Math.max(...lines.map((line) => line.length), 1);
+    const border = "═".repeat(width + 4);
+    log(c.yellow(`  ╔${border}╗`));
+    for (const line of lines) {
+        log(c.yellow(`  ║  ${line.padEnd(width)}  ║`));
+    }
+    log(c.yellow(`  ╚${border}╝`));
+}
+async function confirmInteractive(question) {
+    if (!process.stdin.isTTY)
+        return false;
+    const { createInterface } = await import("readline");
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise((resolve) => {
+        rl.question(`${question} [y/N] `, (input) => {
+            rl.close();
+            resolve(input.trim().toLowerCase());
+        });
+    });
+    return answer === "y" || answer === "yes";
+}
+function fmtTimeoutSeconds(timeoutMs) {
+    if (!timeoutMs || timeoutMs <= 0)
+        return 10;
+    return Math.ceil(timeoutMs / 1000);
+}
+export function getCliVersion() {
+    if (process.env.npm_package_version) {
+        return `v${process.env.npm_package_version}`;
+    }
+    try {
+        const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf-8"));
+        if (pkg?.version)
+            return `v${pkg.version}`;
+    }
+    catch {
+        // ignore and fall through
+    }
+    return "unknown";
+}
+// ── Core process lifecycle ──────────────────────────────────────────────────
+export async function runStart(rest) {
+    const result = await startCore(parsePort(rest));
+    if (result.alreadyRunning) {
+        log(c.yellow(`! JishuShell is already running on port ${result.port}`));
+        log(c.dim(`  Run ${c.bold("jishushell stop")} first, or ${c.bold("jishushell restart")}`));
+        return;
+    }
+    log(c.dim(`  run mode: ${result.mode}  |  port: ${result.port}`));
+    log(c.dim("  Waiting for core to start…"));
+    if (result.started) {
+        log(c.green(`✓ JishuShell started  →  http://localhost:${result.port}`));
+    }
+    else {
+        const timeoutSeconds = fmtTimeoutSeconds(result.startupTimeoutMs);
+        log(c.yellow(`! Port ${result.port} still not listening after ${timeoutSeconds}s.`));
+        log(c.dim(`  Check logs: ${result.logHint}`));
+    }
+}
+export async function runStop(rest) {
+    const withJobs = hasFlag(rest, "--jobs", "-j");
+    if (withJobs) {
+        ensureNomadToken();
+        const instanceIds = await listInstanceIds();
+        if (instanceIds.length > 0) {
+            log(c.dim(`  Stopping ${instanceIds.length} Nomad job(s)…`));
+            const { stopInstance } = await import("../services/app-common/lifecycle-service.js");
+            await Promise.allSettled(instanceIds.map(async (id) => {
+                const meta = readInstanceMeta(id);
+                const name = meta?.name || id;
+                const result = await stopInstance(id);
+                if (result.ok) {
+                    log(`    ${c.green("✓")} stopped job: ${name}`);
+                }
+                else {
+                    log(`    ${c.dim("–")} ${result.error || "already stopped"}: ${name}`);
+                }
+            }));
+            log("");
+        }
+        log(c.dim("  Stopping JishuShell core…"));
+    }
+    const result = await stopCore();
+    log(c.dim(`  run mode: ${result.mode}`));
+    log(c.green("✓ JishuShell stopped"));
+}
+export async function runRestart(rest) {
+    const result = await restartCore(parsePort(rest));
+    log(c.dim(`  run mode: ${result.mode}  |  port: ${result.port}`));
+    if (result.started) {
+        log(c.green(`✓ JishuShell restarted  →  http://localhost:${result.port}`));
+    }
+    else {
+        const timeoutSeconds = fmtTimeoutSeconds(result.startupTimeoutMs);
+        log(c.yellow(`! Core did not come back up within ${timeoutSeconds}s.`));
+        log(c.dim(`  Check logs: ${result.logHint}`));
+    }
+}
+// ── status ────────────────────────────────────────────────────────────────
+export async function runStatus() {
+    ensureNomadToken();
+    const port = getCorePort();
+    const mode = detectRunMode();
+    const nomadAddr = getNomadAddr();
+    log("");
+    log(c.bold(c.cyan("  JishuShell Status")));
+    log(c.dim("  ─────────────────────────────────────────────────────"));
+    log("");
+    // ── 1. Core ───────────────────────────────────────────────────────────
+    log(`  ${c.bold("Core (CLI)")}`);
+    const coreListening = isPortListening(port);
+    const pid = readAlivePid();
+    if (coreListening) {
+        log(`    ${c.green("●")} ${c.green("running")}  →  port :${port}`);
+    }
+    else {
+        log(`    ${c.red("○")} ${c.red("stopped")}`);
+    }
+    log(`    ${c.dim("run mode:")} ${mode}`);
+    if (mode === "systemd") {
+        const svcStatus = systemdStatus();
+        log(`    ${c.dim("systemd:")} ${svcStatus === "active" ? c.green(svcStatus) : c.yellow(svcStatus)}`);
+    }
+    else if (mode === "process" && pid !== null) {
+        log(`    ${c.dim("pid:")} ${pid}`);
+    }
+    log(`    ${c.dim("url:")} http://localhost:${port}`);
+    log("");
+    // ── 2. Docker ─────────────────────────────────────────────────────────
+    log(`  ${c.bold("Docker")}`);
+    let dockerOk = false;
+    let dockerDetail = "daemon unreachable";
+    try {
+        execFileSync("docker", ["info"], { stdio: "ignore", timeout: 5000 });
+        const ver = execSync("docker --version 2>/dev/null", { encoding: "utf-8", timeout: 3000 }).trim();
+        dockerOk = true;
+        dockerDetail = ver.replace("Docker version ", "").split(",")[0];
+    }
+    catch {
+        try {
+            execFileSync("sudo", ["-n", "docker", "info"], { stdio: "ignore", timeout: 5000 });
+            dockerOk = true;
+            dockerDetail = "running (via sudo — re-login to activate docker group)";
+        }
+        catch { }
+    }
+    if (dockerOk) {
+        log(`    ${c.green("●")} ${c.green("running")}  ${c.dim(dockerDetail)}`);
+    }
+    else {
+        log(`    ${c.red("○")} ${c.red("stopped")}  ${c.dim(dockerDetail)}`);
+    }
+    log("");
+    // ── 3. Nomad ──────────────────────────────────────────────────────────
+    log(`  ${c.bold("Nomad")}`);
+    const token = getNomadToken();
+    const nomadHeaders = token ? { "X-Nomad-Token": token } : {};
+    let nomadAgent = null;
+    try {
+        const res = await fetch(`${nomadAddr}/v1/agent/self`, {
+            headers: nomadHeaders, signal: AbortSignal.timeout(5000),
+        });
+        if (res.ok)
+            nomadAgent = await res.json();
+    }
+    catch { /* unreachable */ }
+    const nomadRunning = nomadAgent !== null;
+    if (nomadRunning) {
+        const version = nomadAgent?.config?.Version?.Version || nomadAgent?.member?.Tags?.version || "";
+        log(`    ${c.green("●")} ${c.green("running")}  →  ${nomadAddr}${version ? "  " + c.dim("v" + version) : ""}`);
+    }
+    else {
+        log(`    ${c.red("○")} ${c.red("stopped")}  ${c.dim("(" + nomadAddr + " unreachable)")}`);
+    }
+    log("");
+    // ── 4. Jobs (instances) ───────────────────────────────────────────────
+    const instanceIds = await listInstanceIds();
+    log(`  ${c.bold("Nomad Jobs")}  ${c.dim("(" + instanceIds.length + " instance" + (instanceIds.length !== 1 ? "s" : "") + ")")}`);
+    if (instanceIds.length === 0) {
+        log(`    ${c.dim("(no instances created)")}`);
+    }
+    else if (!nomadRunning) {
+        log(`    ${c.dim("(Nomad not reachable — cannot query job status)")}`);
+        for (const id of instanceIds) {
+            const meta = readInstanceMeta(id);
+            log(`    ${c.dim("??")}  ${(meta?.name || id).padEnd(20)}  ${c.dim(id)}`);
+        }
+    }
+    else {
+        for (const id of instanceIds) {
+            const meta = readInstanceMeta(id);
+            let statusStr = "unknown";
+            let statusColor = c.dim;
+            try {
+                const st = await getInstanceStatus(id);
+                statusStr = st.status;
+                if (st.status === "running")
+                    statusColor = c.green;
+                else if (st.status === "pending")
+                    statusColor = c.yellow;
+                else if (st.status === "failed")
+                    statusColor = c.red;
+            }
+            catch { /* keep unknown */ }
+            const runtime = meta?.runtime;
+            let portInfo = "";
+            if (runtime) {
+                const hostPort = Array.isArray(runtime.ports)
+                    ? runtime.ports.find((port) => Number.isInteger(port?.hostPort) && port.hostPort > 0)?.hostPort
+                    : undefined;
+                if (hostPort)
+                    portInfo = c.dim(`  gateway :${hostPort}`);
+            }
+            const dot = statusStr === "running" ? c.green("●")
+                : statusStr === "pending" ? c.yellow("●")
+                    : statusStr === "failed" ? c.red("●")
+                        : c.dim("○");
+            log(`    ${dot}  ${(meta?.name || id).padEnd(20)}  ${statusColor(statusStr.padEnd(14))}${portInfo}`);
+        }
+    }
+    log("");
+    // ── 5. System Reconciliation ──────────────────────────────────────────
+    const reconcileStatePath = join(JISHUSHELL_HOME, "reconcile-state.json");
+    if (existsSync(reconcileStatePath)) {
+        try {
+            const state = JSON.parse(readFileSync(reconcileStatePath, "utf-8"));
+            const issues = (state.items || []).filter((i) => i.status === "error" || (i.status !== "ok" && (i.requiresSudo || i.reloadRequired || i.manualRequired)));
+            if (issues.length > 0) {
+                log(`  ${c.bold("System Reconciliation")}  ${c.yellow("⚠ " + issues.length + " issue(s)")}`);
+                for (const item of issues) {
+                    const icon = item.status === "error" ? c.red("✗") : c.yellow("!");
+                    log(`    ${icon}  ${c.bold(item.component)}  ${item.message}`);
+                    if (item.command)
+                        log(`       ${c.dim("→")} ${c.cyan(item.command)}`);
+                }
+                log("");
+            }
+            const runtimeAdvisories = Array.isArray(state.runtime?.instances) ? state.runtime.instances : [];
+            if (runtimeAdvisories.length > 0) {
+                log(`  ${c.bold("Runtime Advisories")}  ${c.yellow("⚠ " + runtimeAdvisories.length + " instance(s)")}`);
+                for (const item of runtimeAdvisories) {
+                    const status = item.currentStatus ? c.dim(` (${item.currentStatus})`) : "";
+                    log(`    ${c.yellow("!")}  ${c.bold(item.instanceId)} needs ${item.action || "restart"}${status}`);
+                    if (item.command)
+                        log(`       ${c.dim("→")} ${c.cyan(item.command)}`);
+                }
+                log("");
+            }
+        }
+        catch { /* ignore corrupt state file */ }
+    }
+}
+// ── onboard ───────────────────────────────────────────────────────────────
+function getLocalIP() {
+    try {
+        for (const list of Object.values(networkInterfaces())) {
+            for (const iface of list ?? []) {
+                if (!iface.internal && iface.family === "IPv4")
+                    return iface.address;
+            }
+        }
+    }
+    catch { }
+    return "127.0.0.1";
+}
+function readPassword(prompt) {
+    return new Promise((resolve, reject) => {
+        process.stdout.write(prompt);
+        if (process.stdin.isTTY) {
+            process.stdin.setRawMode(true);
+            process.stdin.resume();
+            let input = "";
+            const onData = (buf) => {
+                const char = buf.toString("utf-8");
+                if (char === "\r" || char === "\n") {
+                    process.stdin.setRawMode(false);
+                    process.stdin.pause();
+                    process.stdin.off("data", onData);
+                    process.stdout.write("\n");
+                    resolve(input);
+                }
+                else if (char === "\u0003") {
+                    process.stdin.setRawMode(false);
+                    process.stdout.write("\n");
+                    reject(new Error("Interrupted"));
+                }
+                else if (char === "\u007f" || char === "\b") {
+                    if (input.length > 0)
+                        input = input.slice(0, -1);
+                }
+                else if (char >= " ") {
+                    input += char;
+                }
+            };
+            process.stdin.on("data", onData);
+        }
+        else {
+            let input = "";
+            process.stdin.resume();
+            process.stdin.setEncoding("utf-8");
+            const onData = (chunk) => {
+                const nl = chunk.indexOf("\n");
+                if (nl >= 0) {
+                    input += chunk.slice(0, nl);
+                    process.stdin.off("data", onData);
+                    process.stdin.pause();
+                    resolve(input.replace(/\r$/, "").trim());
+                }
+                else {
+                    input += chunk;
+                }
+            };
+            process.stdin.on("data", onData);
+        }
+    });
+}
+export async function runOnboard(rest) {
+    const force = hasFlag(rest, "--force", "-f");
+    log("");
+    log(c.bold(c.cyan("  JishuShell Onboard")));
+    log(c.dim("  ─────────────────────────────────────────"));
+    log("");
+    const cfg = getCoreConfig();
+    if (!cfg.service_manager) {
+        log(c.red("  ✗  JishuShell is not installed yet."));
+        log(c.dim("  Run ") + c.bold("jishushell install") + c.dim(" first."));
+        log("");
+        process.exit(1);
+    }
+    const port = getCorePort();
+    if (!isPortListening(port)) {
+        log(c.yellow(`  !  Core is not running on port ${port}.`));
+        log(c.dim("  Start it with: ") + c.bold("jishushell start"));
+        log("");
+        process.exit(1);
+    }
+    const initialized = isInitialized();
+    if (initialized && !force) {
+        const ip = getLocalIP();
+        log(c.green("  ✓  JishuShell is already onboarded."));
+        log("");
+        log(`  Core:   ${c.bold(c.cyan(`http://${ip}:${port}`))}`);
+        log(`  Local:  ${c.bold(c.cyan(`http://localhost:${port}`))}`);
+        log("");
+        log(c.dim("  Tip: ") + c.bold("jishushell onboard --force") + c.dim(" resets the admin password."));
+        log("");
+        return;
+    }
+    if (initialized) {
+        log(c.yellow("  !  Resetting admin password (--force)."));
+    }
+    else {
+        log("  " + c.bold("Welcome!") + " Set your admin password to start using JishuShell.");
+    }
+    log("");
+    let password = "";
+    for (;;) {
+        try {
+            password = await readPassword("  Password (≥8 chars): ");
+        }
+        catch {
+            log(c.yellow("  Interrupted."));
+            process.exit(1);
+        }
+        if (password.length < 8) {
+            log(c.red("  ✗  Minimum 8 characters. Try again."));
+            continue;
+        }
+        let confirm = "";
+        try {
+            confirm = await readPassword("  Confirm password:    ");
+        }
+        catch {
+            log(c.yellow("  Interrupted."));
+            process.exit(1);
+        }
+        if (password !== confirm) {
+            log(c.red("  ✗  Passwords do not match. Try again."));
+            continue;
+        }
+        break;
+    }
+    if (initialized) {
+        await resetPassword(password);
+    }
+    else {
+        const initializedNow = await initPassword(password);
+        if (!initializedNow) {
+            log("");
+            log(c.red("  ✗  Admin password was initialized by another session."));
+            log(c.dim("  Re-run ") + c.bold("jishushell onboard --force") + c.dim(" to reset it."));
+            log("");
+            process.exit(1);
+        }
+    }
+    const ip = getLocalIP();
+    log("");
+    log(c.bold(c.green("  ✓  Onboarding complete!")));
+    log("");
+    log(`  Core API:  ${c.bold(c.cyan(`http://${ip}:${port}`))}`);
+    log(`  Local:     ${c.bold(c.cyan(`http://localhost:${port}`))}`);
+    log("");
+    log(c.dim("  Use panel or direct core API calls to configure LLM providers and instances."));
+    log("");
+}
+// ── reset ─────────────────────────────────────────────────────────────────
+export async function runReset(rest) {
+    const yes = hasFlag(rest, "--yes", "-y");
+    ensureNomadToken();
+    log("");
+    log(c.bold(c.yellow("  ⚠  JishuShell Reset")));
+    log(c.dim("  ─────────────────────────────────────────────────────"));
+    log("");
+    log("  This will:");
+    log(`    ${c.dim("•")} Stop all instances and purge them from the scheduler`);
+    log(`    ${c.dim("•")} Delete all instance directories (~/.jishushell/instances/)`);
+    log(`    ${c.dim("•")} Stop the JishuShell core`);
+    log(`    ${c.dim("•")} Reset auth credentials and LLM provider config`);
+    log(`    ${c.dim("•")} Preserve infrastructure config (Docker image, service manager, port)`);
+    log("");
+    log(`  ${c.bold(c.yellow("Custom integration-home paths outside ~/.jishushell are NOT removed."))}`);
+    log(`  ${c.dim("After reset: restart the core at")} ${c.bold(`http://localhost:${getCorePort()}`)} ${c.dim("and reconfigure through panel or core API.")}`);
+    log("");
+    if (!yes) {
+        if (!process.stdin.isTTY) {
+            log(c.red("  ✗  Reset requires interactive confirmation. Pass --yes to skip."));
+            log("");
+            process.exit(1);
+        }
+        const answer = await new Promise((resolve) => {
+            process.stdout.write(`  Type ${c.bold("RESET")} to continue, or press Enter to cancel: `);
+            let buf = "";
+            const onData = (chunk) => {
+                const str = chunk.toString("utf-8");
+                const nl = str.indexOf("\n");
+                if (nl >= 0) {
+                    buf += str.slice(0, nl);
+                    process.stdin.off("data", onData);
+                    process.stdin.pause();
+                    process.stdout.write("\n");
+                    resolve(buf.trim());
+                }
+                else {
+                    buf += str;
+                }
+            };
+            process.stdin.resume();
+            process.stdin.on("data", onData);
+        });
+        if (answer !== "RESET") {
+            log(c.dim("  Cancelled."));
+            log("");
+            return;
+        }
+    }
+    log("");
+    // 1. Purge jobs and delete instance directories
+    const instanceIds = await listInstanceIds();
+    if (instanceIds.length > 0) {
+        log(c.dim(`  Removing ${instanceIds.length} instance(s)…`));
+        for (const id of instanceIds) {
+            const meta = readInstanceMeta(id);
+            const name = meta?.name || id;
+            let del = { ok: true };
+            if (isAppJob(id)) {
+                try {
+                    const { uninstallInstance } = await import("../services/app-common/lifecycle-service.js");
+                    await uninstallInstance(id);
+                }
+                catch (e) {
+                    del = { ok: false, warnings: [e.message] };
+                }
+            }
+            else {
+                // Legacy/raw runtime cleanup only. App jobs must go through lifecycle-service.
+                await stopIntegrationRuntimeJob(id, true).catch(() => { });
+                if (id.startsWith("openclaw-")) {
+                    try {
+                        const { deleteInstance: delInst } = await import("../services/app-common/service.js");
+                        del = await delInst(id.slice("openclaw-".length));
+                    }
+                    catch (e) {
+                        del = { ok: false, warnings: [e.message] };
+                    }
+                }
+            }
+            if (del.ok) {
+                log(`    ${c.green("✓")} removed: ${name}`);
+            }
+            else {
+                log(`    ${c.yellow("!")} could not fully remove ${name}`);
+            }
+            if (del.warnings?.length) {
+                for (const w of del.warnings)
+                    log(`      ${c.dim(w)}`);
+            }
+        }
+    }
+    // 2. Stop core
+    const port = getCorePort();
+    if (isPortListening(port)) {
+        log(c.dim("  Stopping core…"));
+        try {
+            await stopCore();
+        }
+        catch { /* best-effort */ }
+    }
+    // 3. Selectively clear core.json: preserve infrastructure settings,
+    //    including integration runtime records stored under the historical
+    //    runtime_catalog key, so the user does NOT need to reinstall
+    //    Docker/Nomad/OpenClaw.
+    //    User-owned LLM provider settings are cleared.
+    const CORE_CONFIG = join(JISHUSHELL_HOME, "core.json");
+    const INFRA_KEYS = new Set([
+        "service_manager", "nomad_driver", "runtime_catalog", "runtime_catalog_schema_version",
+        "nomad_token", "core_port", "npm_registry",
+    ]);
+    try {
+        const cfg = getCoreConfig();
+        const preserved = {};
+        for (const key of Object.keys(cfg)) {
+            if (INFRA_KEYS.has(key))
+                preserved[key] = cfg[key];
+        }
+        saveCoreConfig(preserved);
+        log(`    ${c.green("✓")} reset core config (infrastructure settings preserved)`);
+        // Remove core.json backups (stale, not needed after a clean reset)
+        for (const f of [`${CORE_CONFIG}.bak`, `${CORE_CONFIG}.bak.1`, `${CORE_CONFIG}.bak.2`]) {
+            try {
+                if (existsSync(f)) {
+                    unlinkSync(f);
+                }
+            }
+            catch { /* best-effort */ }
+        }
+    }
+    catch (e) {
+        log(`    ${c.yellow("!")} could not reset core config: ${e.message}`);
+    }
+    // 4. Delete auth and secret files
+    const AUTH_FILE = join(JISHUSHELL_HOME, "auth.json");
+    const JWT_FILE = join(JISHUSHELL_HOME, "jwt-secret");
+    const ENCRYPT_KEY = join(JISHUSHELL_HOME, "encryption-key");
+    const filesToRemove = [
+        AUTH_FILE,
+        `${AUTH_FILE}.bak`, `${AUTH_FILE}.bak.1`, `${AUTH_FILE}.bak.2`,
+        JWT_FILE,
+        ENCRYPT_KEY,
+    ];
+    for (const f of filesToRemove) {
+        try {
+            if (existsSync(f)) {
+                unlinkSync(f);
+                log(`    ${c.green("✓")} removed: ${f}`);
+            }
+        }
+        catch (e) {
+            log(`    ${c.yellow("!")} could not remove ${f}: ${e.message}`);
+        }
+    }
+    log("");
+    log(c.bold(c.green("  ✓  Reset complete.")));
+    log("");
+    log(`  To reconfigure: restart the core at ${c.bold(`http://localhost:${port}`)}, then use panel or core API.`);
+    log("");
+}
+// ── update ────────────────────────────────────────────────────────────────
+export async function runUpdateCheck() {
+    const info = await checkUpdate();
+    console.log(JSON.stringify(info));
+    process.exit(info.hasUpdate ? 0 : 1);
+}
+// ── upgrade finalize ───────────────────────────────────────────────────────
+function printUpgradeFinalizeStatus() {
+    const status = getUpgradeFinalizeStatus();
+    log("");
+    log(c.bold("  JishuShell Compatibility Upgrade"));
+    log(c.dim("  ─────────────────────────────────────────────────────"));
+    log("");
+    const icon = status.phase === "completed" ? c.green("✓")
+        : status.phase === "failed" ? c.red("✗")
+            : c.yellow("!");
+    log(`  ${icon} ${c.bold(status.phase)} — ${status.message}`);
+    log("");
+    log(`  migratable: ${status.summary.migratable}`);
+    log(`  migrated:   ${status.summary.migrated}`);
+    log(`  unsupported:${status.summary.unsupported}`);
+    log(`  restart:   ${status.summary.requiresRestart}`);
+    log(`  sudo:      ${status.summary.requiresSudo}`);
+    log(`  rename:    ${status.summary.requiresRename}`);
+    if (status.affectedInstances.length > 0) {
+        log("");
+        log(c.bold("  Affected instances:"));
+        for (const item of status.affectedInstances) {
+            const flags = [
+                item.requiresRename ? "rename" : "",
+                item.requiresRestart ? "restart" : "",
+                item.requiresSudo ? "sudo" : "",
+            ].filter(Boolean).join(", ");
+            log(`    ${c.cyan(item.id)}${flags ? c.dim(` (${flags})`) : ""}`);
+            log(c.dim(`      ${item.detail}`));
+        }
+    }
+    if (status.blockers.length > 0) {
+        log("");
+        log(c.bold(c.red("  Blockers:")));
+        for (const item of status.blockers) {
+            log(`    ${c.red(item.id)}${item.unsupportedReason ? c.dim(` (${item.unsupportedReason})`) : ""}`);
+            log(c.dim(`      ${item.detail}`));
+        }
+    }
+    log("");
+    return status;
+}
+async function runUpgradeStatus() {
+    printUpgradeFinalizeStatus();
+}
+async function runUpgradeFinalize(rest) {
+    const status = printUpgradeFinalizeStatus();
+    const yes = hasFlag(rest, "--yes", "-y");
+    const restartInstances = hasFlag(rest, "--restart-instances");
+    if (status.requiresRestartConsent && !(yes && restartInstances)) {
+        const affected = status.affectedInstances
+            .filter((item) => item.requiresRestart)
+            .map((item) => item.id);
+        log(c.yellow("  This finalization will briefly restart running instances:"));
+        for (const id of affected)
+            log(c.cyan(`    ${id}`));
+        log("");
+        const confirmed = await confirmInteractive("Continue and allow these instance restarts?");
+        if (!confirmed) {
+            log(c.yellow("  Cancelled. No instance data was changed."));
+            log(c.dim("  For non-interactive use: sudo jishushell upgrade finalize --yes --restart-instances"));
+            log("");
+            process.exitCode = 1;
+            return;
+        }
+    }
+    const preflight = preflightUpgradeFinalizeRequest({
+        restartConsentGranted: status.requiresRestartConsent ? true : restartInstances,
+    });
+    if (preflight.code === "not-required") {
+        log(c.green("  ✓ Compatibility finalization is not required."));
+        log("");
+        return;
+    }
+    if (!preflight.ok) {
+        log(c.red(`  ✗ ${preflight.message}`));
+        log("");
+        process.exitCode = 1;
+        return;
+    }
+    log(c.bold("  Running compatibility finalization…"));
+    log("");
+    const result = await executeUpgradeFinalize({
+        restartConsentGranted: status.requiresRestartConsent ? true : restartInstances,
+    });
+    if (result.report) {
+        const { renderReport } = await import("../services/legacy-migrator/index.js");
+        log(renderReport(result.report));
+        log("");
+    }
+    if (result.restartedInstances && result.restartedInstances.length > 0) {
+        log(c.bold("Runtime instance restore:"));
+        for (const item of result.restartedInstances) {
+            const icon = item.ok ? c.green("✓") : c.red("✗");
+            log(`  ${icon} ${item.id}${item.error ? c.dim(` — ${item.error}`) : ""}`);
+        }
+        log("");
+    }
+    if (result.ok) {
+        log(c.green(`  ✓ ${result.message}`));
+    }
+    else {
+        log(c.red(`  ✗ ${result.message}`));
+        process.exitCode = 1;
+    }
+    log("");
+}
+export async function runUpgrade(rest) {
+    const subcmd = rest[0] ?? "status";
+    switch (subcmd) {
+        case "status":
+            return runUpgradeStatus();
+        case "finalize":
+            return runUpgradeFinalize(rest.slice(1));
+        default:
+            log("");
+            log(c.bold("  jishushell upgrade") + " — compatibility upgrade finalization");
+            log("");
+            log("  Usage:");
+            log(`    jishushell upgrade ${c.cyan("status")}      Show compatibility finalization status`);
+            log(`    jishushell upgrade ${c.cyan("finalize")}    Preflight compatibility finalization`);
+            log("");
+            if (subcmd) {
+                console.error(`Unknown upgrade subcommand: ${subcmd}`);
+                process.exitCode = 1;
+            }
+    }
+}
+// ── repair ────────────────────────────────────────────────────────────────
+async function printRepairStatus() {
+    const { getRepairStatus } = await import("../services/system/repair-orchestrator.js");
+    const status = await getRepairStatus();
+    log("");
+    log(c.bold("  JishuShell Repair"));
+    log(c.dim("  ─────────────────────────────────────────────────────"));
+    log("");
+    const icon = status.phase === "completed" ? c.green("✓")
+        : status.phase === "failed" ? c.red("✗")
+            : c.yellow("!");
+    log(`  ${icon} ${c.bold(status.phase)} — ${status.message}`);
+    log("");
+    const rows = [
+        ["service restart", status.requirements.requiresServiceRestart],
+        ["legacy migration", status.requirements.requiresLegacyMigration],
+        ["runtime repair", status.requirements.requiresRuntimeRepair],
+        ["running instance restart", status.requirements.requiresRunningInstanceRestart],
+        ["sudo", status.requirements.requiresSudo],
+    ];
+    for (const [label, required] of rows) {
+        log(`  ${label.padEnd(24)} ${required ? c.yellow("required") : c.dim("ok")}`);
+    }
+    if (status.runningInstancesAffected.length > 0) {
+        log("");
+        log(c.bold(c.yellow("  Running instances affected:")));
+        for (const id of status.runningInstancesAffected)
+            log(`    ${c.cyan(id)}`);
+    }
+    const runningAffected = new Set(status.runningInstancesAffected);
+    const runtimeItems = status.runtime.results.filter((item) => item.status !== "ok");
+    if (runtimeItems.length > 0) {
+        log("");
+        log(c.bold("  Runtime repair items:"));
+        for (const item of runtimeItems) {
+            const restartDeferred = item.restartRequired && !runningAffected.has(item.instanceId);
+            const displayStatus = restartDeferred ? "restart-deferred" : item.status;
+            const itemIcon = item.status === "error" ? c.red("✗")
+                : restartDeferred ? c.dim("·")
+                    : item.status === "needs-restart" ? c.yellow("!")
+                        : item.status === "repaired" ? c.cyan("↻")
+                            : c.yellow("·");
+            log(`    ${itemIcon} ${item.instanceId} (${item.integrationKind}) — ${displayStatus}`);
+            for (const warning of item.warnings)
+                log(c.yellow(`        ${warning}`));
+            if (item.reason) {
+                log(restartDeferred
+                    ? c.dim(`        ${item.reason}; instance is not running, so repair will not start it`)
+                    : c.yellow(`        ${item.reason}`));
+            }
+            if (item.error)
+                log(c.red(`        ${item.error}`));
+        }
+    }
+    if (status.blockers.length > 0) {
+        log("");
+        log(c.bold(c.red("  Blockers:")));
+        for (const blocker of status.blockers) {
+            log(`    ${c.red(blocker.id)} ${c.dim(`[${blocker.source}]`)}`);
+            log(c.dim(`      ${blocker.message}`));
+        }
+    }
+    if (status.repairRequired) {
+        log("");
+        log(c.dim(`  Command: ${status.command}`));
+    }
+    log("");
+    return status;
+}
+export async function runRepair(rest) {
+    const subcmd = rest[0];
+    if (subcmd === "status") {
+        await printRepairStatus();
+        return;
+    }
+    if (subcmd === "help" || subcmd === "--help" || subcmd === "-h") {
+        const { getRepairCommand } = await import("../services/system/repair-orchestrator.js");
+        const repairCommand = getRepairCommand();
+        const restartRepairCommand = getRepairCommand(true);
+        log("");
+        log(c.bold("  jishushell repair") + " — repair local JishuShell framework state");
+        log("");
+        log("  Usage:");
+        log(`    jishushell repair ${c.cyan("status")}      Inspect repair requirements`);
+        log(`    ${c.cyan(repairCommand)}        Repair interactively`);
+        log(`    ${c.cyan(`${repairCommand} --yes`)}  Repair non-interactively when no running instance restart is needed`);
+        log(`    ${c.cyan(`${restartRepairCommand} --yes`)}  Repair with explicit running-instance restart consent`);
+        log("");
+        return;
+    }
+    const yes = hasFlag(rest, "--yes", "-y");
+    const restartInstances = hasFlag(rest, "--restart-instances");
+    const status = await printRepairStatus();
+    if (!status.repairRequired) {
+        log(c.green("  ✓ No repair is required."));
+        log("");
+        return;
+    }
+    if (!status.canRepair) {
+        log(c.red("  ✗ Repair is blocked. Resolve the blockers above and retry."));
+        log("");
+        process.exitCode = 1;
+        return;
+    }
+    if (status.requirements.requiresSudo && process.getuid?.() !== 0) {
+        log(c.yellow("  Repair requires sudo."));
+        log(c.dim(`  Run: ${status.command}`));
+        log("");
+        process.exitCode = 1;
+        return;
+    }
+    let restartConsentGranted = false;
+    if (status.requirements.requiresRunningInstanceRestart) {
+        if (yes && !restartInstances) {
+            log(c.yellow("  Repair needs to restart running instances and cannot continue in --yes mode."));
+            log(c.dim(`  Run interactively after stopping active work: ${status.command}`));
+            log("");
+            process.exitCode = 1;
+            return;
+        }
+        if (yes && restartInstances) {
+            restartConsentGranted = true;
+        }
+        else {
+            restartConsentGranted = await confirmInteractive("Repair will restart the running instances listed above. Continue?");
+            if (!restartConsentGranted) {
+                log(c.yellow("  Cancelled. No repair was applied."));
+                log("");
+                process.exitCode = 1;
+                return;
+            }
+        }
+    }
+    if (status.requirements.requiresServiceRestart) {
+        await runSystemReload();
+        if (process.exitCode)
+            return;
+        const { clearPendingPackageUpdate } = await import("../services/system/repair-orchestrator.js");
+        clearPendingPackageUpdate();
+    }
+    const { executeRepair } = await import("../services/system/repair-orchestrator.js");
+    const result = await executeRepair({
+        restartConsentGranted,
+        applySystem: false,
+    });
+    if (result.legacy?.report) {
+        const { renderReport } = await import("../services/legacy-migrator/index.js");
+        log(renderReport(result.legacy.report));
+        log("");
+    }
+    if (result.legacy?.restartedInstances && result.legacy.restartedInstances.length > 0) {
+        log(c.bold("Runtime instance restore:"));
+        for (const item of result.legacy.restartedInstances) {
+            const itemIcon = item.ok ? c.green("✓") : c.red("✗");
+            log(`  ${itemIcon} ${item.id}${item.error ? c.dim(` — ${item.error}`) : ""}`);
+        }
+        log("");
+    }
+    if (result.runtime?.results && result.runtime.results.length > 0) {
+        log(c.bold("Runtime repair:"));
+        for (const item of result.runtime.results) {
+            const itemIcon = item.status === "error" ? c.red("✗")
+                : item.status === "needs-restart" ? c.yellow("!")
+                    : item.status === "repaired" ? c.cyan("↻")
+                        : item.status === "manual" ? c.yellow("·")
+                            : c.green("✓");
+            log(`  ${itemIcon} ${item.instanceId} (${item.integrationKind}) — ${item.status}`);
+            for (const repaired of item.repaired)
+                log(c.dim(`      repaired: ${repaired}`));
+            for (const warning of item.warnings)
+                log(c.yellow(`      warning: ${warning}`));
+            if (item.reason)
+                log(c.yellow(`      restart required: ${item.reason}`));
+            if (item.error)
+                log(c.red(`      error: ${item.error}`));
+        }
+        log("");
+    }
+    if (result.runtimeRestartedInstances && result.runtimeRestartedInstances.length > 0) {
+        log(c.bold("Runtime instance restart:"));
+        for (const item of result.runtimeRestartedInstances) {
+            const itemIcon = item.ok ? (item.skipped ? c.dim("·") : c.green("✓")) : c.red("✗");
+            const suffix = item.skipped
+                ? c.dim(` — skipped (${item.status || "not running"})`)
+                : item.error
+                    ? c.dim(` — ${item.error}`)
+                    : "";
+            log(`  ${itemIcon} ${item.id}${suffix}`);
+        }
+        log("");
+    }
+    if (result.ok) {
+        log(c.green(`  ✓ ${result.message}`));
+    }
+    else {
+        log(c.red(`  ✗ ${result.message}`));
+        process.exitCode = 1;
+    }
+    log("");
+}
+// ── serve: foreground server (systemd/launchd ExecStart) ────────────────────
+export async function runServe(rest) {
+    // Priority: --port flag > core.json core_port > default core port
+    let port;
+    let host = "0.0.0.0";
+    let coreOnly = process.env.JISHUSHELL_SERVE_CORE_ONLY === "1";
+    for (let i = 0; i < rest.length; i++) {
+        let portVal;
+        if (rest[i] === "--port" && rest[i + 1]) {
+            portVal = rest[++i];
+        }
+        else if (rest[i].startsWith("--port=")) {
+            portVal = rest[i].slice("--port=".length);
+        }
+        else if (rest[i] === "--host" && rest[i + 1]) {
+            host = rest[++i];
+        }
+        else if (rest[i].startsWith("--host=")) {
+            host = rest[i].slice("--host=".length);
+        }
+        else if (rest[i] === "--core-only") {
+            coreOnly = true;
+        }
+        if (portVal !== undefined) {
+            const parsed = parseInt(portVal, 10);
+            if (isNaN(parsed) || parsed < 0 || parsed > 65535) {
+                console.error(`Invalid port: ${portVal}. Must be 0-65535.`);
+                process.exit(1);
+            }
+            port = parsed;
+        }
+    }
+    const panelServerBin = resolveBundledPanelServerBin();
+    const panelPort = Number(process.env.JISHUSHELL_PANEL_PORT) || DEFAULT_PANEL_PORT;
+    const legacySingleServicePanelFallback = process.env.JISHUSHELL_LEGACY_SINGLE_SERVICE_PANEL_FALLBACK !== "0";
+    const shouldServePanel = !coreOnly && panelServerBin && (port === undefined ||
+        (legacySingleServicePanelFallback && port === panelPort));
+    if (shouldServePanel) {
+        const panelModule = await import(pathToFileURL(panelServerBin).href);
+        const corePort = Number(process.env.JISHUSHELL_CORE_PORT) || Number(getCoreConfig().core_port) || DEFAULT_PORT;
+        const coreBaseUrl = process.env.JISHUSHELL_CORE_BASE_URL || `http://127.0.0.1:${corePort}`;
+        const panel = await panelModule.createServer({
+            host,
+            port: port ?? panelPort,
+            coreBaseUrl,
+            manageCore: process.env.JISHUSHELL_PANEL_MANAGE_CORE === "0" ? false : undefined,
+        });
+        await panel.listen();
+        return;
+    }
+    const { createServer } = await import("../server.js");
+    const config = getCoreConfig();
+    await createServer({ port: port ?? (Number(config.core_port) || DEFAULT_PORT), host });
+}
+// ── config: core.json read/write ───────────────────────────────────────────
+export async function runConfig(rest) {
+    const cfgCmd = rest[0];
+    if (cfgCmd === "get") {
+        const cfg = getCoreConfig();
+        const key = rest[1];
+        if (key) {
+            const val = cfg[key];
+            if (val === undefined) {
+                process.stdout.write(c.dim("  (not set)") + "\n");
+            }
+            else {
+                console.log(typeof val === "object" ? JSON.stringify(val, null, 2) : String(val));
+            }
+        }
+        else {
+            console.log(JSON.stringify(cfg, null, 2));
+        }
+    }
+    else if (cfgCmd === "set" && rest[1] && rest[2]) {
+        const ALLOWED_KEYS = ["service_manager", "nomad_driver", "openclaw_runtime_image", "core_port", "npm_registry"];
+        const key = rest[1];
+        const value = rest[2];
+        if (!ALLOWED_KEYS.includes(key)) {
+            log(c.red(`  ✗  Unknown config key: ${key}`));
+            log(c.dim(`     Allowed: ${ALLOWED_KEYS.join(", ")}`));
+            process.exitCode = 1;
+            return;
+        }
+        if (key === "openclaw_runtime_image") {
+            setOpenclawDockerImage(value);
+        }
+        else {
+            const cfg = getCoreConfig();
+            const numVal = parseInt(value, 10);
+            cfg[key] = !isNaN(numVal) && String(numVal) === value ? numVal : value;
+            saveCoreConfig(cfg);
+        }
+        log(c.green(`  ✓  ${key} = ${value}`));
+    }
+    else {
+        console.log(`
+Usage: jishushell config <command>
+
+Commands:
+  get [key]           查看配置（不指定 key 则显示全部）
+  set <key> <value>   修改配置项
+
+Allowed keys:
+  service_manager    服务管理器类型（仅支持 nomad；legacy 'process' 已停止支持，
+                     旧实例请先运行 jishushell migrate legacy）
+  nomad_driver       Nomad driver（docker）
+  openclaw_runtime_image
+                     OpenClaw runtime Docker 镜像
+  core_port          Core server 端口
+  npm_registry       npm 镜像源
+
+Examples:
+  jishushell config get
+  jishushell config get core_port
+  jishushell config set core_port 8091
+`);
+        if (cfgCmd)
+            process.exit(1);
+    }
+}
+// ── install / uninstall / reconcile ──────────────────────────────────────────
+export function brief() {
+    return "  start|stop|restart|status|serve|onboard         Core 生命周期与运行管理\n  reset|config|update-check|upgrade|repair|version Core 维护、版本与升级\n  install|reconcile|uninstall                      对账系统组件与卸载";
+}
+export async function runInstallCmd(rest) {
+    const { runInstall, parseInstallArgs } = await import("../install.js");
+    const opts = parseInstallArgs(rest);
+    await runInstall(opts);
+}
+export async function runReconcile() {
+    const { reconcileSystem } = await import("../services/system/system-reconciler.js");
+    log("");
+    log(c.bold("  Reconciling system components…"));
+    log("");
+    const result = await reconcileSystem();
+    for (const item of result.items) {
+        const icon = item.status === "ok" ? c.green("✓")
+            : item.status === "updated" ? c.cyan("↻")
+                : item.status === "skipped" ? c.dim("·")
+                    : c.red("✗");
+        const suffix = item.requiresSudo ? c.yellow(" [needs sudo]") : "";
+        log(`  ${icon}  ${c.bold(item.component)}  ${item.message}${suffix}`);
+        if (item.command && item.status !== "ok") {
+            log(`       ${c.dim("→")} ${c.cyan(item.command)}`);
+        }
+        if (item.details && item.status === "error") {
+            log(`       ${c.dim(item.details)}`);
+        }
+    }
+    log("");
+    const errors = result.items.filter(i => i.status === "error");
+    const updated = result.items.filter(i => i.status === "updated");
+    const needsSudo = result.items.filter(i => i.requiresSudo && i.status !== "ok" && i.status !== "updated");
+    if (errors.length > 0) {
+        log(c.red(`  ${errors.length} component(s) had errors.`));
+        process.exitCode = 1;
+    }
+    if (needsSudo.length > 0 && process.getuid?.() !== 0) {
+        log(c.yellow(`  ${needsSudo.length} item(s) require sudo. Run:`));
+        log(c.cyan(`    ${result.command}`));
+        process.exitCode = 1;
+    }
+    else if (result.reloadRequired) {
+        log(c.yellow("  System files were updated; restart services to activate them:"));
+        log(c.cyan(`    ${result.command}`));
+    }
+    else if (updated.length > 0) {
+        log(c.green(`  ${updated.length} component(s) updated.`));
+    }
+    else if (errors.length === 0) {
+        log(c.green("  All system components are up-to-date."));
+    }
+    log("");
+}
+// ── system subcommand group ───────────────────────────────────────────────
+async function runSystemRepairInstances(rest) {
+    const dryRun = hasFlag(rest, "--dry-run");
+    log("");
+    log(c.bold("  JishuShell Instance Compatibility Repair"));
+    log(c.dim("  ─────────────────────────────────────────────────────"));
+    log("");
+    const { repairRuntimeInstances } = await import("../services/repair/runtime-repair.js");
+    const result = await repairRuntimeInstances({ dryRun });
+    if (dryRun)
+        log(c.dim("  Dry run only; no files or Nomad variables were changed."));
+    if (result.results.length === 0) {
+        log(c.green("  ✓ No OpenClaw/Hermes instances found."));
+        log("");
+        return;
+    }
+    for (const item of result.results) {
+        const icon = item.status === "error" ? c.red("✗")
+            : item.status === "needs-restart" ? c.yellow("!")
+                : item.status === "repaired" ? c.cyan("↻")
+                    : item.status === "manual" ? c.yellow("·")
+                        : c.green("✓");
+        log(`  ${icon} ${item.instanceId} (${item.integrationKind}) — ${item.status}`);
+        for (const repaired of item.repaired)
+            log(c.dim(`      repaired: ${repaired}`));
+        for (const warning of item.warnings)
+            log(c.yellow(`      warning: ${warning}`));
+        if (item.reason)
+            log(c.yellow(`      restart required: ${item.reason}`));
+        if (item.error)
+            log(c.red(`      error: ${item.error}`));
+    }
+    if (!result.ok)
+        process.exitCode = 1;
+    log("");
+}
+async function runSystemReload() {
+    log("");
+    log(c.bold("  JishuShell System Reload"));
+    log(c.dim("  ─────────────────────────────────────────────────────"));
+    log("");
+    // Step 1: Reconcile
+    log(c.bold("  1. Reconciling system components…"));
+    const { reconcileSystem, inspectSystemDrift } = await import("../services/system/system-reconciler.js");
+    const result = await reconcileSystem();
+    const errors = result.items.filter(i => i.status === "error");
+    const updated = result.items.filter(i => i.status === "updated");
+    const needsSudo = result.items.filter(i => i.requiresSudo && i.status !== "ok" && i.status !== "updated");
+    for (const item of result.items) {
+        if (item.status === "ok")
+            continue;
+        const icon = item.status === "updated" ? c.cyan("↻")
+            : item.status === "skipped" ? c.dim("·")
+                : c.red("✗");
+        const suffix = item.requiresSudo ? c.yellow(" [needs sudo]") : "";
+        log(`     ${icon}  ${item.component}: ${item.message}${suffix}`);
+    }
+    if (updated.length > 0) {
+        log(c.green(`     ✓ ${updated.length} component(s) updated`));
+    }
+    if (errors.length > 0) {
+        log(c.red(`     ✗ ${errors.length} component(s) had errors`));
+        process.exitCode = 1;
+    }
+    if (needsSudo.length > 0 && process.getuid?.() !== 0) {
+        log(c.yellow(`     ! ${needsSudo.length} item(s) require sudo — re-run with sudo`));
+        log("");
+        process.exitCode = 1;
+        return;
+    }
+    log("");
+    // Step 2: Restart Core-owned services
+    log(c.bold("  2. Restarting Core services…"));
+    let panelStartedOk = false;
+    try {
+        const restartResult = await restartCore();
+        if (restartResult.started) {
+            log(c.green(`     ✓ JishuShell running  →  http://localhost:${restartResult.port}`));
+        }
+        else {
+            const timeoutSeconds = fmtTimeoutSeconds(restartResult.startupTimeoutMs);
+            log(c.yellow(`     ! JishuShell did not respond within ${timeoutSeconds}s`));
+            log(c.dim(`       Check logs: ${restartResult.logHint}`));
+        }
+    }
+    catch (e) {
+        log(c.red(`     ✗ Restart failed: ${e.message}`));
+        process.exitCode = 1;
+    }
+    if (process.platform !== "darwin") {
+        try {
+            execFileSync("systemctl", ["cat", "jishushell-panel"], { stdio: "ignore", timeout: 5000 });
+            const panelPort = Number(process.env.JISHUSHELL_PANEL_PORT) || 8090;
+            try {
+                execFileSync("systemctl", ["stop", "jishushell-panel"], { stdio: "ignore", timeout: 10000 });
+            }
+            catch { }
+            if (isPortListening(panelPort)) {
+                killPortProcess(panelPort);
+                for (let i = 0; i < 20 && isPortListening(panelPort); i++) {
+                    await new Promise((r) => setTimeout(r, 250));
+                }
+            }
+            execFileSync("systemctl", ["reset-failed", "jishushell-panel"], { stdio: "ignore", timeout: 5000 });
+            execFileSync("systemctl", ["start", "jishushell-panel"], { stdio: "ignore", timeout: 10000 });
+            const panelStarted = await waitForPortOpen(panelPort, 30000);
+            if (panelStarted) {
+                log(c.green(`     ✓ Panel running       →  http://localhost:${panelPort}`));
+                panelStartedOk = true;
+            }
+            else {
+                log(c.yellow(`     ! Panel did not respond on :${panelPort}`));
+            }
+        }
+        catch (e) {
+            log(c.dim(`     · Panel service not restarted: ${e.message}`));
+        }
+    }
+    log("");
+    // Step 3: Verify Core-owned services
+    log(c.bold("  3. Verifying Core services…"));
+    const port = getCorePort();
+    if (isPortListening(port)) {
+        log(c.green(`     ✓ Core listening on :${port}`));
+    }
+    else {
+        log(c.red(`     ✗ Core not responding on :${port}`));
+        process.exitCode = 1;
+    }
+    log("");
+    if (!process.exitCode) {
+        await inspectSystemDrift();
+        log(c.green("  ✓ System reload complete."));
+    }
+    else {
+        log(c.yellow("  ! System reload completed with warnings. Review output above."));
+    }
+    if (panelStartedOk) {
+        log("");
+        log(c.dim("  Tip: refresh any open JishuShell browser tab to load the updated UI."));
+    }
+    log("");
+}
+export async function runSystem(rest) {
+    const subcmd = rest[0];
+    switch (subcmd) {
+        case "reload":
+            return runSystemReload();
+        case "status":
+            return runStatus();
+        case "reconcile":
+            return runReconcile();
+        case "repair-instances":
+            return runSystemRepairInstances(rest.slice(1));
+        default:
+            log("");
+            log(c.bold("  jishushell system") + " — manage system-level infrastructure");
+            log("");
+            log("  Usage:");
+            log(`    jishushell system ${c.cyan("reload")}      Reconcile host configs and restart Core services`);
+            log(`    jishushell system ${c.cyan("status")}      Show system component health`);
+            log(`    jishushell system ${c.cyan("reconcile")}   Check/fix system drift without restart`);
+            log(`    jishushell system ${c.cyan("repair-instances")} [--dry-run]  Repair runtime instance compatibility`);
+            log("");
+            if (subcmd) {
+                console.error(`Unknown system subcommand: ${subcmd}`);
+                process.exitCode = 1;
+            }
+    }
+}
+export async function runUninstall(rest) {
+    const yes = hasFlag(rest, "--yes", "-y");
+    const { spawnSync } = await import("child_process");
+    const uninstallSh = join(JISHUSHELL_HOME, "install", "post-uninstall.sh");
+    if (!existsSync(uninstallSh)) {
+        console.error(`Uninstall script not found: ${uninstallSh}`);
+        console.error("Please run: sudo bash ~/.jishushell/install/jishu-uninstall.sh --data --yes");
+        process.exit(1);
+    }
+    if (!yes) {
+        const { createInterface } = await import("readline");
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        await new Promise((resolve) => {
+            rl.question("This will stop all services, remove auto-start and delete ~/.jishushell. Continue? [y/N] ", (ans) => {
+                rl.close();
+                if (ans.toLowerCase() !== "y") {
+                    console.log("Cancelled.");
+                    process.exit(0);
+                }
+                resolve();
+            });
+        });
+    }
+    const cleanResult = spawnSync("bash", [uninstallSh], { stdio: "inherit" });
+    const npmResult = spawnSync("npm", ["uninstall", "-g", "jishushell"], { stdio: "inherit" });
+    process.exit((cleanResult.status ?? 0) || (npmResult.status ?? 0));
+}
+// ── Unified entry point ─────────────────────────────────────────────────────
+export function printHelp() {
+    console.log(`
+Usage: jishushell <command> [options]
+
+Core commands:
+  start   [--port N]              启动 core
+  stop    [--jobs]                停止 core（--jobs 同时停止所有实例）
+  restart [--port N]              重启 core
+  status                          Core 状态总览
+  serve   [--port N] [--host H]   前台运行 core；GUI 包无 --port 时启动 Panel 入口
+  onboard [--pass P]              初始化密码向导
+  reset                           重置 core 数据
+  config  [key] [value]           查看或修改配置项
+  update-check                    检查新版本
+  upgrade status|finalize         查看或完成兼容升级 finalization
+  repair [status|--yes]           检查或修复本机 JishuShell 框架状态
+  version | --version | -v        显示 CLI 版本
+  install [options]               安装服务（systemd / Docker / 直接运行）
+  uninstall [--yes]               卸载 core 及所有数据
+  reconcile                       对账系统组件（systemd/Docker 镜像/Nomad）
+
+System commands:
+  system reload                   对账宿主机配置并重启 core/Panel
+  system status                   系统组件健康检查
+  system reconcile                只对账，不重启
+  system repair-instances         修复 runtime 实例兼容状态（不自动重启实例）
+
+Run 'jishushell <command> help' for details.
+`);
+}
+export async function run(rest) {
+    const cmd = rest[0];
+    const args = rest.slice(1);
+    switch (cmd) {
+        case "start": return runStart(args);
+        case "stop": return runStop(args);
+        case "restart": return runRestart(args);
+        case "status": return runStatus();
+        case "serve": return runServe(args);
+        case "onboard": return runOnboard(args);
+        case "reset": return runReset(args);
+        case "update-check": return runUpdateCheck();
+        case "upgrade": return runUpgrade(args);
+        case "repair": return runRepair(args);
+        case "config": return runConfig(args);
+        case "version":
+        case "--version":
+        case "-v":
+            console.log(getCliVersion());
+            return;
+        case "install": return runInstallCmd(args);
+        case "uninstall": return runUninstall(args);
+        case "reconcile": return runReconcile();
+        case "system": return runSystem(args);
+        case "help":
+        case "--help":
+        case "-h":
+            printHelp();
+            return;
+        default:
+            printHelp();
+            if (cmd) {
+                console.error(`Unknown core command: ${cmd}`);
+                process.exit(1);
+            }
+    }
+}
+export async function dispatch(argv) {
+    const cmd = argv[0];
+    if (!cmd || ![
+        "install",
+        "uninstall",
+        "reconcile",
+        "system",
+        "start",
+        "stop",
+        "restart",
+        "status",
+        "serve",
+        "onboard",
+        "reset",
+        "update-check",
+        "upgrade",
+        "repair",
+        "config",
+        "version",
+        "--version",
+        "-v",
+    ].includes(cmd)) {
+        return false;
+    }
+    await run(argv);
+    return true;
+}
+//# sourceMappingURL=core.js.map