jishushell 0.5.22 → 0.6.5

package/dist/cli/{panel.js → core.js}

@@ -1,24 +1,38 @@
 /**
- * src/cli/panel.ts
- * Unified panel management module — covers start/stop/restart/status/serve/
+ * src/cli/core.ts
+ * Unified core management module — covers start/stop/restart/status/serve/
  * onboard/reset/update/config/install/uninstall.
  *
  * Dependency hierarchy:
- *   cli/panel.ts  →  services/panel-manager.ts  (pure logic, no I/O)
- *   cli/panel.ts  →  services/nomad-manager.ts  (instance management, no I/O)
+ *   cli/core.ts  →  services/core-manager.ts  (pure logic, no I/O)
+ *   cli/core.ts  →  services/nomad-manager.ts  (instance management, no I/O)
  * All terminal output/formatting lives in this file.
  */
 import { execSync, execFileSync } from "child_process";
 import { existsSync, readFileSync, unlinkSync } from "fs";
-import { join } from "path";
+import { dirname, join } from "path";
 import { networkInterfaces } from "os";
+import { fileURLToPath, pathToFileURL } from "url";
 import { parsePort, hasFlag } from "./helpers.js";
-import { detectRunMode, getPanelPort, isPortListening, readAlivePid, systemdStatus, startPanel, stopPanel, restartPanel, } from "../services/panel-manager.js";
+import { detectRunMode, getCorePort, isPortListening, readAlivePid, systemdStatus, startCore, stopCore, restartCore, killPortProcess, waitForPortOpen, } from "../services/core-manager.js";
 import { checkUpdate, upgradePackage, scheduleRestart, getInstalledGlobalVersion, isVersionAtLeast, markUpdateRestarting, markUpdateFailed, } from "../services/update-manager.js";
 import { listInstanceIds, readInstanceMeta, stopNomadJobInstance, getInstanceStatus, ensureNomadToken, isAppJob, } from "../services/nomad-manager.js";
-import { JISHUSHELL_HOME, getPanelConfig, getNomadToken, getNomadAddr, savePanelConfig } from "../config.js";
+import { JISHUSHELL_HOME, getCoreConfig, getNomadToken, getNomadAddr, saveCoreConfig, setOpenclawDockerImage } from "../config.js";
 import { isInitialized, initPassword, resetPassword } from "../auth.js";
-const DEFAULT_PORT = 8090;
+const DEFAULT_PORT = 8091;
+const DEFAULT_PANEL_PORT = 8090;
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+function resolveBundledPanelServerBin() {
+    const packageRoot = join(__dirname, "..", "..");
+    const candidates = [
+        process.env.JISHUSHELL_PANEL_BIN,
+        join(packageRoot, "node_modules", "jishushell-panel", "output", "dist", "server.js"),
+    ]
+        .map((candidate) => candidate?.trim())
+        .filter((candidate) => Boolean(candidate));
+    return candidates.find((candidate) => existsSync(candidate)) ?? null;
+}
 // ── ANSI colours (CLI-only, stripped when not a TTY) ──────────────────────
 const isTTY = process.stdout.isTTY ?? false;
 const c = {
@@ -30,6 +44,11 @@ const c = {
     dim: (s) => isTTY ? `\x1b[2m${s}\x1b[0m` : s,
 };
 function log(msg) { process.stdout.write(msg + "\n"); }
+function fmtTimeoutSeconds(timeoutMs) {
+    if (!timeoutMs || timeoutMs <= 0)
+        return 10;
+    return Math.ceil(timeoutMs / 1000);
+}
 export function getCliVersion() {
     if (process.env.npm_package_version) {
         return `v${process.env.npm_package_version}`;
@@ -44,27 +63,23 @@ export function getCliVersion() {
     }
     return "unknown";
 }
-// ── Panel process lifecycle ─────────────────────────────────────────────────
+// ── Core process lifecycle ──────────────────────────────────────────────────
 export async function runStart(rest) {
-    const result = await startPanel(parsePort(rest));
+    const result = await startCore(parsePort(rest));
     if (result.alreadyRunning) {
         log(c.yellow(`! JishuShell is already running on port ${result.port}`));
         log(c.dim(`  Run ${c.bold("jishushell stop")} first, or ${c.bold("jishushell restart")}`));
         return;
     }
     log(c.dim(`  run mode: ${result.mode}  |  port: ${result.port}`));
-    log(c.dim("  Waiting for panel to start…"));
+    log(c.dim("  Waiting for core to start…"));
     if (result.started) {
         log(c.green(`✓ JishuShell started  →  http://localhost:${result.port}`));
     }
     else {
-        log(c.yellow(`! Port ${result.port} still not listening after 10s.`));
-        if (result.logFile) {
-            log(c.dim(`  Check logs: ${result.logFile}`));
-        }
-        else {
-            log(c.dim("  Check logs: journalctl -u jishushell -n 50"));
-        }
+        const timeoutSeconds = fmtTimeoutSeconds(result.startupTimeoutMs);
+        log(c.yellow(`! Port ${result.port} still not listening after ${timeoutSeconds}s.`));
+        log(c.dim(`  Check logs: ${result.logHint}`));
     }
 }
 export async function runStop(rest) {
@@ -90,43 +105,39 @@ export async function runStop(rest) {
             }));
             log("");
         }
-        log(c.dim("  Stopping JishuShell panel…"));
+        log(c.dim("  Stopping JishuShell core…"));
     }
-    const result = await stopPanel();
+    const result = await stopCore();
     log(c.dim(`  run mode: ${result.mode}`));
     log(c.green("✓ JishuShell stopped"));
 }
 export async function runRestart(rest) {
-    const result = await restartPanel(parsePort(rest));
+    const result = await restartCore(parsePort(rest));
     log(c.dim(`  run mode: ${result.mode}  |  port: ${result.port}`));
     if (result.started) {
         log(c.green(`✓ JishuShell restarted  →  http://localhost:${result.port}`));
     }
     else {
-        log(c.yellow("! Panel did not come back up within 10s."));
-        if (result.logFile) {
-            log(c.dim(`  Check logs: ${result.logFile}`));
-        }
-        else {
-            log(c.dim("  Check: journalctl -u jishushell -n 50"));
-        }
+        const timeoutSeconds = fmtTimeoutSeconds(result.startupTimeoutMs);
+        log(c.yellow(`! Core did not come back up within ${timeoutSeconds}s.`));
+        log(c.dim(`  Check logs: ${result.logHint}`));
     }
 }
 // ── status ────────────────────────────────────────────────────────────────
 export async function runStatus() {
     ensureNomadToken();
-    const port = getPanelPort();
+    const port = getCorePort();
     const mode = detectRunMode();
     const nomadAddr = getNomadAddr();
     log("");
     log(c.bold(c.cyan("  JishuShell Status")));
     log(c.dim("  ─────────────────────────────────────────────────────"));
     log("");
-    // ── 1. Panel ──────────────────────────────────────────────────────────
-    log(`  ${c.bold("Panel (CLI)")}`);
-    const panelListening = isPortListening(port);
+    // ── 1. Core ───────────────────────────────────────────────────────────
+    log(`  ${c.bold("Core (CLI)")}`);
+    const coreListening = isPortListening(port);
     const pid = readAlivePid();
-    if (panelListening) {
+    if (coreListening) {
         log(`    ${c.green("●")} ${c.green("running")}  →  port :${port}`);
     }
     else {
@@ -242,6 +253,36 @@ export async function runStatus() {
         }
     }
     log("");
+    // ── 5. System Reconciliation ──────────────────────────────────────────
+    const reconcileStatePath = join(JISHUSHELL_HOME, "reconcile-state.json");
+    if (existsSync(reconcileStatePath)) {
+        try {
+            const state = JSON.parse(readFileSync(reconcileStatePath, "utf-8"));
+            const issues = (state.items || []).filter((i) => i.status === "error" || (i.status !== "ok" && (i.requiresSudo || i.reloadRequired || i.manualRequired)));
+            if (issues.length > 0) {
+                log(`  ${c.bold("System Reconciliation")}  ${c.yellow("⚠ " + issues.length + " issue(s)")}`);
+                for (const item of issues) {
+                    const icon = item.status === "error" ? c.red("✗") : c.yellow("!");
+                    log(`    ${icon}  ${c.bold(item.component)}  ${item.message}`);
+                    if (item.command)
+                        log(`       ${c.dim("→")} ${c.cyan(item.command)}`);
+                }
+                log("");
+            }
+            const runtimeAdvisories = Array.isArray(state.runtime?.instances) ? state.runtime.instances : [];
+            if (runtimeAdvisories.length > 0) {
+                log(`  ${c.bold("Runtime Advisories")}  ${c.yellow("⚠ " + runtimeAdvisories.length + " instance(s)")}`);
+                for (const item of runtimeAdvisories) {
+                    const status = item.currentStatus ? c.dim(` (${item.currentStatus})`) : "";
+                    log(`    ${c.yellow("!")}  ${c.bold(item.instanceId)} needs ${item.action || "restart"}${status}`);
+                    if (item.command)
+                        log(`       ${c.dim("→")} ${c.cyan(item.command)}`);
+                }
+                log("");
+            }
+        }
+        catch { /* ignore corrupt state file */ }
+    }
 }
 // ── onboard ───────────────────────────────────────────────────────────────
 function getLocalIP() {
@@ -313,16 +354,16 @@ export async function runOnboard(rest) {
     log(c.bold(c.cyan("  JishuShell Onboard")));
     log(c.dim("  ─────────────────────────────────────────"));
     log("");
-    const cfg = getPanelConfig();
+    const cfg = getCoreConfig();
     if (!cfg.service_manager) {
         log(c.red("  ✗  JishuShell is not installed yet."));
         log(c.dim("  Run ") + c.bold("jishushell install") + c.dim(" first."));
         log("");
         process.exit(1);
     }
-    const port = getPanelPort();
+    const port = getCorePort();
     if (!isPortListening(port)) {
-        log(c.yellow(`  !  Panel is not running on port ${port}.`));
+        log(c.yellow(`  !  Core is not running on port ${port}.`));
         log(c.dim("  Start it with: ") + c.bold("jishushell start"));
         log("");
         process.exit(1);
@@ -332,7 +373,7 @@ export async function runOnboard(rest) {
         const ip = getLocalIP();
         log(c.green("  ✓  JishuShell is already onboarded."));
         log("");
-        log(`  Panel:  ${c.bold(c.cyan(`http://${ip}:${port}`))}`);
+        log(`  Core:   ${c.bold(c.cyan(`http://${ip}:${port}`))}`);
         log(`  Local:  ${c.bold(c.cyan(`http://localhost:${port}`))}`);
         log("");
         log(c.dim("  Tip: ") + c.bold("jishushell onboard --force") + c.dim(" resets the admin password."));
@@ -390,10 +431,10 @@ export async function runOnboard(rest) {
     log("");
     log(c.bold(c.green("  ✓  Onboarding complete!")));
     log("");
-    log(`  Open your browser:  ${c.bold(c.cyan(`http://${ip}:${port}`))}`);
-    log(`  Or locally:         ${c.bold(c.cyan(`http://localhost:${port}`))}`);
+    log(`  Core API:  ${c.bold(c.cyan(`http://${ip}:${port}`))}`);
+    log(`  Local:     ${c.bold(c.cyan(`http://localhost:${port}`))}`);
     log("");
-    log(c.dim("  Log in with your password, then configure your LLM provider in Settings."));
+    log(c.dim("  Use panel or direct core API calls to configure LLM providers and instances."));
     log("");
 }
 // ── reset ─────────────────────────────────────────────────────────────────
@@ -407,12 +448,12 @@ export async function runReset(rest) {
     log("  This will:");
     log(`    ${c.dim("•")} Stop all instances and purge them from the scheduler`);
     log(`    ${c.dim("•")} Delete all instance directories (~/.jishushell/instances/)`);
-    log(`    ${c.dim("•")} Stop the JishuShell panel`);
+    log(`    ${c.dim("•")} Stop the JishuShell core`);
     log(`    ${c.dim("•")} Reset auth credentials and LLM provider config`);
     log(`    ${c.dim("•")} Preserve infrastructure config (Docker image, service manager, port)`);
     log("");
     log(`  ${c.bold(c.yellow("Custom openclaw_home paths outside ~/.jishushell are NOT removed."))}`);
-    log(`  ${c.dim("After reset: restart the panel and open")} ${c.bold(`http://localhost:${getPanelPort()}`)} ${c.dim("to reconfigure.")}`);
+    log(`  ${c.dim("After reset: restart the core at")} ${c.bold(`http://localhost:${getCorePort()}`)} ${c.dim("and reconfigure through panel or core API.")}`);
     log("");
     if (!yes) {
         if (!process.stdin.isTTY) {
@@ -487,35 +528,35 @@ export async function runReset(rest) {
             }
         }
     }
-    // 2. Stop panel
-    const port = getPanelPort();
+    // 2. Stop core
+    const port = getCorePort();
     if (isPortListening(port)) {
-        log(c.dim("  Stopping panel…"));
+        log(c.dim("  Stopping core…"));
         try {
-            await stopPanel();
+            await stopCore();
         }
         catch { /* best-effort */ }
     }
-    // 3. Selectively clear panel.json: preserve infrastructure settings
-    //    (service_manager, nomad_driver, openclaw_image, nomad_token, panel_port,
+    // 3. Selectively clear core.json: preserve infrastructure settings
+    //    (service_manager, nomad_driver, runtime_catalog, nomad_token, core_port,
     //    npm_registry) so the user does NOT need to reinstall Docker/Nomad/OpenClaw.
-    //    Only user-owned fields (default_provider and related LLM config) are cleared.
-    const PANEL_CONFIG = join(JISHUSHELL_HOME, "panel.json");
+    //    User-owned LLM provider settings are cleared.
+    const CORE_CONFIG = join(JISHUSHELL_HOME, "core.json");
     const INFRA_KEYS = new Set([
-        "service_manager", "nomad_driver", "openclaw_image",
-        "nomad_token", "panel_port", "npm_registry",
+        "service_manager", "nomad_driver", "runtime_catalog", "runtime_catalog_schema_version",
+        "nomad_token", "core_port", "npm_registry",
     ]);
     try {
-        const cfg = getPanelConfig();
+        const cfg = getCoreConfig();
         const preserved = {};
         for (const key of Object.keys(cfg)) {
             if (INFRA_KEYS.has(key))
                 preserved[key] = cfg[key];
         }
-        savePanelConfig(preserved);
-        log(`    ${c.green("✓")} reset panel config (infrastructure settings preserved)`);
-        // Remove panel.json backups (stale, not needed after a clean reset)
-        for (const f of [`${PANEL_CONFIG}.bak`, `${PANEL_CONFIG}.bak.1`, `${PANEL_CONFIG}.bak.2`]) {
+        saveCoreConfig(preserved);
+        log(`    ${c.green("✓")} reset core config (infrastructure settings preserved)`);
+        // Remove core.json backups (stale, not needed after a clean reset)
+        for (const f of [`${CORE_CONFIG}.bak`, `${CORE_CONFIG}.bak.1`, `${CORE_CONFIG}.bak.2`]) {
             try {
                 if (existsSync(f)) {
                     unlinkSync(f);
@@ -525,7 +566,7 @@ export async function runReset(rest) {
         }
     }
     catch (e) {
-        log(`    ${c.yellow("!")} could not reset panel config: ${e.message}`);
+        log(`    ${c.yellow("!")} could not reset core config: ${e.message}`);
     }
     // 4. Delete auth and secret files
     const AUTH_FILE = join(JISHUSHELL_HOME, "auth.json");
@@ -551,7 +592,7 @@ export async function runReset(rest) {
     log("");
     log(c.bold(c.green("  ✓  Reset complete.")));
     log("");
-    log(`  To reconfigure: restart the panel, then open ${c.bold(`http://localhost:${port}`)}`);
+    log(`  To reconfigure: restart the core at ${c.bold(`http://localhost:${port}`)}, then use panel or core API.`);
     log("");
 }
 // ── update ────────────────────────────────────────────────────────────────
@@ -577,8 +618,34 @@ export async function runUpdate() {
         if (!isVersionAtLeast(installedVersion, expectedVersion)) {
             throw new Error(`npm -g version is still ${installedVersion}, expected at least ${expectedVersion}`);
         }
+        try {
+            const { repairRuntimeInstances, buildRuntimeRestartAdvisories } = await import("../services/runtime-repair.js");
+            const repair = await repairRuntimeInstances();
+            const restartRequired = await buildRuntimeRestartAdvisories(repair.results);
+            if (repair.results.length > 0) {
+                log(c.dim(`  Instance compatibility repair checked ${repair.results.length} runtime instance(s).`));
+            }
+            if (restartRequired.length > 0) {
+                log(c.yellow(`  ${restartRequired.length} runtime instance(s) should be started/restarted after reload.`));
+                for (const item of restartRequired)
+                    log(c.cyan(`    ${item.command}`));
+            }
+            if (!repair.ok) {
+                log(c.yellow("  Instance compatibility repair completed with warnings; run `jishushell system repair-instances` for details."));
+            }
+        }
+        catch (repairError) {
+            log(c.yellow(`  Instance compatibility repair skipped: ${repairError?.message ?? repairError}`));
+        }
         if (trackedWebUpdate) {
             markUpdateRestarting(expectedVersion, trackedCurrentVersion, installedVersion);
+            try {
+                const { inspectSystemDrift } = await import("../services/system-reconciler.js");
+                await inspectSystemDrift();
+            }
+            catch {
+                // The restarted core will run reconciliation again; update success does not depend on this hint.
+            }
         }
     }
     catch (err) {
@@ -589,18 +656,16 @@ export async function runUpdate() {
         throw err;
     }
     log(c.green("  ✓  Package updated."));
-    log(c.dim("  Scheduling panel restart in 2 s…"));
+    log(c.dim("  Scheduling core restart in 2 s…"));
     scheduleRestart(2000);
-    log(c.green("  ✓  Restart scheduled — panel will reconnect shortly."));
+    log(c.green("  ✓  Restart scheduled — core will reconnect shortly."));
 }
 // ── serve: foreground server (systemd/launchd ExecStart) ────────────────────
 export async function runServe(rest) {
-    const { createServer } = await import("../server.js");
-    const { getPanelConfig } = await import("../config.js");
-    // Priority: --port flag > panel.json panel_port > 8090
-    const config = getPanelConfig();
-    let port = Number(config.panel_port) || DEFAULT_PORT;
+    // Priority: --port flag > core.json core_port > default core port
+    let port;
     let host = "0.0.0.0";
+    let coreOnly = process.env.JISHUSHELL_SERVE_CORE_ONLY === "1";
     for (let i = 0; i < rest.length; i++) {
         let portVal;
         if (rest[i] === "--port" && rest[i + 1]) {
@@ -615,6 +680,9 @@ export async function runServe(rest) {
         else if (rest[i].startsWith("--host=")) {
             host = rest[i].slice("--host=".length);
         }
+        else if (rest[i] === "--core-only") {
+            coreOnly = true;
+        }
         if (portVal !== undefined) {
             const parsed = parseInt(portVal, 10);
             if (isNaN(parsed) || parsed < 0 || parsed > 65535) {
@@ -624,13 +692,33 @@ export async function runServe(rest) {
             port = parsed;
         }
     }
-    await createServer({ port, host });
+    const panelServerBin = resolveBundledPanelServerBin();
+    const panelPort = Number(process.env.JISHUSHELL_PANEL_PORT) || DEFAULT_PANEL_PORT;
+    const legacySingleServicePanelFallback = process.env.JISHUSHELL_LEGACY_SINGLE_SERVICE_PANEL_FALLBACK !== "0";
+    const shouldServePanel = !coreOnly && panelServerBin && (port === undefined ||
+        (legacySingleServicePanelFallback && port === panelPort));
+    if (shouldServePanel) {
+        const panelModule = await import(pathToFileURL(panelServerBin).href);
+        const corePort = Number(process.env.JISHUSHELL_CORE_PORT) || Number(getCoreConfig().core_port) || DEFAULT_PORT;
+        const coreBaseUrl = process.env.JISHUSHELL_CORE_BASE_URL || `http://127.0.0.1:${corePort}`;
+        const panel = await panelModule.createServer({
+            host,
+            port: port ?? panelPort,
+            coreBaseUrl,
+            manageCore: process.env.JISHUSHELL_PANEL_MANAGE_CORE === "0" ? false : undefined,
+        });
+        await panel.listen();
+        return;
+    }
+    const { createServer } = await import("../server.js");
+    const config = getCoreConfig();
+    await createServer({ port: port ?? (Number(config.core_port) || DEFAULT_PORT), host });
 }
-// ── config: panel.json read/write ───────────────────────────────────────────
+// ── config: core.json read/write ───────────────────────────────────────────
 export async function runConfig(rest) {
     const cfgCmd = rest[0];
     if (cfgCmd === "get") {
-        const cfg = getPanelConfig();
+        const cfg = getCoreConfig();
         const key = rest[1];
         if (key) {
             const val = cfg[key];
@@ -646,7 +734,7 @@ export async function runConfig(rest) {
         }
     }
     else if (cfgCmd === "set" && rest[1] && rest[2]) {
-        const ALLOWED_KEYS = ["service_manager", "nomad_driver", "openclaw_image", "panel_port", "npm_registry"];
+        const ALLOWED_KEYS = ["service_manager", "nomad_driver", "openclaw_runtime_image", "core_port", "npm_registry"];
         const key = rest[1];
         const value = rest[2];
         if (!ALLOWED_KEYS.includes(key)) {
@@ -655,10 +743,15 @@ export async function runConfig(rest) {
             process.exitCode = 1;
             return;
         }
-        const cfg = getPanelConfig();
-        const numVal = parseInt(value, 10);
-        cfg[key] = !isNaN(numVal) && String(numVal) === value ? numVal : value;
-        savePanelConfig(cfg);
+        if (key === "openclaw_runtime_image") {
+            setOpenclawDockerImage(value);
+        }
+        else {
+            const cfg = getCoreConfig();
+            const numVal = parseInt(value, 10);
+            cfg[key] = !isNaN(numVal) && String(numVal) === value ? numVal : value;
+            saveCoreConfig(cfg);
+        }
         log(c.green(`  ✓  ${key} = ${value}`));
     }
     else {
@@ -672,28 +765,368 @@ Commands:
 Allowed keys:
   service_manager    服务管理器类型（nomad / process）
   nomad_driver       Nomad driver（docker）
-  openclaw_image     OpenClaw Docker 镜像
-  panel_port         面板端口
+  openclaw_runtime_image
+                     OpenClaw runtime Docker 镜像
+  core_port          Core server 端口
   npm_registry       npm 镜像源
 
 Examples:
   jishushell config get
-  jishushell config get panel_port
-  jishushell config set panel_port 8090
+  jishushell config get core_port
+  jishushell config set core_port 8091
 `);
         if (cfgCmd)
             process.exit(1);
     }
 }
-// ── install / uninstall ──────────────────────────────────────────────────────
+// ── install / uninstall / reconcile ──────────────────────────────────────────
 export function brief() {
-    return "  start|stop|restart|status|serve|onboard         面板生命周期与运行管理\n  reset|config|update|version|install|uninstall    面板维护、版本与安装";
+    return "  start|stop|restart|status|serve|onboard         Core 生命周期与运行管理\n  reset|config|update|version|install|uninstall    Core 维护、版本与安装\n  reconcile                                        对账系统组件";
 }
 export async function runInstallCmd(rest) {
     const { runInstall, parseInstallArgs } = await import("../install.js");
     const opts = parseInstallArgs(rest);
     await runInstall(opts);
 }
+export async function runReconcile() {
+    const { reconcileSystem } = await import("../services/system-reconciler.js");
+    log("");
+    log(c.bold("  Reconciling system components…"));
+    log("");
+    const result = await reconcileSystem();
+    for (const item of result.items) {
+        const icon = item.status === "ok" ? c.green("✓")
+            : item.status === "updated" ? c.cyan("↻")
+                : item.status === "skipped" ? c.dim("·")
+                    : c.red("✗");
+        const suffix = item.requiresSudo ? c.yellow(" [needs sudo]") : "";
+        log(`  ${icon}  ${c.bold(item.component)}  ${item.message}${suffix}`);
+        if (item.command && item.status !== "ok") {
+            log(`       ${c.dim("→")} ${c.cyan(item.command)}`);
+        }
+        if (item.details && item.status === "error") {
+            log(`       ${c.dim(item.details)}`);
+        }
+    }
+    log("");
+    const errors = result.items.filter(i => i.status === "error");
+    const updated = result.items.filter(i => i.status === "updated");
+    const needsSudo = result.items.filter(i => i.requiresSudo && i.status !== "ok" && i.status !== "updated");
+    if (errors.length > 0) {
+        log(c.red(`  ${errors.length} component(s) had errors.`));
+        process.exitCode = 1;
+    }
+    if (needsSudo.length > 0 && process.getuid?.() !== 0) {
+        log(c.yellow(`  ${needsSudo.length} item(s) require sudo. Run:`));
+        log(c.cyan(`    ${result.command}`));
+        process.exitCode = 1;
+    }
+    else if (result.reloadRequired) {
+        log(c.yellow("  System files were updated; restart services to activate them:"));
+        log(c.cyan(`    ${result.command}`));
+    }
+    else if (updated.length > 0) {
+        log(c.green(`  ${updated.length} component(s) updated.`));
+    }
+    else if (errors.length === 0) {
+        log(c.green("  All system components are up-to-date."));
+    }
+    log("");
+}
+// ── system subcommand group ───────────────────────────────────────────────
+async function runSystemRepairInstances(rest) {
+    const dryRun = hasFlag(rest, "--dry-run");
+    log("");
+    log(c.bold("  JishuShell Instance Compatibility Repair"));
+    log(c.dim("  ─────────────────────────────────────────────────────"));
+    log("");
+    const { repairRuntimeInstances } = await import("../services/runtime-repair.js");
+    const result = await repairRuntimeInstances({ dryRun });
+    if (dryRun)
+        log(c.dim("  Dry run only; no files or Nomad variables were changed."));
+    if (result.results.length === 0) {
+        log(c.green("  ✓ No OpenClaw/Hermes instances found."));
+        log("");
+        return;
+    }
+    for (const item of result.results) {
+        const icon = item.status === "error" ? c.red("✗")
+            : item.status === "needs-restart" ? c.yellow("!")
+                : item.status === "repaired" ? c.cyan("↻")
+                    : item.status === "manual" ? c.yellow("·")
+                        : c.green("✓");
+        log(`  ${icon} ${item.instanceId} (${item.agentType}) — ${item.status}`);
+        for (const repaired of item.repaired)
+            log(c.dim(`      repaired: ${repaired}`));
+        for (const warning of item.warnings)
+            log(c.yellow(`      warning: ${warning}`));
+        if (item.reason)
+            log(c.yellow(`      restart required: ${item.reason}`));
+        if (item.error)
+            log(c.red(`      error: ${item.error}`));
+    }
+    if (!result.ok)
+        process.exitCode = 1;
+    log("");
+}
+async function runSystemReload(rest = []) {
+    const restartInstances = hasFlag(rest, "--restart-instances");
+    let pendingInstanceRestarts = false;
+    let runtimeAdvisoriesKnown = false;
+    let runtimeAdvisories = [];
+    log("");
+    log(c.bold("  JishuShell System Reload"));
+    log(c.dim("  ─────────────────────────────────────────────────────"));
+    log("");
+    // Step 1: Reconcile
+    log(c.bold("  1. Reconciling system components…"));
+    const { reconcileSystem, inspectSystemDrift } = await import("../services/system-reconciler.js");
+    const result = await reconcileSystem();
+    const errors = result.items.filter(i => i.status === "error");
+    const updated = result.items.filter(i => i.status === "updated");
+    const needsSudo = result.items.filter(i => i.requiresSudo && i.status !== "ok" && i.status !== "updated");
+    for (const item of result.items) {
+        if (item.status === "ok")
+            continue;
+        const icon = item.status === "updated" ? c.cyan("↻")
+            : item.status === "skipped" ? c.dim("·")
+                : c.red("✗");
+        const suffix = item.requiresSudo ? c.yellow(" [needs sudo]") : "";
+        log(`     ${icon}  ${item.component}: ${item.message}${suffix}`);
+    }
+    if (updated.length > 0) {
+        log(c.green(`     ✓ ${updated.length} component(s) updated`));
+    }
+    if (errors.length > 0) {
+        log(c.red(`     ✗ ${errors.length} component(s) had errors`));
+        process.exitCode = 1;
+    }
+    if (needsSudo.length > 0 && process.getuid?.() !== 0) {
+        log(c.yellow(`     ! ${needsSudo.length} item(s) require sudo — re-run with sudo`));
+        log("");
+        process.exitCode = 1;
+        return;
+    }
+    log("");
+    // Step 2: Repair runtime instance compatibility
+    log(c.bold("  2. Repairing runtime instance compatibility…"));
+    let repairResults = [];
+    try {
+        const { repairRuntimeInstances, buildRuntimeRestartAdvisories } = await import("../services/runtime-repair.js");
+        const repair = await repairRuntimeInstances();
+        repairResults = repair.results;
+        runtimeAdvisories = await buildRuntimeRestartAdvisories(repair.results);
+        runtimeAdvisoriesKnown = true;
+        pendingInstanceRestarts = runtimeAdvisories.length > 0;
+        if (repair.results.length === 0) {
+            log(c.green("     ✓ No OpenClaw/Hermes instances found"));
+        }
+        let printedRepairDetail = false;
+        for (const item of repair.results) {
+            if (item.status === "ok")
+                continue;
+            printedRepairDetail = true;
+            if (item.status === "error") {
+                log(`     ${c.red("✗")}  ${item.instanceId}: repair failed`);
+            }
+            else if (item.status === "manual") {
+                log(`     ${c.yellow("·")}  ${item.instanceId}: manual compatibility check required`);
+            }
+            else {
+                const repaired = item.repaired.length > 0
+                    ? `repaired ${item.repaired.join(", ")}`
+                    : "compatibility checked";
+                log(`     ${c.green("✓")}  ${item.instanceId}: ${repaired}`);
+            }
+            for (const warning of item.warnings) {
+                if (warning.startsWith("note:")) {
+                    log(c.dim(`        ${warning}`));
+                }
+                else {
+                    log(c.yellow(`        warning: ${warning}`));
+                }
+            }
+            if (item.error)
+                log(c.red(`        error: ${item.error}`));
+        }
+        if (repair.results.length > 0 && !printedRepairDetail) {
+            log(c.green("     ✓ No runtime compatibility repairs needed"));
+        }
+        if (runtimeAdvisories.length > 0) {
+            log(c.yellow(`     → ${runtimeAdvisories.length} instance(s) need a manual restart — see step 4`));
+        }
+        if (!repair.ok)
+            process.exitCode = 1;
+    }
+    catch (e) {
+        log(c.yellow(`     ! Instance compatibility repair skipped: ${e?.message ?? e}`));
+        process.exitCode = 1;
+    }
+    log("");
+    // Step 3: Restart services
+    log(c.bold("  3. Restarting services…"));
+    let panelStartedOk = false;
+    try {
+        const restartResult = await restartCore();
+        if (restartResult.started) {
+            log(c.green(`     ✓ JishuShell running  →  http://localhost:${restartResult.port}`));
+        }
+        else {
+            const timeoutSeconds = fmtTimeoutSeconds(restartResult.startupTimeoutMs);
+            log(c.yellow(`     ! JishuShell did not respond within ${timeoutSeconds}s`));
+            log(c.dim(`       Check logs: ${restartResult.logHint}`));
+        }
+    }
+    catch (e) {
+        log(c.red(`     ✗ Restart failed: ${e.message}`));
+        process.exitCode = 1;
+    }
+    if (process.platform !== "darwin") {
+        try {
+            execFileSync("systemctl", ["cat", "jishushell-panel"], { stdio: "ignore", timeout: 5000 });
+            const panelPort = Number(process.env.JISHUSHELL_PANEL_PORT) || 8090;
+            try {
+                execFileSync("systemctl", ["stop", "jishushell-panel"], { stdio: "ignore", timeout: 10000 });
+            }
+            catch { }
+            if (isPortListening(panelPort)) {
+                killPortProcess(panelPort);
+                for (let i = 0; i < 20 && isPortListening(panelPort); i++) {
+                    await new Promise((r) => setTimeout(r, 250));
+                }
+            }
+            execFileSync("systemctl", ["reset-failed", "jishushell-panel"], { stdio: "ignore", timeout: 5000 });
+            execFileSync("systemctl", ["start", "jishushell-panel"], { stdio: "ignore", timeout: 10000 });
+            const panelStarted = await waitForPortOpen(panelPort, 30000);
+            if (panelStarted) {
+                log(c.green(`     ✓ Panel running       →  http://localhost:${panelPort}`));
+                panelStartedOk = true;
+            }
+            else {
+                log(c.yellow(`     ! Panel did not respond on :${panelPort}`));
+            }
+        }
+        catch (e) {
+            log(c.dim(`     · Panel service not restarted: ${e.message}`));
+        }
+    }
+    log("");
+    // Step 4: Persist and report runtime instance advisories
+    log(c.bold("  4. Next actions for instances…"));
+    if (!runtimeAdvisoriesKnown) {
+        log(c.yellow("     ! Runtime instance advisories were not refreshed"));
+    }
+    else if (!pendingInstanceRestarts) {
+        log(c.green("     ✓ No instance start/restart actions required"));
+    }
+    else {
+        if (!restartInstances) {
+            log(c.yellow("     Restart these instances when they are idle:"));
+            log("");
+            for (const item of runtimeAdvisories) {
+                const status = item.currentStatus ? c.dim(` (currently ${item.currentStatus})`) : "";
+                log(`     ${c.yellow("·")}  ${item.instanceId}: ${item.action}${status}`);
+                log(c.cyan(`         ${item.command}`));
+            }
+            log("");
+            log(c.dim("     Note: system reload does not start or restart app instances automatically."));
+        }
+        else {
+            try {
+                const { restartRuntimeInstances } = await import("../services/runtime-repair.js");
+                const restart = await restartRuntimeInstances(repairResults);
+                const restartedIds = new Set();
+                for (const item of restart.results) {
+                    const icon = item.status === "restarted" ? c.green("✓")
+                        : item.status === "skipped" ? c.dim("·")
+                            : c.red("✗");
+                    const suffix = item.previousStatus ? c.dim(` (was ${item.previousStatus})`) : "";
+                    log(`     ${icon}  ${item.instanceId}: ${item.status}${suffix}`);
+                    if (item.status === "restarted")
+                        restartedIds.add(item.instanceId);
+                    if (item.reason)
+                        log(c.dim(`        ${item.reason}`));
+                    if (item.error)
+                        log(c.red(`        error: ${item.error}`));
+                }
+                if (!restart.ok)
+                    process.exitCode = 1;
+                runtimeAdvisories = runtimeAdvisories.filter((item) => !restartedIds.has(item.instanceId));
+                pendingInstanceRestarts = runtimeAdvisories.length > 0;
+            }
+            catch (e) {
+                log(c.red(`     ✗ Runtime instance restart failed: ${e?.message ?? e}`));
+                process.exitCode = 1;
+            }
+        }
+    }
+    if (runtimeAdvisoriesKnown) {
+        try {
+            const { persistRuntimeRestartAdvisories } = await import("../services/system-reconciler.js");
+            await persistRuntimeRestartAdvisories(runtimeAdvisories);
+        }
+        catch (e) {
+            log(c.yellow(`     ! Runtime advisory state not persisted: ${e?.message ?? e}`));
+        }
+    }
+    log("");
+    // Step 5: Verify
+    log(c.bold("  5. Verifying…"));
+    const port = getCorePort();
+    if (isPortListening(port)) {
+        log(c.green(`     ✓ Core listening on :${port}`));
+    }
+    else {
+        log(c.red(`     ✗ Core not responding on :${port}`));
+        process.exitCode = 1;
+    }
+    log("");
+    if (!process.exitCode) {
+        await inspectSystemDrift();
+        if (pendingInstanceRestarts) {
+            log(c.green("  ✓ System reload complete.") + c.dim(`  (${runtimeAdvisories.length} instance restart(s) still pending — see step 4)`));
+        }
+        else {
+            log(c.green("  ✓ System reload complete."));
+        }
+    }
+    else {
+        log(c.yellow("  ! System reload completed with warnings. Review output above."));
+    }
+    if (panelStartedOk) {
+        log("");
+        log(c.dim("  Tip: refresh any open JishuShell browser tab to load the updated"));
+        log(c.dim("       UI and see pending instance restart prompts."));
+    }
+    log("");
+}
+export async function runSystem(rest) {
+    const subcmd = rest[0];
+    switch (subcmd) {
+        case "reload":
+            return runSystemReload(rest.slice(1));
+        case "status":
+            return runStatus();
+        case "reconcile":
+            return runReconcile();
+        case "repair-instances":
+            return runSystemRepairInstances(rest.slice(1));
+        default:
+            log("");
+            log(c.bold("  jishushell system") + " — manage system-level infrastructure");
+            log("");
+            log("  Usage:");
+            log(`    jishushell system ${c.cyan("reload")} [--restart-instances]  Reconcile configs, restart services, and report runtime advisories`);
+            log(`    jishushell system ${c.cyan("status")}      Show system component health`);
+            log(`    jishushell system ${c.cyan("reconcile")}   Check/fix system drift without restart`);
+            log(`    jishushell system ${c.cyan("repair-instances")} [--dry-run]  Repair runtime instance compatibility`);
+            log("");
+            if (subcmd) {
+                console.error(`Unknown system subcommand: ${subcmd}`);
+                process.exitCode = 1;
+            }
+    }
+}
 export async function runUninstall(rest) {
     const yes = hasFlag(rest, "--yes", "-y");
     const { spawnSync } = await import("child_process");
@@ -726,20 +1159,28 @@ export function printHelp() {
     console.log(`
 Usage: jishushell <command> [options]
 
-Panel commands:
-  start   [--port N]              启动面板
-  stop    [--jobs]                停止面板（--jobs 同时停止所有实例）
-  restart [--port N]              重启面板
-  status                          面板状态总览
-  serve   [--port N] [--host H]   前台运行（适合 Docker 等场景）
+Core commands:
+  start   [--port N]              启动 core
+  stop    [--jobs]                停止 core（--jobs 同时停止所有实例）
+  restart [--port N]              重启 core
+  status                          Core 状态总览
+  serve   [--port N] [--host H]   前台运行 core；GUI 包无 --port 时启动 Panel 入口
   onboard [--pass P]              初始化密码向导
-  reset                           重置面板数据
+  reset                           重置 core 数据
   config  [key] [value]           查看或修改配置项
   update-check                    检查新版本
   update                          升级到最新版本
   version | --version | -v        显示 CLI 版本
   install [options]               安装服务（systemd / Docker / 直接运行）
-  uninstall [--yes]               卸载面板及所有数据
+  uninstall [--yes]               卸载 core 及所有数据
+  reconcile                       对账系统组件（systemd/Docker 镜像/Nomad）
+
+System commands:
+  system reload [--restart-instances]
+                                  重载系统配置并重启 core/Panel；默认只提示受影响实例
+  system status                   系统组件健康检查
+  system reconcile                只对账，不重启
+  system repair-instances         修复 runtime 实例兼容状态（不自动重启实例）
 
 Run 'jishushell <command> help' for details.
 `);
@@ -765,6 +1206,8 @@ export async function run(rest) {
             return;
         case "install": return runInstallCmd(args);
         case "uninstall": return runUninstall(args);
+        case "reconcile": return runReconcile();
+        case "system": return runSystem(args);
         case "help":
         case "--help":
         case "-h":
@@ -773,7 +1216,7 @@ export async function run(rest) {
         default:
             printHelp();
             if (cmd) {
-                console.error(`Unknown panel command: ${cmd}`);
+                console.error(`Unknown core command: ${cmd}`);
                 process.exit(1);
             }
     }
@@ -783,6 +1226,8 @@ export async function dispatch(argv) {
     if (!cmd || ![
         "install",
         "uninstall",
+        "reconcile",
+        "system",
         "start",
         "stop",
         "restart",
@@ -802,4 +1247,4 @@ export async function dispatch(argv) {
     await run(argv);
     return true;
 }
-//# sourceMappingURL=panel.js.map
+//# sourceMappingURL=core.js.map