jishushell 0.6.18 → 0.7.3

package/apps/immich-container.yaml

@@ -0,0 +1,371 @@
+id: immich-container
+name: Immich
+version: "1.0.2"
+jishushell:
+  min_version: "0.5.15"
+description: "Self-hosted photo and video backup/gallery."
+singleInstance: true
+
+# Converted from https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
+# and https://github.com/immich-app/immich/releases/latest/download/example.env.
+# Compose features that are intentionally normalized here:
+# - env_file/.env values are inlined as explicit env keys because AppSpec has no env_file field.
+# - compose service DNS is preserved through an app-scoped Docker bridge network.
+# - the top-level named volume model-cache is represented as an app-scoped bind mount.
+# - image HEALTHCHECK and command healthcheck entries are not reused by AppSpec.
+# - database shm_size is not expressible as a first-class AppSpec field today.
+
+network:
+  mode: docker-bridge
+  name: "jishushell-${instance.id}"
+
+tasks:
+  - name: database
+    role: sidecar
+    runtime: container
+    image: "ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23"
+    user: "0:0"
+    cap_add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETUID", "SETGID", "SETPCAP"]
+    env:
+      POSTGRES_PASSWORD: "postgres"
+      POSTGRES_USER: "postgres"
+      POSTGRES_DB: "immich"
+      POSTGRES_INITDB_ARGS: "--data-checksums"
+    resources:
+      cpu: "700m"
+      memory: "1024Mi"
+    ports:
+      - name: pg
+        port: 5432
+        visibility: internal
+    volumes:
+      - source: "~/.jishushell/apps/${instance.id}/postgres"
+        target: "/var/lib/postgresql/data"
+
+  - name: redis
+    role: sidecar
+    runtime: container
+    image: "docker.io/valkey/valkey:9@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9"
+    user: "0:0"
+    cap_add: ["CHOWN", "SETUID", "SETGID"]
+    resources:
+      cpu: "100m"
+      memory: "128Mi"
+    ports:
+      - name: redis
+        port: 6379
+        visibility: internal
+
+  - name: immich-machine-learning
+    role: sidecar
+    runtime: container
+    image: "ghcr.io/immich-app/immich-machine-learning:v2"
+    user: "0:0"
+    cap_add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETUID", "SETGID", "SETPCAP", "NET_BIND_SERVICE"]
+    env:
+      UPLOAD_LOCATION: "./library"
+      DB_DATA_LOCATION: "./postgres"
+      TZ: "Asia/Shanghai"
+      IMMICH_VERSION: "v2"
+      DB_PASSWORD: "postgres"
+      DB_USERNAME: "postgres"
+      DB_DATABASE_NAME: "immich"
+    resources:
+      cpu: "1000m"
+      memory: "1536Mi"
+    ports:
+      - name: ml-http
+        port: 3003
+        visibility: internal
+    volumes:
+      - source: "~/.jishushell/apps/${instance.id}/model-cache"
+        target: "/cache"
+
+  - name: immich-server
+    role: service
+    runtime: container
+    image: "ghcr.io/immich-app/immich-server:v2"
+    user: "0:0"
+    cap_add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETUID", "SETGID", "SETPCAP", "NET_BIND_SERVICE"]
+    env:
+      UPLOAD_LOCATION: "./library"
+      DB_DATA_LOCATION: "./postgres"
+      TZ: "Asia/Shanghai"
+      IMMICH_VERSION: "v2"
+      DB_PASSWORD: "postgres"
+      DB_USERNAME: "postgres"
+      DB_DATABASE_NAME: "immich"
+    resources:
+      cpu: "1200m"
+      memory: "1536Mi"
+    ports:
+      - name: http
+        port: 2283
+        container_port: 2283
+        visibility: external
+    volumes:
+      - source: "~/.jishushell/apps/${instance.id}/library"
+        target: "/data"
+      - source: "~/.jishushell/files/photos/library"
+        target: "/external/photos"
+        readonly: true
+      - source: "/etc/localtime"
+        target: "/etc/localtime"
+        readonly: true
+    health:
+      http:
+        path: /api/server/ping
+        port: 2283
+      interval: "15s"
+      timeout: "5s"
+      retries: 8
+      start_period: "120s"
+
+provides:
+  - capability: "ui-immich"
+    kind: ui
+    interface: web-ui
+    task: "immich-server"
+    port: 2283
+    endpoint:
+      portName: http
+    path: "/"
+    protocol: "http"
+    visibility: "external"
+    embedded: "direct"
+    description: "Immich Web UI"
+
+lifecycle:
+  install:
+    - downloadImage: "docker.io/valkey/valkey:9@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9"
+    - downloadImage: "ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23"
+    - downloadImage: "ghcr.io/immich-app/immich-server:v2"
+      timeout_ms: 1800000
+      idle_timeout_ms: 1800000
+    - downloadImage: "ghcr.io/immich-app/immich-machine-learning:v2"
+      timeout_ms: 1800000
+      idle_timeout_ms: 1800000
+    - mkdir: "~/.jishushell/apps/${instance.id}/library"
+    - mkdir: "~/.jishushell/apps/${instance.id}/postgres"
+    - mkdir: "~/.jishushell/apps/${instance.id}/model-cache"
+
+  post_start:
+    - run: |
+        set -eu
+
+        STATE_DIR="$HOME/.jishushell/apps/${instance.id}"
+        ENV_FILE="$STATE_DIR/.env"
+        mkdir -p "$STATE_DIR"
+        touch "$ENV_FILE"
+        chmod 600 "$ENV_FILE"
+
+        read_env() {
+          awk -F= -v key="$1" '$1 == key { value = substr($0, length(key) + 2) } END { if (value != "") print value }' "$ENV_FILE" 2>/dev/null || true
+        }
+
+        upsert_env() {
+          key="$1"
+          value="$2"
+          tmp="${ENV_FILE}.tmp"
+          awk -v key="$key" -v value="$value" '
+            BEGIN { updated = 0 }
+            index($0, key "=") == 1 { print key "=" value; updated = 1; next }
+            { print }
+            END { if (!updated) print key "=" value }
+          ' "$ENV_FILE" > "$tmp"
+          chmod 600 "$tmp"
+          mv "$tmp" "$ENV_FILE"
+        }
+
+        sync_openclaw() {
+          if [ -n "${JISHUSHELL_CORE_URL:-}" ] && [ -n "${JISHUSHELL_INTERNAL_TOKEN:-}" ]; then
+            curl -fsS -X POST \
+              -H "X-Jishushell-Internal-Token: $JISHUSHELL_INTERNAL_TOKEN" \
+              -H "X-Jishushell-Instance: ${instance.id}" \
+              "$JISHUSHELL_CORE_URL/api/integrations/immich/internal/sync-openclaw" >/dev/null || true
+          fi
+        }
+
+        IMMICH_API_KEY="$(read_env IMMICH_API_KEY)"
+        if [ -n "$IMMICH_API_KEY" ]; then
+          sync_openclaw
+          exit 0
+        fi
+
+        IMMICH_ADMIN_EMAIL="$(read_env IMMICH_ADMIN_EMAIL)"
+        if [ -z "$IMMICH_ADMIN_EMAIL" ]; then
+          IMMICH_ADMIN_EMAIL="admin@jishushell.local"
+          upsert_env IMMICH_ADMIN_EMAIL "$IMMICH_ADMIN_EMAIL"
+        fi
+
+        IMMICH_ADMIN_PASSWORD="$(read_env IMMICH_ADMIN_PASSWORD)"
+        if [ -z "$IMMICH_ADMIN_PASSWORD" ]; then
+          IMMICH_ADMIN_PASSWORD="JishuShell@2026"
+          upsert_env IMMICH_ADMIN_PASSWORD "$IMMICH_ADMIN_PASSWORD"
+        fi
+
+        find_immich_container() {
+          docker ps \
+            --format '{{.ID}}\t{{.Names}}\t{{.Label "com.hashicorp.nomad.job_name"}}\t{{.Label "com.hashicorp.nomad.task_name"}}' \
+            | awk -F '\t' -v instance="${instance.id}" '
+              $4 == "immich-server" && ($3 == instance || $3 == "jishushell-" instance) {
+                print $1;
+                found = 1;
+                exit;
+              }
+              $4 == "immich-server" && index($2, instance) > 0 { label_fallback = $1 }
+              $2 == "immich-server" || index($2, "immich-server-") == 1 { name_fallback = $1 }
+              END {
+                if (!found) {
+                  if (label_fallback) print label_fallback;
+                  else if (name_fallback) print name_fallback;
+                }
+              }
+            '
+        }
+
+        CONTAINER_ID=""
+        for attempt in $(seq 1 120); do
+          CONTAINER_ID="$(find_immich_container | head -n 1)"
+          if [ -n "$CONTAINER_ID" ]; then
+            break
+          fi
+          sleep 2
+        done
+        if [ -z "$CONTAINER_ID" ]; then
+          echo "immich-server container is not running" >&2
+          exit 1
+        fi
+
+        IMMICH_API_KEY="$(docker exec -i \
+          -e IMMICH_BOOTSTRAP_EMAIL="$IMMICH_ADMIN_EMAIL" \
+          -e IMMICH_BOOTSTRAP_PASSWORD="$IMMICH_ADMIN_PASSWORD" \
+          "$CONTAINER_ID" node - <<'NODE'
+        const baseUrl = "http://127.0.0.1:2283/api";
+        const email = process.env.IMMICH_BOOTSTRAP_EMAIL;
+        const password = process.env.IMMICH_BOOTSTRAP_PASSWORD;
+
+        const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+        function fatal(message) {
+          const error = new Error(message);
+          error.fatal = true;
+          throw error;
+        }
+
+        async function request(path, options = {}) {
+          const response = await fetch(`${baseUrl}${path}`, {
+            ...options,
+            headers: {
+              accept: "application/json",
+              "content-type": "application/json",
+              ...(options.headers ?? {}),
+            },
+          });
+          const text = await response.text();
+          let body = null;
+          if (text) {
+            try {
+              body = JSON.parse(text);
+            } catch {
+              body = null;
+            }
+          }
+          return { response, body, text };
+        }
+
+        async function login() {
+          const result = await request("/auth/login", {
+            method: "POST",
+            body: JSON.stringify({ email, password }),
+          });
+          if (result.response.ok && result.body?.accessToken) {
+            return result.body.accessToken;
+          }
+          return null;
+        }
+
+        async function bootstrap() {
+          let lastError = "Immich API is not ready";
+          for (let attempt = 0; attempt < 150; attempt += 1) {
+            try {
+              const ping = await request("/server/ping", { method: "GET" });
+              if (!ping.response.ok) {
+                lastError = `ping failed: HTTP ${ping.response.status} ${ping.text}`;
+                await sleep(2000);
+                continue;
+              }
+
+              let accessToken = await login();
+              if (!accessToken) {
+                const signUp = await request("/auth/admin-sign-up", {
+                  method: "POST",
+                  body: JSON.stringify({ email, password, name: "JishuShell" }),
+                });
+                if (signUp.response.status === 400 || signUp.response.status === 409) {
+                  fatal("Immich is already initialized and the stored JishuShell admin credentials did not work; set IMMICH_ADMIN_EMAIL/IMMICH_ADMIN_PASSWORD or IMMICH_API_KEY in the instance .env file");
+                }
+                if (!signUp.response.ok) {
+                  lastError = `admin sign-up failed: HTTP ${signUp.response.status} ${signUp.text}`;
+                  await sleep(2000);
+                  continue;
+                }
+                accessToken = await login();
+              }
+
+              if (!accessToken) {
+                throw new Error("unable to log in with the stored Immich admin credentials");
+              }
+
+              const apiKey = await request("/api-keys", {
+                method: "POST",
+                headers: { Authorization: `Bearer ${accessToken}` },
+                body: JSON.stringify({ name: "JishuShell", permissions: ["all"] }),
+              });
+              if (!apiKey.response.ok) {
+                throw new Error(`API key creation failed: HTTP ${apiKey.response.status} ${apiKey.text}`);
+              }
+              if (!apiKey.body?.secret) {
+                throw new Error("API key creation response did not include a secret");
+              }
+              console.log(apiKey.body.secret);
+              return;
+            } catch (error) {
+              if (error?.fatal) {
+                throw error;
+              }
+              lastError = error instanceof Error ? error.message : String(error);
+              await sleep(2000);
+            }
+          }
+          throw new Error(lastError);
+        }
+
+        bootstrap().catch((error) => {
+          console.error(error instanceof Error ? error.message : String(error));
+          process.exit(1);
+        });
+        NODE
+        )"
+
+        if [ -z "$IMMICH_API_KEY" ]; then
+          echo "Immich API key generation returned an empty secret" >&2
+          exit 1
+        fi
+        upsert_env IMMICH_API_KEY "$IMMICH_API_KEY"
+        sync_openclaw
+      timeout_ms: 420000
+
+  uninstall:
+    - run: >-
+        rm -rf
+        "$HOME/.jishushell/apps/${instance.id}/.env"
+        "$HOME/.jishushell/apps/${instance.id}/library"
+        "$HOME/.jishushell/apps/${instance.id}/postgres"
+        "$HOME/.jishushell/apps/${instance.id}/model-cache"
+      sudo: true
+      timeout_ms: 1800000
+    - deleteImage: "ghcr.io/immich-app/immich-machine-learning:v2"
+    - deleteImage: "ghcr.io/immich-app/immich-server:v2"
+    - deleteImage: "ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23"
+    - deleteImage: "docker.io/valkey/valkey:9@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9"

package/apps/jishu-kb-container.yaml

@@ -1,30 +1,35 @@
 id: jishu-kb-container
 name: JishuShell KB
-version: "0.1.1"
+version: "0.1.2"
 jishushell:
-  min_version: "0.5.15"
+  min_version: "0.6.19"
 description: "JishuShell-KB: BM25 + 向量 + cross-encoder rerank 的本地知识库（单镜像）。提供 /api/kb/* 原生检索 API + OpenAI 兼容 /v1 透传 + Web UI。"
 singleInstance: true
 integrations:
   - kind: jishukb
 
 # 拓扑（单容器，无 sidecar）
-#   jishu-kb (container :8088) ── host :18095 ── 用户浏览器 / shim / agent
+#   jishu-kb (container :8088) ── host :18095 ── 用户浏览器 / JishuShell / OpenClaw
+#                              ├─ /mcp （OpenClaw native remote MCP）
 #                              └─ /data （SQLite + 向量索引 + 上传文档 + ONNX rerank 模型）
 #
 # 端到端调用链（OpenClaw agent）：
-#   用户 → OpenClaw（自带 LLM）→ 决定调 kb_search → mcporter call kb.kb_search
-#     → jishukb-shim → POST http://host.docker.internal:18095/api/kb/default/search
-#     → 返回 ranked chunks + scores → OpenClaw 自带 LLM 拼答案 + 引用
+#   用户 → OpenClaw（自带 LLM）→ native mcp.servers.kb
+#     → POST http://<kb-host>:18095/mcp
+#     → JishuKB 在同一个运行中服务内执行 kb__* 工具
+#     → 返回 ranked chunks / 文档 / jobs / 配置摘要 → OpenClaw 自带 LLM 拼答案 + 引用
 #
 # 关键设计：
-#   - v1 不带 auth（LAN-trust 模型，同 AnythingLLM / WeKnora / SearXNG）。
-#     JISHU_KB_AUTH_TOKEN 留空即可。
+#   - remote MCP 是 opt-in 且需要 bearer token。JishuShell 的 jishukb
+#     integration 会在 start/restart 前生成 instance 私有 secret.env，
+#     通过 Nomad env template 注入 JISHU_KB_AUTH_TOKEN，同时设置
+#     JISHU_KB_MCP_HTTP=1，然后把 mcpAuthToken 写入 provider-credentials，
+#     供 OpenClaw 连接使用。
 #   - JishuKB 不再由 Core 注入 default LLM key。generation provider
 #     由用户在 JishuKB 自己的 UI 中手动配置；Core 不把真实 upstream key
 #     写进 /api/admin/provider。
 #   - Core 仍保留知识库默认 default KB 创建、provider-credentials 写入、
-#     knowledge capability 暴露等集成能力。
+#     knowledge/web capability 暴露等集成能力。
 #   - Ollama URL 通过 `requires: llm-ollama` 注入到 JISHU_KB_OLLAMA_URL，
 #     供 embedding/rerank 模型按需调用；未绑定时为空字符串，jishu-kb
 #     fallback 到自身 config.go 默认值。
@@ -36,16 +41,14 @@ tasks:
   - name: jishukb
     role: service
     runtime: container
-    # 镜像 GHCR public，多架构（amd64/arm64）。Pin 0.1.1 避免 :latest 漂移。
-    image: "ghcr.io/x-aijishu/jishu-kb:0.1.1"
+    # 镜像 GHCR public，多架构（amd64/arm64）。Pin 0.1.2 避免 :latest 漂移。
+    image: "ghcr.io/x-aijishu/jishu-kb:0.1.2"
     user: "host"
     env:
       # 监听端口（container 内）。
       JISHU_KB_PORT: "8088"
       # 数据持久化目录。镜像默认即 /data，显式声明便于看 spec 一目了然。
       JISHU_KB_DATA: "/data"
-      # v1 ships without auth — see manifest top notes + plan.md §5.
-      JISHU_KB_AUTH_TOKEN: ""
       # The panel now embeds KB through the capability proxy. That keeps
       # absolute `/api/...` calls on the KB origin and lets the proxy
       # bootstrap hydrate server-stored conversations into a new browser
@@ -53,15 +56,16 @@ tasks:
       # embedding permissive for users who open :18095 manually.
       #
       # Wildcard is intentional here: panel origin can vary by LAN IP / host
-      # name, while JishuShell-KB v1 already runs without auth in the same
-      # LAN-trust model as AnythingLLM / WeKnora.
+      # name. API and remote MCP writes are protected by the generated bearer
+      # token; the static shell remains loadable so users can enter auth when
+      # opening :18095 manually.
       JISHU_KB_FRAME_ANCESTORS: "*"
       # Ollama URL: injected by `requires: llm-ollama` 下方的 capability slot。
       # `${requires.X}` materialization 当前不支持 `:-default` 兜底语法；
       # 未绑定时这里就是空字符串。jishu-kb 在 internal/config/config.go
       # 中自带默认值 http://localhost:11434，不影响启动。
       JISHU_KB_OLLAMA_URL: "${requires.JISHU_KB_OLLAMA_URL}"
-      # rerank 默认开；topK 默认 6（与 shim 默认值保持一致）。
+      # rerank 默认开；topK 默认 6（与 OpenClaw KB guidance 保持一致）。
       JISHU_KB_RERANK: "1"
       JISHU_KB_TOPK: "6"
       TZ: "Asia/Shanghai"
@@ -73,6 +77,7 @@ tasks:
       cpu: "1000m"
       memory: "1024Mi"
     ports:
+      # Core 会先把这个值当作宿主端口 seed 尝试；最终 hostPort 以 instance.json 为准。
       - name: http
         port: 18095
         container_port: 8088
@@ -108,9 +113,9 @@ requires:
     cardinality: "one"
 
 provides:
-  # 知识库 capability — agent `requires: knowledge` 时 panel 把
-  # KNOWLEDGE_BASE_URL 注入为 http://<host>:18095（裸根，shim 自己拼
-  # /api/kb/<id>/search）。命名遵循 <category>-<slug>。
+  # 知识库 capability — OpenClaw 绑定此 provider 后，JishuShell 通过
+  # provider-credentials + /api/service/capabilities 发现 remote MCP，并写入
+  # openclaw.json -> mcp.servers.kb。命名遵循 <category>-<slug>。
   - capability: "knowledge-jishukb"
     id: "jishukb"
     kind: "knowledge"
@@ -122,7 +127,7 @@ provides:
     path: "/"
     protocol: "http"
     visibility: "external"
-    description: "JishuShell-KB native KB API (/api/kb/*) — kb_search returns ranked chunks + scores"
+    description: "JishuShell-KB native KB API and remote MCP (/mcp) for OpenClaw kb__* tools"
 
   # Web UI capability。走 embedded: "proxy"：panel 通过 capability proxy
   # 同源托管 KB 页面，代理 bootstrap 会把绝对 `/api/...`、SSE、WS 等请求
@@ -149,4 +154,4 @@ lifecycle:
     - mkdir: "~/.jishushell/apps/${instance.id}/data"
 
   uninstall:
-    - deleteImage: "ghcr.io/x-aijishu/jishu-kb:0.1.1"
+    - deleteImage: "ghcr.io/x-aijishu/jishu-kb:0.1.2"

package/apps/ollama-binary.yaml

@@ -18,6 +18,7 @@ tasks:
       cpu: "2000m"
       memory: "4096Mi"
     ports:
+      # Core 会先把这个值当作宿主端口 seed 尝试；最终 hostPort 以 instance.json 为准。
       - name: gateway
         port: 11434
         visibility: external

package/apps/ollama-cpu-container.yaml

@@ -20,6 +20,7 @@ tasks:
       cpu: "2000m"
       memory: "4096Mi"
     ports:
+      # Core 会先把这个值当作宿主端口 seed 尝试；最终 hostPort 以 instance.json 为准。
       - name: gateway
         port: 11434
     health:

package/apps/ollama-with-hollama-binary.yaml

@@ -18,6 +18,7 @@ tasks:
       cpu: "2000m"
       memory: "4096Mi"
     ports:
+      # Core 会先把这个值当作宿主端口 seed 尝试；最终 hostPort 以 instance.json 为准。
       - name: gateway
         port: 11434
         visibility: external
@@ -38,6 +39,7 @@ tasks:
       cpu: "500m"
       memory: "512Mi"
     ports:
+      # Core 会先把这个值当作宿主端口 seed 尝试；最终 hostPort 以 instance.json 为准。
       - name: webui
         port: 4173
         visibility: external

package/apps/openclaw-binary.yaml

@@ -13,7 +13,9 @@ tasks:
     role: service
     runtime: process
     command: ~/.jishushell/apps/${instance.id}/bin/openclaw
-    args: ["gateway", "run", "--port", "18789", "--allow-unconfigured"]
+    # process runtime 直接监听宿主机端口，所以启动参数必须使用 Core 最终分配的
+    # hostPort，不能写死下面的 AppSpec seed。
+    args: ["gateway", "run", "--port", "${runtime.ports.gateway.http.hostPort}", "--allow-unconfigured"]
     env:
       NODE_ENV: production
     resources:
@@ -21,6 +23,7 @@ tasks:
       memory: "2024Mi"
     ports:
       - name: http
+        # Core 会先把这个值当作宿主端口 seed 尝试；最终 hostPort 以 instance.json 为准。
         port: 18789
         visibility: external
     health:
@@ -75,13 +78,6 @@ requires:
     inject_as: "BROWSER_CDP_URL"
     required: false
     cardinality: "one"
-  - capability: "mcp"
-    slot: "mcp"
-    kind: "mcp"
-    interface: "mcp-http"
-    inject_as: "MCP_SERVERS"
-    required: false
-    cardinality: "many"
   - capability: "files"
     slot: "files"
     kind: "files"

package/apps/openclaw-container.yaml

@@ -21,6 +21,7 @@ tasks:
       cpu: "1000m"
       memory: "1536Mi"
     ports:
+      # Core 会先把这个值当作宿主端口 seed 尝试；最终 hostPort 以 instance.json 为准。
       - name: http
         port: 18789
         visibility: external
@@ -82,13 +83,6 @@ requires:
     inject_as: "BROWSER_CDP_URL"
     required: false
     cardinality: "one"
-  - capability: "mcp"
-    slot: "mcp"
-    kind: "mcp"
-    interface: "mcp-http"
-    inject_as: "MCP_SERVERS"
-    required: false
-    cardinality: "many"
   - capability: "files"
     slot: "files"
     kind: "files"

package/apps/openclaw-with-ollama-container.yaml

@@ -25,6 +25,7 @@ tasks:
       cpu: "1000m"
       memory: "1024Mi"
     ports:
+      # Core 会先把这个值当作宿主端口 seed 尝试；最终 hostPort 以 instance.json 为准。
       - name: http
         port: 18789
         visibility: external

package/apps/openclaw-with-searxng-container.yaml

@@ -56,6 +56,7 @@ tasks:
       cpu: "1000m"
       memory: "1024Mi"
     ports:
+      # Core 会先把这个值当作宿主端口 seed 尝试；最终 hostPort 以 instance.json 为准。
       - name: http
         port: 18789
         visibility: external
@@ -139,6 +140,25 @@ lifecycle:
                   formats:
                     - html
                     - json
+                engines:
+                  # The upstream default general engines (google, duckduckgo,
+                  # startpage...) are unreachable from a mainland-China network,
+                  # so the aggregated result is empty out of the box. Enable
+                  # China-reachable engines here so search works without the
+                  # manual "enable engines in preferences" workaround, and so the
+                  # agent path (which sends no engine cookie) also returns hits.
+                  # bing/baidu are reliable; quark/360search are best-effort and
+                  # simply drop out on timeout without breaking aggregation.
+                  - name: bing
+                    disabled: false
+                  - name: baidu
+                    disabled: false
+                  - name: quark
+                    disabled: false
+                    timeout: 5.0
+                  - name: 360search
+                    disabled: false
+                    timeout: 5.0
                 '''
             ).lstrip(),
             encoding="utf-8",

package/apps/searxng-container.yaml

@@ -19,6 +19,7 @@ tasks:
       cpu: "500m"
       memory: "256Mi"
     ports:
+      # Core 会先把这个值当作宿主端口 seed 尝试；最终 hostPort 以 instance.json 为准。
       - name: http
         port: 18080
         container_port: 8080
@@ -138,6 +139,25 @@ lifecycle:
                   formats:
                     - html
                     - json
+                engines:
+                  # The upstream default general engines (google, duckduckgo,
+                  # startpage...) are unreachable from a mainland-China network,
+                  # so the aggregated result is empty out of the box. Enable
+                  # China-reachable engines here so search works without the
+                  # manual "enable engines in preferences" workaround, and so the
+                  # agent path (which sends no engine cookie) also returns hits.
+                  # bing/baidu are reliable; quark/360search are best-effort and
+                  # simply drop out on timeout without breaking aggregation.
+                  - name: bing
+                    disabled: false
+                  - name: baidu
+                    disabled: false
+                  - name: quark
+                    disabled: false
+                    timeout: 5.0
+                  - name: 360search
+                    disabled: false
+                    timeout: 5.0
                 '''
             ).lstrip(),
             encoding="utf-8",