jishushell 0.6.18 → 0.7.3

package/dist/routes/instances.js

@@ -1,839 +1,33 @@
-import { getServiceManagerType } from "../config.js";
 import { assertNotLocked } from "../services/backup/backup-manager.js";
 import * as appService from "../services/app-common/service.js";
 import * as appLifecycle from "../services/app-common/lifecycle-service.js";
-import { cleanupInstance as cleanupProxyInstance, getLastProxyError, invalidateConfigCache, } from "../services/llm-proxy/instance-proxy.js";
+import { cleanupInstance as cleanupProxyInstance, getLastProxyError, } from "../services/llm-proxy/instance-proxy.js";
 import { createInstance, isInstanceAdminError, validateId, } from "../services/instances/admin.js";
 import { cloneInstance, isInstanceCloneError } from "../services/instances/clone.js";
 import { getConnectionStatus, getConnectionSummary, isConnectionAdminError, replaceConnections, } from "../services/connections/admin.js";
 import { getAppConfigMeta, isAppConfigAdminError, readAppConfig, writeAppConfig, } from "../services/instances/config-admin.js";
-import { augmentInstanceMetadata, getInstanceCapabilities, resolvePrimaryIntegrationKind, } from "../services/runtime/instance.js";
-import { getIntegration, hasIntegration } from "../services/integrations/index.js";
+import { augmentInstanceMetadata, resolvePrimaryIntegrationKind, } from "../services/runtime/instance.js";
+import { getIntegration } from "../services/integrations/index.js";
 import { invalidateExecutionOwner } from "../services/app-common/execution-owner.js";
 import { markRuntimeRepairRestartApplied } from "../services/repair/runtime-repair.js";
-import { getCapabilityHtmlRewriter } from "../services/capability-proxy/html-rewriters/index.js";
-import { createHash } from "node:crypto";
-import { assertTerminalSessionOwner, getTerminalSession, getTerminalSessionEvents, sendTerminalSessionInput, startTerminalSession, stopTerminalSession, subscribeTerminalSession, } from "../services/app-common/terminal-session-manager.js";
-import { refreshInstanceStatus } from "../services/app-common/status-refresh.js";
-import { writeSecretFile } from "../utils/fs.js";
-import { Readable } from "node:stream";
-export { validateId };
-// Hop-by-hop headers that must not be forwarded by a proxy (RFC 2616 §13.5.1).
-// Exported for integration-owned route modules that implement their own HTTP proxies.
-export const HOP_BY_HOP = new Set([
-    "connection", "keep-alive", "proxy-authenticate", "proxy-authorization",
-    "te", "trailer", "transfer-encoding", "upgrade",
-]);
-/**
- * Strip the panel session cookie (`jishushell_session`) from a cookie header
- * value, preserving any other cookies for upstream forwarding.
- */
-function stripPanelSessionCookie(value) {
-    if (value === undefined)
-        return undefined;
-    const cookie = Array.isArray(value) ? value.join("; ") : value;
-    const preserved = cookie
-        .split(";")
-        .map((part) => part.trim())
-        .filter((part) => part && !/^jishushell_session=/i.test(part));
-    return preserved.length ? preserved.join("; ") : undefined;
-}
-function readHeaderValue(value) {
-    const header = Array.isArray(value) ? value[0] : value;
-    return typeof header === "string" && header.trim() ? header.trim() : null;
-}
-function parseHttpOrigin(value) {
-    if (!value)
-        return null;
-    try {
-        const parsed = new URL(value);
-        return parsed.protocol === "http:" || parsed.protocol === "https:" ? parsed.origin : null;
-    }
-    catch {
-        return null;
-    }
-}
-export function inferRequestOrigin(request) {
-    // Only trust browser-sent Origin/Referer for auto-allowlisting. Host and
-    // X-Forwarded-* are proxy metadata and should not become persisted origin
-    // policy by themselves.
-    return (parseHttpOrigin(readHeaderValue(request?.headers?.origin))
-        ?? parseHttpOrigin(readHeaderValue(request?.headers?.referer)));
-}
-function capabilityProxyPath(instanceId, capability) {
-    return `/api/instances/${encodeURIComponent(instanceId)}/provides/${encodeURIComponent(capability)}`;
-}
-function joinProxyPath(basePath, suffix) {
-    const normalizedBase = basePath.replace(/\/+$/, "");
-    const normalizedSuffix = suffix.replace(/^\/+/, "");
-    if (!normalizedSuffix)
-        return normalizedBase;
-    return `${normalizedBase}/${normalizedSuffix}`;
-}
-function canonicalCapabilityProxyBase(basePath, capabilityPath) {
-    const normalizedCapabilityPath = typeof capabilityPath === "string" ? capabilityPath.trim() : "";
-    const needsTrailingSlash = !normalizedCapabilityPath || normalizedCapabilityPath.endsWith("/");
-    return needsTrailingSlash ? `${basePath}/` : basePath;
-}
-function rewriteCapabilityLocation(basePath, canonicalBasePath, pathname, search = "", hash = "") {
-    const rewrittenPath = pathname === "/"
-        ? canonicalBasePath
-        : joinProxyPath(basePath, pathname);
-    return `${rewrittenPath}${search}${hash}`;
-}
-export function joinUpstreamPath(basePath, suffix) {
-    const normalizedBase = typeof basePath === "string" && basePath.trim()
-        ? (basePath.startsWith("/") ? basePath : `/${basePath}`)
-        : "/";
-    const normalizedSuffix = suffix.replace(/^\/+/, "");
-    if (!normalizedSuffix)
-        return normalizedBase;
-    return `${normalizedBase.replace(/\/+$/, "")}/${normalizedSuffix}`;
-}
-function shouldRewriteProxyResponse(contentType) {
-    const value = (contentType ?? "").toLowerCase();
-    return value.includes("text/html") || value.includes("text/css");
-}
-function capabilityProxyCleanupToken(parts) {
-    const hash = createHash("sha256");
-    for (const part of parts) {
-        hash.update(part ?? "");
-        hash.update("\0");
-    }
-    return hash.digest("hex").slice(0, 32);
-}
-function hasCookieValue(cookieHeader, name, expectedValue) {
-    return cookieHeader
-        .split(";")
-        .map((part) => part.trim())
-        .some((part) => {
-        const eq = part.indexOf("=");
-        if (eq < 0)
-            return false;
-        return part.slice(0, eq) === name && part.slice(eq + 1) === expectedValue;
-    });
-}
-export async function resolveHttpCapability(instanceId, capabilityName) {
-    const capability = appService
-        .getProvidedCapabilitiesForApp(instanceId)
-        .find((entry) => entry.capability === capabilityName);
-    if (!capability)
-        throw new Error(`Capability '${capabilityName}' not found`);
-    if (capability.visibility === "internal") {
-        throw new Error(`Capability '${capabilityName}' is not externally accessible`);
-    }
-    if (capability.protocol !== "http" && capability.protocol !== "https") {
-        throw new Error(`Capability '${capabilityName}' does not use HTTP(S)`);
-    }
-    const runtimePort = appService.resolveRuntimeCapabilityPort(instanceId, capabilityName);
-    if (typeof runtimePort !== "number" || runtimePort < 1) {
-        throw new Error(`Capability '${capabilityName}' has no resolved port`);
-    }
-    const upstreamHost = await appService.getHostForAppPort(instanceId, runtimePort);
-    const proxyBase = capabilityProxyPath(instanceId, capabilityName);
-    const canonicalProxyBase = canonicalCapabilityProxyBase(proxyBase, capability.path);
-    return {
-        capability,
-        targetBaseUrl: `${capability.protocol}://${appService.urlHost(upstreamHost)}:${runtimePort}`,
-        proxyUrl: canonicalProxyBase,
-    };
-}
-/**
- * Inject a tiny <script> that monkey-patches `fetch`, `XMLHttpRequest.open`,
- * and `Element.prototype.{setAttribute,src,href}` so that same-origin absolute
- * paths (e.g. `/api/v1/...`, `/static/...`) are transparently rewritten to go
- * through the capability proxy prefix.
- *
- * The alternative — rewriting every JS bundle byte-for-byte — is fragile and
- * expensive; a runtime shim at document load is the standard approach used by
- * reverse-proxy front-ends (cf. Cloudflare Access, oauth2-proxy, etc.).
- */
-function capabilityProxyBootstrap(proxyBasePath) {
-    const prefix = JSON.stringify(proxyBasePath.replace(/\/+$/, ""));
-    const workerPrelude = JSON.stringify([
-        "(function(){",
-        `var P=${prefix};`,
-        "function px(path){",
-        "if(!path||path.charAt(0)!=='/'||path.charAt(1)==='/'||path.indexOf(P)===0||path.indexOf('/api/instances/')===0)return path;",
-        "return P+path;",
-        "}",
-        "function str(u){return typeof u==='string'?u:(u&&typeof u.href==='string'?u.href:null);}",
-        "function rwWs(u){",
-        "var s0=str(u);if(!s0)return u;",
-        "var H=typeof __capProxyHost==='string'?__capProxyHost:self.location.host;",
-        "var L=typeof __capProxyProtocol==='string'?__capProxyProtocol:self.location.protocol;",
-        "var B=(L==='https:'?'https:':'http:')+'//'+H+'/';",
-        "try{var p=new URL(s0,B);",
-        "if(p.host===H&&(p.protocol==='ws:'||p.protocol==='wss:'||p.protocol===L)){",
-        "var pp=px(p.pathname);",
-        "if(pp!==p.pathname){var s=L==='https:'?'wss:':'ws:';return s+'//'+H+pp+p.search+p.hash;}",
-        "}}catch(_e){}",
-        "return u;",
-        "}",
-        "var _WS=self.WebSocket;",
-        "if(typeof _WS==='function')self.WebSocket=function(url,protocols){url=rwWs(url);return protocols!==undefined?new _WS(url,protocols):new _WS(url);};",
-        "if(typeof _WS==='function'){self.WebSocket.prototype=_WS.prototype;self.WebSocket.CONNECTING=_WS.CONNECTING;self.WebSocket.OPEN=_WS.OPEN;self.WebSocket.CLOSING=_WS.CLOSING;self.WebSocket.CLOSED=_WS.CLOSED;}",
-        "})();",
-    ].join(""));
-    return [
-        "<script>(function(){",
-        `var P=${prefix};`,
-        "var O=window.location.origin;",
-        // --- Service Worker neutralization ---
-        // Embedded SPAs like OpenWebUI register a service worker that aggressively
-        // caches HTML and JS chunks at the proxy origin. After we update the proxy
-        // bootstrap, the SW would keep serving the old (unpatched) HTML, so socket.io
-        // never gets the WebSocket monkey-patch and the splash screen spins forever.
-        // Unregister any existing SW, purge its caches, and block future
-        // registrations for the lifetime of the iframe.
-        "try{if(navigator.serviceWorker){",
-        "if(navigator.serviceWorker.getRegistrations){",
-        "navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(r){try{r.unregister()}catch(_e){}})}).catch(function(){});",
-        "}",
-        "navigator.serviceWorker.register=function(){return Promise.reject(new Error('service worker disabled in capability proxy'))};",
-        "}}catch(_e){}",
-        "try{if(window.caches&&caches.keys){caches.keys().then(function(ks){ks.forEach(function(k){try{caches.delete(k)}catch(_e){}})}).catch(function(){});}}catch(_e){}",
-        // Only rewrite paths that do NOT already start with the proxy prefix and
-        // that are simple absolute paths (start with `/` but not `//`).
-        "function px(path){",
-        "if(!path||path.charAt(0)!=='/'||path.charAt(1)==='/'||path.indexOf(P)===0||path.indexOf('/api/instances/')===0)return path;",
-        "return P+path;",
-        "}",
-        "function str(u){return typeof u==='string'?u:(u&&typeof u.href==='string'?u.href:null);}",
-        "function rw(u){",
-        "var s0=str(u);if(!s0)return u;",
-        "var direct=px(s0);",
-        "if(direct!==s0)return direct;",
-        "try{var p=new URL(s0,window.location.href);",
-        "if(p.origin===O){var pp=px(p.pathname);if(pp!==p.pathname)return pp+p.search+p.hash;}",
-        "}catch(_e){}",
-        "return u;",
-        "}",
-        "function rwWs(u){",
-        "var s0=str(u);if(!s0)return u;",
-        "try{var p=new URL(s0,window.location.href);",
-        "if(p.host===window.location.host&&(p.protocol==='ws:'||p.protocol==='wss:'||p.protocol===window.location.protocol)){",
-        "var pp=px(p.pathname);",
-        "if(pp!==p.pathname){var s=window.location.protocol==='https:'?'wss:':'ws:';return s+'//'+window.location.host+pp+p.search+p.hash;}",
-        "}}catch(_e){}",
-        "return u;",
-        "}",
-        // --- fetch() ---
-        "var _f=window.fetch;",
-        "window.fetch=function(r,o){",
-        "if(typeof r==='string'||(r&&typeof r.href==='string'))r=rw(r);",
-        "else if(r instanceof Request){",
-        "var nr=rw(r.url);if(nr!==r.url)r=new Request(nr,r);}",
-        "return _f.call(this,r,o);};",
-        // --- XMLHttpRequest.open() ---
-        "var _xo=XMLHttpRequest.prototype.open;",
-        "XMLHttpRequest.prototype.open=function(m,u){",
-        "arguments[1]=rw(u);",
-        "return _xo.apply(this,arguments);};",
-        // --- history.pushState / replaceState ---
-        // SPA routers (SvelteKit, React Router, etc.) navigate via pushState.
-        // Without this, pushing "/" lands on the panel's own SPA.
-        "var _ps=history.pushState;",
-        "var _rs=history.replaceState;",
-        "history.pushState=function(s,t,u){",
-        "if(typeof u==='string')u=rw(u);",
-        "return _ps.call(this,s,t,u);};",
-        "history.replaceState=function(s,t,u){",
-        "if(typeof u==='string')u=rw(u);",
-        "return _rs.call(this,s,t,u);};",
-        // --- location.assign / location.replace ---
-        "var _la=location.assign.bind(location);",
-        "var _lr=location.replace.bind(location);",
-        "location.assign=function(u){return _la(rw(u));};",
-        "location.replace=function(u){return _lr(rw(u));};",
-        // --- frame-busting defense ---
-        // Embedded SPAs (e.g. WeKnora) frequently do
-        //   window.top.location.href = '/login'
-        // when they see a 401, intending to log the user out. Inside our
-        // capability proxy iframe `top` is the panel's main window — that
-        // tears the user away from the instance detail page entirely.
-        // Redirect `top`/`parent` to the iframe's own window so the
-        // navigation stays inside the embed. Safe because the iframe IS
-        // same-origin as the panel (our reverse proxy serves it from the
-        // panel's host); cross-origin access would throw and fail closed.
-        "try{",
-        "Object.defineProperty(window,'top',{configurable:true,get:function(){return window;}});",
-        "Object.defineProperty(window,'parent',{configurable:true,get:function(){return window;}});",
-        "}catch(_e){}",
-        // --- dynamic property assignment: img.src = '/static/...' ---
-        "function patchProp(tag,prop){",
-        "var d=Object.getOwnPropertyDescriptor(tag.prototype,prop);",
-        "if(!d||!d.set)return;",
-        "var orig=d.set;",
-        "Object.defineProperty(tag.prototype,prop,{",
-        "set:function(v){return orig.call(this,rw(v));},",
-        "get:d.get,configurable:true,enumerable:true});",
-        "}",
-        "patchProp(HTMLImageElement,'src');",
-        "patchProp(HTMLScriptElement,'src');",
-        "patchProp(HTMLLinkElement,'href');",
-        "patchProp(HTMLSourceElement,'src');",
-        // --- Worker monkey-patch ---
-        // Some SPA clients create socket.io/WebSocket connections from workers.
-        // Patch same-origin workers so the same proxy-prefixing rule applies there.
-        "var _Worker=window.Worker;",
-        `var _workerPrelude=${workerPrelude};`,
-        "function shouldWrapWorker(url){",
-        "try{var p=new URL(String(url),window.location.href);return p.protocol==='blob:'||p.protocol==='data:'||p.origin===O;}catch(_e){return false;}",
-        "}",
-        "function wrapWorker(url,options){",
-        "if(typeof _Worker!=='function'||!shouldWrapWorker(url))return url;",
-        "try{var resolved=new URL(String(url),window.location.href).href;",
-        "var isModule=!!(options&&options.type==='module');",
-        "var workerEnv='var __capProxyHost='+JSON.stringify(window.location.host)+';var __capProxyProtocol='+JSON.stringify(window.location.protocol)+';';",
-        "var source=isModule?workerEnv+_workerPrelude+'\\nimport '+JSON.stringify(resolved)+';':workerEnv+_workerPrelude+'\\nimportScripts('+JSON.stringify(resolved)+');';",
-        "return URL.createObjectURL(new Blob([source],{type:'text/javascript'}));",
-        "}catch(_e){return url;}",
-        "}",
-        "if(typeof _Worker==='function'){",
-        "window.Worker=function(url,options){var wrapped=wrapWorker(url,options);return options!==undefined?new _Worker(wrapped,options):new _Worker(wrapped);};",
-        "window.Worker.prototype=_Worker.prototype;",
-        "}",
-        // --- WebSocket ---
-        // SPAs like OpenWebUI use socket.io over WebSocket. The socket.io client
-        // builds ws:// URLs from window.location and the configured path; the URL
-        // ends up pointing at the panel root (e.g. ws://panel:8090/ws/socket.io)
-        // instead of the capability proxy.  Without this patch the WS upgrade
-        // request either gets destroyed (no route) or hits the wrong backend.
-        "var _WS=window.WebSocket;",
-        "if(typeof _WS==='function'){",
-        "window.WebSocket=function(url,protocols){",
-        "url=rwWs(url);",
-        "return protocols!==undefined?new _WS(url,protocols):new _WS(url);",
-        "};",
-        "window.WebSocket.prototype=_WS.prototype;",
-        "window.WebSocket.CONNECTING=_WS.CONNECTING;",
-        "window.WebSocket.OPEN=_WS.OPEN;",
-        "window.WebSocket.CLOSING=_WS.CLOSING;",
-        "window.WebSocket.CLOSED=_WS.CLOSED;",
-        "}",
-        // --- EventSource ---
-        // Some frameworks use SSE (Server-Sent Events) for real-time updates.
-        "var _ES=window.EventSource;",
-        "if(typeof _ES==='function'){",
-        "window.EventSource=function(url,opts){",
-        "if(typeof url==='string')url=rw(url);",
-        "return new _ES(url,opts);",
-        "};",
-        "window.EventSource.prototype=_ES.prototype;",
-        "window.EventSource.CONNECTING=_ES.CONNECTING;",
-        "window.EventSource.OPEN=_ES.OPEN;",
-        "window.EventSource.CLOSED=_ES.CLOSED;",
-        "}",
-        "})();</script>",
-    ].join("");
-}
-function rewriteProxyTextBody(body, contentType, proxyBasePath, extraHeadHtml = "") {
-    const value = (contentType ?? "").toLowerCase();
-    const proxyBaseWithSlash = `${proxyBasePath.replace(/\/+$/, "")}/`;
-    let rewritten = body;
-    if (value.includes("text/html")) {
-        // Rewrite asset URLs FIRST, then optionally inject a <base> tag.
-        // Reversing the order would let the regex below match (and double-
-        // prefix) the leading slash of the just-inserted `<base href="/api/...">`,
-        // producing
-        //   <base href="/api/instances/X/provides/Y/api/instances/X/provides/Y/">
-        // which then resolves every relative asset to a 404.
-        rewritten = rewritten.replace(/((?:href|src|action|poster)=['"])\/(?!\/)/gi, `$1${proxyBaseWithSlash}`);
-        // Rewrite dynamic import() paths inside inline <script> blocks so that
-        // SvelteKit (and similar frameworks) resolve JS modules through the proxy.
-        // Matches import("/_app/...") and import('/_app/...').
-        rewritten = rewritten.replace(/\bimport\(\s*(['"])\/(?!\/)/g, `import($1${proxyBaseWithSlash}`);
-        // Rewrite SvelteKit's client-side base path so that client-side routing
-        // and subsequent chunk fetches go through the capability proxy path.
-        // Older SvelteKit SSR output: __sveltekit_XXXXX = { base: "" };
-        rewritten = rewritten.replace(/(__sveltekit_\w+\s*=\s*\{\s*base\s*:\s*)(["'])["']/, `$1$2${proxyBasePath.replace(/\/+$/, "")}$2`);
-        // SvelteKit 2.x start() config: paths: { base: "", assets: "..." }
-        rewritten = rewritten.replace(/(paths\s*:\s*\{\s*base\s*:\s*)(["'])["'](\s*,\s*assets\s*:)/, `$1$2${proxyBasePath.replace(/\/+$/, "")}$2$3`);
-        if (!/<base\b/i.test(rewritten)) {
-            if (/<head[^>]*>/i.test(rewritten)) {
-                rewritten = rewritten.replace(/<head([^>]*)>/i, `<head$1><base href="${proxyBaseWithSlash}">`);
-            }
-            else {
-                rewritten = `<base href="${proxyBaseWithSlash}">${rewritten}`;
-            }
-        }
-        if (extraHeadHtml) {
-            if (/<base\b/i.test(rewritten)) {
-                rewritten = rewritten.replace(/<base\b[^>]*>/i, (match) => `${match}${extraHeadHtml}`);
-            }
-            else if (/<head[^>]*>/i.test(rewritten)) {
-                rewritten = rewritten.replace(/<head([^>]*)>/i, `<head$1>${extraHeadHtml}`);
-            }
-            else {
-                rewritten = `${extraHeadHtml}${rewritten}`;
-            }
-        }
-    }
-    if (value.includes("text/css")) {
-        rewritten = rewritten.replace(/url\((['"]?)\/(?!\/)/gi, `url($1${proxyBaseWithSlash}`);
-    }
-    else if (value.includes("text/html")) {
-        // HTML can contain inline scripts like new URL("/..."); only rewrite lowercase CSS url(...).
-        rewritten = rewritten.replace(/url\((['"]?)\/(?!\/)/g, `url($1${proxyBaseWithSlash}`);
-    }
-    return rewritten;
-}
-function isReadableBody(value) {
-    if (value instanceof Readable)
-        return true;
-    if (!value || typeof value !== "object")
-        return false;
-    const candidate = value;
-    return (typeof candidate.pipe === "function" &&
-        typeof candidate.on === "function" &&
-        typeof candidate[Symbol.asyncIterator] === "function");
-}
-async function readProxyBodyStream(stream) {
-    const chunks = [];
-    for await (const chunk of stream) {
-        if (typeof chunk === "string") {
-            chunks.push(Buffer.from(chunk));
-        }
-        else if (chunk instanceof Uint8Array) {
-            chunks.push(Buffer.from(chunk));
-        }
-        else {
-            chunks.push(Buffer.from(String(chunk)));
-        }
-    }
-    return Buffer.concat(chunks);
-}
-function bytesToArrayBuffer(bytes) {
-    const out = new ArrayBuffer(bytes.byteLength);
-    new Uint8Array(out).set(bytes);
-    return out;
-}
-function isPlainRecord(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const proto = Object.getPrototypeOf(value);
-    return proto === Object.prototype || proto === null;
-}
-function encodeFormRecord(body) {
-    const params = new URLSearchParams();
-    for (const [key, value] of Object.entries(body)) {
-        if (Array.isArray(value)) {
-            for (const item of value)
-                params.append(key, String(item));
-        }
-        else {
-            params.append(key, String(value));
-        }
-    }
-    return params.toString();
-}
-async function buildProxyRequestBody(req) {
-    if (req.method === "GET" || req.method === "HEAD")
-        return undefined;
-    const body = req.body;
-    if (body == null)
-        return undefined;
-    if (typeof body === "string") {
-        return body;
-    }
-    if (body instanceof Uint8Array || Buffer.isBuffer(body))
-        return bytesToArrayBuffer(body);
-    if (isReadableBody(body)) {
-        return bytesToArrayBuffer(await readProxyBodyStream(body));
-    }
-    const contentType = String(req.headers["content-type"] ?? "").toLowerCase();
-    if (contentType.includes("application/x-www-form-urlencoded") && isPlainRecord(body)) {
-        return encodeFormRecord(body);
-    }
-    if (contentType.includes("application/json") && isPlainRecord(body)) {
-        return JSON.stringify(body);
-    }
-    if (isPlainRecord(body)) {
-        return JSON.stringify(body);
-    }
-    return undefined;
-}
-function parseCommandLine(input) {
-    const trimmed = input.trim();
-    if (!trimmed)
-        return [];
-    const args = [];
-    let current = "";
-    let quote = null;
-    let escaping = false;
-    for (const char of trimmed) {
-        if (escaping) {
-            current += char;
-            escaping = false;
-            continue;
-        }
-        if (char === "\\") {
-            escaping = true;
-            continue;
-        }
-        if (quote) {
-            if (char === quote) {
-                quote = null;
-            }
-            else {
-                current += char;
-            }
-            continue;
-        }
-        if (char === '"' || char === "'") {
-            quote = char;
-            continue;
-        }
-        if (/\s/.test(char)) {
-            if (current) {
-                args.push(current);
-                current = "";
-            }
-            continue;
-        }
-        current += char;
-    }
-    if (escaping)
-        current += "\\";
-    if (quote)
-        throw new Error("Command contains an unterminated quote");
-    if (current)
-        args.push(current);
-    return args;
-}
-function isTerminalProvide(provide) {
-    return !!provide && String(provide.protocol).toLowerCase() === "terminal" && !!provide.terminal;
-}
-function resolveTerminalProvide(instanceId, capability) {
-    const provide = appService
-        .getProvidedCapabilitiesForApp(instanceId)
-        .find((entry) => entry.capability === capability);
-    if (!provide)
-        throw new Error(`Capability '${capability}' not found`);
-    if (!isTerminalProvide(provide)) {
-        throw new Error(`Capability '${capability}' is not a terminal provide`);
-    }
-    return provide;
-}
-function buildTerminalCommand(baseCommand, input) {
-    if (!Array.isArray(baseCommand) || baseCommand.length === 0 || baseCommand.some((part) => typeof part !== "string" || !part.trim())) {
-        throw new Error("Terminal provide is missing a valid base command");
-    }
-    const parsed = parseCommandLine(input);
-    if (!parsed.length)
-        throw new Error("Command cannot be empty");
-    const baseName = baseCommand[0].split("/").pop() || baseCommand[0];
-    const matchesBase = parsed.length >= baseCommand.length && baseCommand.every((part, index) => parsed[index] === part);
-    const matchesBaseName = parsed[0] === baseName;
-    if (matchesBase)
-        return parsed;
-    if (matchesBaseName)
-        return [baseCommand[0], ...parsed.slice(1)];
-    return [...baseCommand, ...parsed];
-}
-async function proxyProvidedCapability(req, reply) {
-    const idErr = validateId(req.params.id);
-    if (idErr)
-        return reply.status(400).send({ detail: idErr });
-    const rawInst = appService.getInstance(req.params.id);
-    if (!rawInst)
-        return reply.status(404).send({ detail: "Instance not found" });
-    if (!appService.getInstanceInstallRecord(req.params.id))
-        return reply.status(404).send({ detail: "App not found" });
-    const capabilities = appService.getProvidedCapabilitiesForApp(req.params.id);
-    const capability = capabilities.find((entry) => entry.capability === req.params.capability);
-    if (!capability) {
-        return reply.status(404).send({ detail: `Capability '${req.params.capability}' not found` });
-    }
-    if (capability.visibility === "internal") {
-        return reply.status(403).send({ detail: `Capability '${req.params.capability}' is not externally accessible` });
-    }
-    if (capability.protocol !== "http" && capability.protocol !== "https") {
-        return reply.status(400).send({ detail: `Capability '${req.params.capability}' does not use HTTP(S)` });
-    }
-    // Resolve only the canonical runtime hostPort. AppSpec declared ports are
-    // template metadata; using them here would route users to the wrong
-    // instance after reallocation or migration drift.
-    let runtimePort;
-    try {
-        runtimePort = appService.resolveRuntimeCapabilityPort(req.params.id, req.params.capability) ?? undefined;
-    }
-    catch (error) {
-        if (appService.isCanonicalRuntimePortRequiredError(error)) {
-            return reply.status(error.statusCode || 409).send({ detail: error.message, code: error.code });
-        }
-        throw error;
-    }
-    if (typeof runtimePort !== "number" || runtimePort < 1) {
-        return reply.status(500).send({ detail: `Capability '${req.params.capability}' has no resolved port` });
-    }
-    const upstreamHost = await appService.getHostForAppPort(req.params.id, runtimePort);
-    const upstreamOrigin = `${capability.protocol}://${appService.urlHost(upstreamHost)}:${runtimePort}`;
-    const wildcardSuffix = typeof req.params["*"] === "string" ? req.params["*"] : "";
-    const proxyBasePath = capabilityProxyPath(req.params.id, req.params.capability);
-    const querySuffix = req.raw.url?.includes("?") ? req.raw.url.slice(req.raw.url.indexOf("?")) : "";
-    const requestPath = req.raw.url?.split("?")[0] ?? "";
-    const canonicalProxyBase = canonicalCapabilityProxyBase(proxyBasePath, capability.path);
-    if (!wildcardSuffix && canonicalProxyBase !== proxyBasePath && !requestPath.endsWith("/")) {
-        reply.code(308).header("location", `${canonicalProxyBase}${querySuffix}`);
-        return reply.send();
-    }
-    const upstreamPath = joinUpstreamPath(capability.path, wildcardSuffix);
-    const targetUrl = `${upstreamOrigin}${upstreamPath}${querySuffix}`;
-    const headers = new Headers();
-    for (const [key, value] of Object.entries(req.headers)) {
-        if (value == null)
-            continue;
-        const normalizedKey = key.toLowerCase();
-        if (HOP_BY_HOP.has(normalizedKey) || normalizedKey === "host" || normalizedKey === "content-length" || normalizedKey === "accept-encoding") {
-            continue;
-        }
-        // Strip panel session credentials to avoid leaking them upstream
-        // (consistent with the WebSocket capability proxy in server.ts)
-        if (normalizedKey === "authorization")
-            continue;
-        if (normalizedKey === "cookie") {
-            const stripped = stripPanelSessionCookie(value);
-            if (stripped)
-                headers.set(key, stripped);
-            continue;
-        }
-        if (Array.isArray(value)) {
-            for (const item of value)
-                headers.append(key, item);
-        }
-        else {
-            headers.set(key, String(value));
-        }
-    }
-    headers.set("accept-encoding", "identity");
-    if (headers.has("origin"))
-        headers.set("origin", upstreamOrigin);
-    // `x-forwarded-prefix` is not a standard reverse-proxy header and some
-    // upstream frameworks (notably SvelteKit apps like Hollama) treat it as a
-    // deployment base path, which breaks `/_app/*` asset resolution under this
-    // generic proxy. The HTML/base rewrite below already handles path prefixing.
-    if (req.headers.host)
-        headers.set("x-forwarded-host", String(req.headers.host));
-    headers.set("x-forwarded-proto", req.protocol);
-    const clientIp = typeof req.ip === "string" && req.ip
-        ? req.ip
-        : typeof req.raw?.socket?.remoteAddress === "string"
-            ? req.raw.socket.remoteAddress
-            : "";
-    if (clientIp) {
-        const forwardedFor = headers.get("x-forwarded-for");
-        headers.set("x-forwarded-for", forwardedFor ? `${forwardedFor}, ${clientIp}` : clientIp);
-        headers.set("x-real-ip", clientIp);
-    }
-    // Intercept service worker scripts BEFORE talking to upstream.  SPAs like
-    // OpenWebUI register a SvelteKit service worker that aggressively caches
-    // HTML/JS at the proxy origin; once installed, the SW serves stale bodies
-    // and the page never receives our latest bootstrap (WebSocket / fetch
-    // monkey-patch).  We replace the SW body with a self-unregistration stub so
-    // the next browser update cycle removes the offending worker and restores
-    // network-backed loading.
-    if (/(?:^|\/)(?:service-worker|sw)\.js$/i.test(requestPath)) {
-        reply
-            .code(200)
-            .header("content-type", "application/javascript; charset=utf-8")
-            .header("cache-control", "no-store, no-cache, must-revalidate, max-age=0")
-            .header("pragma", "no-cache")
-            .header("service-worker-allowed", "/");
-        return reply.send("// Capability proxy: service worker intentionally disabled.\n" +
-            "self.addEventListener('install',function(e){self.skipWaiting()});\n" +
-            "self.addEventListener('activate',function(e){\n" +
-            "  e.waitUntil((async function(){\n" +
-            "    try{var cs=await caches.keys();for(var i=0;i<cs.length;i++){try{await caches.delete(cs[i])}catch(_e){}}}catch(_e){}\n" +
-            "    try{var clients=await self.clients.matchAll({includeUncontrolled:true});clients.forEach(function(c){try{c.navigate(c.url)}catch(_e){}})}catch(_e){}\n" +
-            "    try{await self.registration.unregister()}catch(_e){}\n" +
-            "  })());\n" +
-            "});\n");
-    }
-    // Single AbortController so we can cancel the upstream when the client
-    // disconnects. AbortSignal.timeout() only limits connection establishment;
-    // long-poll/SSE bodies (e.g. socket.io) would otherwise pin the fetch
-    // promise indefinitely and starve the event loop.
-    const upstreamAbort = new AbortController();
-    const connectTimer = setTimeout(() => upstreamAbort.abort(new Error("upstream connect timeout")), 30_000);
-    const onClientClose = () => {
-        if (!reply.raw.writableEnded)
-            upstreamAbort.abort(new Error("client disconnected"));
-    };
-    reply.raw.once("close", onClientClose);
-    try {
-        console.error("[cap-proxy] PRE buildBody method=", req.method, "bodyType=", typeof req.body, req.body?.constructor?.name, "signalAborted=", upstreamAbort.signal.aborted);
-        const requestBody = await buildProxyRequestBody(req);
-        console.error("[cap-proxy] POST buildBody size=", requestBody instanceof ArrayBuffer ? requestBody.byteLength : typeof requestBody === "string" ? requestBody.length : "undef", "signalAborted=", upstreamAbort.signal.aborted, "reason=", upstreamAbort.signal.reason?.message);
-        const upstream = await fetch(targetUrl, {
-            method: req.method,
-            headers,
-            body: requestBody,
-            redirect: "manual",
-            signal: upstreamAbort.signal,
-        }).finally(() => clearTimeout(connectTimer));
-        console.error("[cap-proxy] POST fetch status=", upstream.status);
-        const upstreamContentType = upstream.headers.get("content-type");
-        const willRewriteBody = shouldRewriteProxyResponse(upstreamContentType);
-        const willInjectHtml = (upstreamContentType ?? "").toLowerCase().includes("text/html");
-        reply.code(upstream.status);
-        upstream.headers.forEach((value, key) => {
-            const normalizedKey = key.toLowerCase();
-            if (HOP_BY_HOP.has(normalizedKey) || normalizedKey === "content-length" || normalizedKey === "content-encoding") {
-                return;
-            }
-            // When we rewrite the response body (HTML/CSS/JS), the upstream ETag /
-            // Cache-Control values describe the *original* upstream bytes — but the
-            // body the browser receives is post-rewrite (proxy-prefixed paths, JS
-            // hard-coded redirect targets, etc.). Honoring the upstream cache hints
-            // lets the browser pin a stale rewrite indefinitely: e.g. an early
-            // visit that pre-dated the JS rewrite gets cached and survives across
-            // app restarts, breaking the auth redirect logic until a hard refresh.
-            // Strip cache validators and force revalidation on every load.
-            if (willRewriteBody && (normalizedKey === "cache-control" ||
-                normalizedKey === "etag" ||
-                normalizedKey === "last-modified" ||
-                normalizedKey === "expires" ||
-                normalizedKey === "pragma")) {
-                return;
-            }
-            if (willInjectHtml && (normalizedKey === "content-security-policy" ||
-                normalizedKey === "content-security-policy-report-only" ||
-                normalizedKey === "x-frame-options")) {
-                return;
-            }
-            if (normalizedKey === "location") {
-                if (value.startsWith("/")) {
-                    reply.header(key, rewriteCapabilityLocation(proxyBasePath, canonicalProxyBase, value));
-                    return;
-                }
-                try {
-                    const parsed = new URL(value);
-                    const upstreamBase = new URL(upstreamOrigin);
-                    if (parsed.origin === upstreamBase.origin) {
-                        reply.header(key, rewriteCapabilityLocation(proxyBasePath, canonicalProxyBase, parsed.pathname, parsed.search, parsed.hash));
-                        return;
-                    }
-                }
-                catch {
-                    // fall through to raw location header
-                }
-            }
-            reply.header(key, value);
-        });
-        if (req.method === "HEAD") {
-            reply.raw.off("close", onClientClose);
-            return reply.send();
-        }
-        if (willRewriteBody) {
-            // Pair with the cache-validator strip above.
-            reply.header("cache-control", "no-cache, no-store, must-revalidate");
-            reply.header("pragma", "no-cache");
-            reply.header("expires", "0");
-            let extraHeadHtml = "";
-            const htmlRewriter = getCapabilityHtmlRewriter(capability);
-            extraHeadHtml += (await htmlRewriter?.buildHeadHtml({
-                instanceId: req.params.id,
-                capability,
-                upstreamOrigin,
-                signal: upstreamAbort.signal,
-                willInjectHtml,
-            })) ?? "";
-            // Inject a generic fetch/XHR monkey-patch for all capability-proxied
-            // HTML pages.  SPA frameworks like SvelteKit compile absolute API paths
-            // (e.g. `/api/v1/...`, `/ollama/...`) into JS bundles at build time.
-            // When the page is served under the proxy path those requests bypass
-            // the proxy and hit the panel's own `/api/` routes instead.  The patch
-            // intercepts fetch() and XMLHttpRequest.open() and rewrites same-origin
-            // absolute paths that do NOT already start with the proxy prefix.
-            extraHeadHtml += capabilityProxyBootstrap(proxyBasePath);
-            const rawBody = await upstream.text();
-            // First-visit/content-change cleanup: if the browser still has a stale
-            // ServiceWorker registered from an earlier panel build (which would
-            // intercept this navigation and serve cached HTML *without* the
-            // bootstrap patches), emit Clear-Site-Data so the browser drops the SW
-            // + its cache and reloads through the proxy. We mark the success with a
-            // long-lived cookie scoped to the proxy path to avoid a reload loop.
-            // The cookie value is tied to the upstream HTML bytes and validators,
-            // not a fixed boolean, so same-tag image rebuilds such as jishu-kb:0.1.1
-            // can still trigger one fresh cleanup after the embedded UI changes.
-            // Gate to HTML only — JS/CSS sub-resources also flow through this branch
-            // now that we rewrite JS bundles, and emitting Clear-Site-Data on a JS
-            // response would clear storage mid-page-load.
-            if (willInjectHtml) {
-                const cleanupToken = capabilityProxyCleanupToken([
-                    req.params.id,
-                    req.params.capability,
-                    upstreamOrigin,
-                    upstreamContentType,
-                    upstream.headers.get("etag"),
-                    upstream.headers.get("last-modified"),
-                    upstream.headers.get("content-length"),
-                    rawBody,
-                ]);
-                const cookieHeader = (req.headers.cookie || "").toString();
-                const swCleaned = hasCookieValue(cookieHeader, "cap_proxy_sw_clean", cleanupToken);
-                if (!swCleaned) {
-                    reply.header("Clear-Site-Data", '"cache", "storage"');
-                    reply.header("Set-Cookie", `cap_proxy_sw_clean=${cleanupToken}; Path=${proxyBasePath}; Max-Age=2592000; SameSite=Lax`);
-                }
-            }
-            reply.raw.off("close", onClientClose);
-            const rewritten = rewriteProxyTextBody(rawBody, upstreamContentType, proxyBasePath, extraHeadHtml);
-            return reply.send(rewritten);
-        }
-        if (!upstream.body) {
-            reply.raw.off("close", onClientClose);
-            return reply.send();
-        }
-        const readable = Readable.fromWeb(upstream.body);
-        readable.once("close", () => reply.raw.off("close", onClientClose));
-        return reply.send(readable);
-    }
-    catch (error) {
-        console.error("[cap-proxy] CATCH", error?.constructor?.name, error?.name, error?.message, "signalAborted=", upstreamAbort.signal.aborted, "reason=", upstreamAbort.signal.reason?.message, "stack=", error?.stack?.split("\n").slice(0, 4).join(" | "));
-        reply.raw.off("close", onClientClose);
-        return reply.status(502).send({ detail: error?.message || `Failed to proxy capability '${req.params.capability}'` });
-    }
-}
-// Resolve service manager once at route registration, re-resolve on config change
-let _svc = null;
-let _svcType = "";
-export async function getSvc() {
-    const currentType = getServiceManagerType();
-    if (_svc && _svcType === currentType)
-        return _svc;
-    if (currentType !== "nomad") {
-        // Step 13: process-manager / host-mode legacy runtime is unsupported.
-        throw new Error(`service_manager='${currentType}' is no longer supported. ` +
-            "Only 'nomad' runtimes are accepted on the runtime path. " +
-            "Run `jishushell migrate legacy` to convert legacy instances.");
-    }
-    _svc = await import("../services/runtime/drivers/nomad.js");
-    _svcType = currentType;
-    return _svc;
-}
+import { proxyProvidedCapability } from "../services/capability-proxy/http.js";
+import { sendTerminalCapabilityInput, startTerminalCapabilitySession, stopTerminalCapabilitySession, streamTerminalCapabilitySession, } from "../services/capability-proxy/terminal.js";
+import { inferRequestOrigin } from "../services/http/request-utils.js";
+import { getCachedStatus } from "../services/instances/status.js";
+import { approvePairingRequest, isInstancePairingError, listPairingRequests, } from "../services/instances/pairing.js";
+// Generic instance API only. Product-specific HTTP behavior belongs in
+// integrations/<kind> or app-modules/<app>, reached through explicit hooks.
 function getLifecycleActionSource(req) {
     const raw = req.headers["x-jishushell-action-source"];
     const value = Array.isArray(raw) ? raw[0] : raw;
     const source = typeof value === "string" ? value.trim() : "";
     return /^[a-z0-9._:-]{1,80}$/i.test(source) ? source : "unknown";
 }
-export async function getCachedStatus(_svc, instanceId, reason) {
-    const snapshot = await refreshInstanceStatus(instanceId, {
-        reason,
-        force: true,
-        minIntervalMs: 0,
-    });
-    return snapshot?.service ?? { status: "unknown", pid: null, uptime: null, memory_mb: null, cpu_percent: null };
-}
 export async function instanceRoutes(app) {
     // List
     app.get("/api/instances", async () => {
-        const svc = await getSvc();
         const instances = appService.listInstances();
-        const statuses = await Promise.all(instances.map(inst => getCachedStatus(svc, inst.id, "api-list").catch(() => ({ status: "unknown", pid: null, uptime: null, memory_mb: null, cpu_percent: null }))));
+        const statuses = await Promise.all(instances.map(inst => getCachedStatus(inst.id, "api-list").catch(() => ({ status: "unknown", pid: null, uptime: null, memory_mb: null, cpu_percent: null }))));
         return Promise.all(instances.map(async (inst, i) => ({
             ...(await augmentInstanceMetadata(inst.id, inst)),
             service: statuses[i],
@@ -845,7 +39,7 @@ export async function instanceRoutes(app) {
             return await createInstance(req.body);
         }
         catch (e) {
-            // Structured rejection from createHermesInstance — return 409 with code
+            // Structured rejection from integration create policy — return 409 with code
             if (e && e.name === "InstanceCreationRejected") {
                 return reply.status(409).send({
                     detail: e.hint,
@@ -901,11 +95,10 @@ export async function instanceRoutes(app) {
         const idErr = validateId(req.params.id);
         if (idErr)
             return reply.status(400).send({ detail: idErr });
-        const svc = await getSvc();
         const inst = appService.getInstance(req.params.id);
         if (!inst)
             return reply.status(404).send({ detail: "Instance not found" });
-        const status = await getCachedStatus(svc, req.params.id, "api-detail");
+        const status = await getCachedStatus(req.params.id, "api-detail");
         return {
             ...(await augmentInstanceMetadata(req.params.id, inst)),
             service: status,
@@ -1135,36 +328,19 @@ export async function instanceRoutes(app) {
         const idErr = validateId(req.params.id);
         if (idErr)
             return reply.status(400).send({ detail: idErr });
-        const inst = appService.getInstance(req.params.id);
-        if (!inst) {
-            return reply.status(404).send({ detail: "Instance not found" });
-        }
-        const capabilities = await getInstanceCapabilities(req.params.id, inst);
-        if (!capabilities.pairing.list) {
-            return reply.status(501).send({ detail: "Pairing list is not supported for this runtime" });
+        try {
+            return await listPairingRequests(req.params.id);
         }
-        const integrationKind = resolvePrimaryIntegrationKind(inst);
-        if (!integrationKind) {
-            return reply.status(501).send({ detail: "Pairing list is not supported for this runtime" });
+        catch (error) {
+            if (isInstancePairingError(error))
+                return reply.status(error.statusCode).send({ detail: error.message });
+            throw error;
         }
-        const svc = await getSvc();
-        // Pure integration dispatch — no hardcoded kind fallback.
-        const cmd = await getIntegration(integrationKind).buildPairingListCommand(req.params.id);
-        const result = await svc.exec(req.params.id, cmd, 15_000);
-        return { output: result.stdout + result.stderr, exitCode: result.exitCode };
     });
     app.post("/api/instances/:id/pairing/approve", async (req, reply) => {
         const idErr = validateId(req.params.id);
         if (idErr)
             return reply.status(400).send({ detail: idErr });
-        const inst = appService.getInstance(req.params.id);
-        if (!inst) {
-            return reply.status(404).send({ detail: "Instance not found" });
-        }
-        const capabilities = await getInstanceCapabilities(req.params.id, inst);
-        if (!capabilities.pairing.approve) {
-            return reply.status(501).send({ detail: "Pairing approve is not supported for this runtime" });
-        }
         const { channel, code, notify } = req.body ?? {};
         if (!channel || !PAIRING_CHANNEL_RE.test(channel)) {
             return reply.status(400).send({ detail: "Invalid channel: must be lowercase alphanumeric/hyphen/underscore" });
@@ -1172,29 +348,23 @@ export async function instanceRoutes(app) {
         if (!code || !PAIRING_CODE_RE.test(code)) {
             return reply.status(400).send({ detail: "Invalid pairing code: must be 4-16 uppercase alphanumeric characters" });
         }
-        const integrationKind = resolvePrimaryIntegrationKind(inst);
-        if (!integrationKind) {
-            return reply.status(501).send({ detail: "Pairing approve is not supported for this runtime" });
+        try {
+            return await approvePairingRequest(req.params.id, { channel, code, notify });
         }
-        const cmd = await getIntegration(integrationKind).buildPairingApproveCommand(req.params.id, {
-            channel,
-            code,
-            notify,
-        });
-        const svc = await getSvc();
-        const result = await svc.exec(req.params.id, cmd, 15_000);
-        if (result.exitCode !== 0) {
-            return reply.status(400).send({ detail: (result.stderr || result.stdout || "Approval failed").trim() });
+        catch (error) {
+            if (isInstancePairingError(error))
+                return reply.status(error.statusCode).send({ detail: error.message });
+            throw error;
         }
-        return { ok: true, output: (result.stdout + result.stderr).trim() };
     });
-    // Integration chat (inline chat panel for runtimes that expose an OpenAI-compat
-    // HTTP chat completion endpoint and declare chatPanel="inline" in their
-    // capability profile — currently only Hermes).
+    // Inline Chat surface for runtimes that choose the JishuShell-rendered Chat
+    // tab instead of an iframe-backed app UI. The runtime declares how Core can
+    // reach its chat endpoint via `inlineChatDescriptor`; this route owns only
+    // the shared forwarding/SSE wrapper.
     //
-    // Flow: panel JWT auth → read per-instance API_SERVER_KEY from integration-home/.env →
-    // read allocated host port from runtime.ports → POST forward to
-    // http://127.0.0.1:<port>/v1/chat/completions.
+    // Flow: panel JWT auth -> read the declared per-instance secret from
+    // integration-home/.env -> read allocated host port from runtime.ports ->
+    // POST forward to the declared runtime chat endpoint.
     //
     // The response is framed as Server-Sent Events with periodic `: ping`
     // heartbeats while we wait for the agent to finish. Long-running agent
@@ -1206,9 +376,8 @@ export async function instanceRoutes(app) {
     // Errors before headers are sent fall back to HTTP 5xx JSON; errors
     // after hijack go out as an `event: error` SSE payload.
     //
-    // This is a thin server-side forwarder, NOT a new LLM proxy. The actual
-    // LLM call still goes through Hermes → jsproxy → JishuShell /proxy/v1 →
-    // upstream provider.
+    // This is a thin server-side forwarder, NOT a new LLM proxy. Managed model
+    // traffic still goes through the runtime's configured Core proxy binding.
     app.post("/api/instances/:id/agent/chat", async (req, reply) => {
         const idErr = validateId(req.params.id);
         if (idErr)
@@ -1228,10 +397,9 @@ export async function instanceRoutes(app) {
                 detail: `Runtime "${integrationKind ?? "generic"}" does not support inline chat (chatPanel=${chatPanel})`,
             });
         }
-        // Integration-owned dispatch: the route no longer hardcodes Hermes's env
-        // var name or endpoint path. Any integration that declares chatPanel
-        // "inline" MUST also supply `inlineChatDescriptor` (api key env var +
-        // optional path/header/timeout) so this forwarder can reach its agent.
+        // Integration-owned dispatch: any integration that declares chatPanel
+        // "inline" MUST also supply `inlineChatDescriptor` (secret env var plus
+        // optional path/header/timeout) so this forwarder can reach its runtime.
         if (!integrationKind) {
             return reply.status(500).send({
                 detail: `Instance "${req.params.id}" has no integration identity but declared chatPanel=inline`,
@@ -1257,8 +425,8 @@ export async function instanceRoutes(app) {
             }
             throw error;
         }
-        // Agent API key lives in the integration-managed secretEnv file. Integration
-        // declares which env var holds it (Hermes → API_SERVER_KEY).
+        // The runtime API key lives in the integration-managed secretEnv file.
+        // Integration declares which env var holds it.
         const secretEnv = inst?.paths?.secretEnv;
         if (!secretEnv) {
             return reply.status(500).send({ detail: "Instance has no secretEnv path" });
@@ -1273,7 +441,7 @@ export async function instanceRoutes(app) {
         const endpointPath = desc.endpointPath ?? "/v1/chat/completions";
         const authHeader = desc.authHeader ?? "Authorization";
         const authScheme = desc.authScheme ?? "Bearer ";
-        // Upstream budget: the Hermes call itself still gets a hard ceiling so
+        // Upstream budget: the runtime call still gets a hard ceiling so
         // a wedged container can't hold the connection forever. Integration can
         // extend this via inlineChatDescriptor.timeoutMs; default is 30 min
         // which comfortably covers multi-step tool loops.
@@ -1346,101 +514,16 @@ export async function instanceRoutes(app) {
         }
     });
     app.post("/api/instances/:id/provides/:capability/terminal/session", async (req, reply) => {
-        const idErr = validateId(req.params.id);
-        if (idErr)
-            return reply.status(400).send({ detail: idErr });
-        if (!appService.getInstance(req.params.id)) {
-            return reply.status(404).send({ detail: "Instance not found" });
-        }
-        try {
-            const provide = resolveTerminalProvide(req.params.id, req.params.capability);
-            const terminal = provide.terminal;
-            const input = typeof req.body?.input === "string" ? req.body.input : "";
-            const command = buildTerminalCommand(terminal.command, input);
-            const session = startTerminalSession({
-                instanceId: req.params.id,
-                capability: req.params.capability,
-                terminal,
-                command,
-            });
-            return reply.send(session);
-        }
-        catch (error) {
-            return reply.status(400).send({ detail: error?.message || "Failed to start terminal session" });
-        }
+        return startTerminalCapabilitySession(req, reply);
     });
     app.get("/api/instances/:id/provides/:capability/terminal/session/:sessionId/stream", async (req, reply) => {
-        const idErr = validateId(req.params.id);
-        if (idErr)
-            return reply.status(400).send({ detail: idErr });
-        if (!assertTerminalSessionOwner(req.params.sessionId, req.params.id, req.params.capability)) {
-            return reply.status(404).send({ detail: "Terminal session not found" });
-        }
-        const session = getTerminalSession(req.params.sessionId);
-        if (!session)
-            return reply.status(404).send({ detail: "Terminal session not found" });
-        const since = Math.max(parseInt(req.query.since || "0", 10) || 0, 0);
-        reply.hijack();
-        const raw = reply.raw;
-        raw.writeHead(200, {
-            "Content-Type": "text/event-stream; charset=utf-8",
-            "Cache-Control": "no-cache, no-transform",
-            "Connection": "keep-alive",
-            "X-Accel-Buffering": "no",
-        });
-        const writeEvent = (event, data) => {
-            raw.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
-        };
-        for (const event of getTerminalSessionEvents(req.params.sessionId, since)) {
-            writeEvent(event.type, event);
-        }
-        if (!session.running) {
-            writeEvent("done", { sessionId: req.params.sessionId });
-            raw.end();
-            return;
-        }
-        const unsubscribe = subscribeTerminalSession(req.params.sessionId, (event) => {
-            writeEvent(event.type, event);
-            if (event.type === "exit" || event.type === "error") {
-                writeEvent("done", { sessionId: req.params.sessionId });
-                unsubscribe?.();
-                raw.end();
-            }
-        });
-        req.raw.on("close", () => {
-            unsubscribe?.();
-        });
-        raw.write(": ping\n\n");
+        return streamTerminalCapabilitySession(req, reply);
     });
     app.post("/api/instances/:id/provides/:capability/terminal/session/:sessionId/input", async (req, reply) => {
-        const idErr = validateId(req.params.id);
-        if (idErr)
-            return reply.status(400).send({ detail: idErr });
-        if (!assertTerminalSessionOwner(req.params.sessionId, req.params.id, req.params.capability)) {
-            return reply.status(404).send({ detail: "Terminal session not found" });
-        }
-        try {
-            sendTerminalSessionInput(req.params.sessionId, typeof req.body?.input === "string" ? req.body.input : "");
-            return reply.send({ ok: true });
-        }
-        catch (error) {
-            return reply.status(400).send({ detail: error?.message || "Failed to send terminal input" });
-        }
+        return sendTerminalCapabilityInput(req, reply);
     });
     app.post("/api/instances/:id/provides/:capability/terminal/session/:sessionId/stop", async (req, reply) => {
-        const idErr = validateId(req.params.id);
-        if (idErr)
-            return reply.status(400).send({ detail: idErr });
-        if (!assertTerminalSessionOwner(req.params.sessionId, req.params.id, req.params.capability)) {
-            return reply.status(404).send({ detail: "Terminal session not found" });
-        }
-        try {
-            stopTerminalSession(req.params.sessionId);
-            return reply.send({ ok: true });
-        }
-        catch (error) {
-            return reply.status(400).send({ detail: error?.message || "Failed to stop terminal session" });
-        }
+        return stopTerminalCapabilitySession(req, reply);
     });
     app.all("/api/instances/:id/provides/:capability", async (req, reply) => proxyProvidedCapability(req, reply));
     app.all("/api/instances/:id/provides/:capability/*", async (req, reply) => proxyProvidedCapability(req, reply));
@@ -1461,128 +544,6 @@ export async function instanceRoutes(app) {
         }
         return { lines: logLines };
     });
-    // Admin: re-encrypt all instance secrets with current AES key
-    app.post("/api/admin/migrate-secrets", async (_req, _reply) => {
-        const { getAesKey, getJwtSecret } = await import("../config.js");
-        const { scryptSync, createDecipheriv, createCipheriv, randomBytes } = await import("crypto");
-        const { readFileSync, existsSync: fsExistsSync } = await import("fs");
-        const instances = appService.listInstances();
-        const results = [];
-        const currentKey = getAesKey();
-        const legacyKey = scryptSync(getJwtSecret(), "jishushell-apikey-v1", 32);
-        for (const inst of instances) {
-            const envFiles = appService.getRuntimeEnvFiles(inst.id);
-            const providerEnvFile = envFiles[0]?.replace(/model\.env$/, "provider.env");
-            if (!providerEnvFile || !fsExistsSync(providerEnvFile)) {
-                results.push({ id: inst.id, status: "skipped", error: "no provider.env" });
-                continue;
-            }
-            const envContent = readFileSync(providerEnvFile, "utf-8");
-            const match = envContent.match(/UPSTREAM_API_KEY=(.+)/);
-            if (!match || !match[1]?.startsWith("enc:")) {
-                results.push({ id: inst.id, status: "skipped", error: "no encrypted key" });
-                continue;
-            }
-            const encrypted = match[1];
-            const raw = Buffer.from(encrypted.slice(4), "base64");
-            if (raw.length < 29) {
-                results.push({ id: inst.id, status: "error", error: "encrypted data too short" });
-                continue;
-            }
-            const iv = raw.subarray(0, 12);
-            const tag = raw.subarray(12, 28);
-            const ciphertext = raw.subarray(28);
-            // Try decrypt with current key first
-            let plaintext = null;
-            let needsReEncrypt = false;
-            try {
-                const d = createDecipheriv("aes-256-gcm", currentKey, iv);
-                d.setAuthTag(tag);
-                plaintext = d.update(ciphertext, undefined, "utf-8") + d.final("utf-8");
-                // Already encrypted with current key — no migration needed
-                results.push({ id: inst.id, status: "ok" });
-                continue;
-            }
-            catch {
-                // Current key failed — try legacy
-                needsReEncrypt = true;
-            }
-            if (needsReEncrypt) {
-                try {
-                    const d = createDecipheriv("aes-256-gcm", legacyKey, iv);
-                    d.setAuthTag(tag);
-                    plaintext = d.update(ciphertext, undefined, "utf-8") + d.final("utf-8");
-                }
-                catch {
-                    results.push({ id: inst.id, status: "error", error: "decrypt failed with both keys" });
-                    continue;
-                }
-                // Re-encrypt with current key
-                const newIv = randomBytes(12);
-                const c = createCipheriv("aes-256-gcm", currentKey, newIv);
-                const enc = Buffer.concat([c.update(plaintext, "utf-8"), c.final()]);
-                const newTag = c.getAuthTag();
-                const newEncrypted = "enc:" + Buffer.concat([newIv, newTag, enc]).toString("base64");
-                // Write back
-                const newContent = envContent.replace(/UPSTREAM_API_KEY=.+/, `UPSTREAM_API_KEY=${newEncrypted}`);
-                writeSecretFile(providerEnvFile, newContent);
-                results.push({ id: inst.id, status: "migrated" });
-            }
-        }
-        // Invalidate proxy config cache for migrated instances
-        for (const r of results) {
-            if (r.status === "migrated")
-                invalidateConfigCache(r.id);
-        }
-        return { ok: true, results };
-    });
-    // ── Docker image check & pull ───────────────────────────────────────────
-    // Generic Docker operations used by NewInstance UI to verify / pull runtime
-    // images before creating an instance. Framework-level (not integration-scoped)
-    // because every container runtime shares the same docker CLI here.
-    app.get("/api/docker/image-check", async (req, reply) => {
-        const image = req.query.image;
-        if (!image || typeof image !== "string") {
-            return reply.status(400).send({ detail: "Missing 'image' query parameter" });
-        }
-        // Validate image name to prevent command injection
-        if (!/^[a-zA-Z0-9][a-zA-Z0-9\-_.:/@]*$/.test(image) || image.length > 256) {
-            return reply.status(400).send({ detail: "Invalid Docker image name" });
-        }
-        const { inspectDockerImage, toDockerInspectUserError } = await import("../utils/docker-inspect.js");
-        const result = inspectDockerImage(image, { timeout: 10000 });
-        if (result.ok) {
-            return { exists: true, image };
-        }
-        if (result.reason === "not_found")
-            return { exists: false, image };
-        const inspectError = toDockerInspectUserError(image, result);
-        return reply.status(inspectError.statusCode).send({
-            detail: inspectError.message,
-            code: inspectError.code,
-            exists: false,
-            image,
-        });
-    });
-    app.post("/api/docker/image-pull", async (req, reply) => {
-        const image = req.body?.image;
-        if (!image || typeof image !== "string") {
-            return reply.status(400).send({ detail: "Missing 'image' in request body" });
-        }
-        if (!/^[a-zA-Z0-9][a-zA-Z0-9\-_.:/@]*$/.test(image) || image.length > 256) {
-            return reply.status(400).send({ detail: "Invalid Docker image name" });
-        }
-        try {
-            const { execFile } = await import("child_process");
-            const { promisify } = await import("util");
-            const execFileAsync = promisify(execFile);
-            await execFileAsync("docker", ["pull", image], { timeout: 600_000 });
-            return { ok: true, image };
-        }
-        catch (e) {
-            return reply.status(500).send({ detail: `Failed to pull image: ${e.message}` });
-        }
-    });
     // ── Connections REST API ────────────────────────────────────────────────
     /** GET /api/instances/:id/connections — view spec.requires + bindings. */
     app.get("/api/instances/:id/connections", async (req, reply) => {
@@ -1632,106 +593,5 @@ export async function instanceRoutes(app) {
             return { state: "error", unboundRequired: [], unboundOptional: [], bindable: 0, error: e.message };
         }
     });
-    // ── Suggestions API (PR 6) ─────────────────────────────────────────────
-    app.get("/api/suggestions", async () => {
-        const { computeSuggestions } = await import("../services/connections/suggestions.js");
-        return { suggestions: computeSuggestions() };
-    });
-    app.post("/api/suggestions/:id/apply", async (req, reply) => {
-        const { computeSuggestions } = await import("../services/connections/suggestions.js");
-        const all = computeSuggestions();
-        const target = all.find((s) => s.id === req.params.id);
-        if (!target) {
-            return reply.status(404).send({ detail: "Suggestion no longer applies" });
-        }
-        // Apply by issuing the equivalent PUT /connections — read current
-        // bindings, splice in the new one for `slot`, persist via the
-        // transactor.
-        const meta = appService.getInstance(target.consumerInstanceId);
-        if (!meta)
-            return reply.status(404).send({ detail: "Consumer instance not found" });
-        // Resolve consumer spec from canonical sources only. The suggestion
-        // target is an instance id; AppSpec id is only the template identity.
-        const appData = appService.getInstanceInstallRecord(target.consumerInstanceId);
-        let consumerSpec = appData?.spec ?? null;
-        if (!consumerSpec) {
-            const { readCanonicalSpecForInstance } = await import("../services/app-common/instance-store.js");
-            consumerSpec = readCanonicalSpecForInstance(target.consumerInstanceId);
-        }
-        if (!consumerSpec) {
-            return reply.status(409).send({
-                detail: "Instance has no canonical AppSpec; run `jishushell migrate legacy --yes` first",
-                code: "INSTANCE_NEEDS_MIGRATION",
-            });
-        }
-        const newConnections = {
-            ...(meta.connections ?? {}),
-            [target.slot]: {
-                kind: "single",
-                providerId: target.candidate.providerId,
-                capability: target.candidate.capability,
-            },
-        };
-        const { applyConnections } = await import("../services/connections/transactor.js");
-        const safeJson = await import("../utils/safe-json.js");
-        const fs = await import("fs");
-        const path = await import("path");
-        const instancePath = appService.instanceMetaPath(target.consumerInstanceId);
-        const readInstanceJson = async () => (safeJson.safeReadJson(instancePath, `instance:${target.consumerInstanceId}`) ?? {});
-        const saveInstanceJson = async (_id, mutator) => {
-            const cur = (safeJson.safeReadJson(instancePath, `instance:${target.consumerInstanceId}`) ?? {});
-            try {
-                fs.mkdirSync(path.dirname(instancePath), { recursive: true });
-            }
-            catch {
-                /* noop */
-            }
-            safeJson.safeWriteJson(instancePath, mutator(cur));
-        };
-        let integration = null;
-        const hasIntegrationMetadata = Array.isArray(meta.integrations)
-            && meta.integrations.length > 0;
-        if (hasIntegrationMetadata) {
-            const integrationKind = resolvePrimaryIntegrationKind(meta);
-            if (!integrationKind || !hasIntegration(integrationKind)) {
-                return reply.status(409).send({
-                    detail: "Instance is missing canonical integration identity; run migration or repair first",
-                    code: "INSTANCE_NEEDS_MIGRATION",
-                });
-            }
-            const resolvedIntegration = getIntegration(integrationKind);
-            integration =
-                typeof resolvedIntegration.applyConnectionEnv === "function"
-                    ? resolvedIntegration
-                    : null;
-        }
-        try {
-            const result = await applyConnections({
-                instance: meta,
-                spec: consumerSpec,
-                newConnections,
-                saveInstanceJson,
-                readInstanceJson,
-                integration,
-            });
-            return { ok: true, applied: target.id, resolved: result.resolved.length };
-        }
-        catch (e) {
-            return reply.status(e?.statusCode ?? 500).send({
-                detail: e?.message ?? "Suggestion apply failed",
-                code: e?.code,
-            });
-        }
-    });
-    app.post("/api/suggestions/:id/dismiss", async (req, reply) => {
-        const { dismissSuggestion } = await import("../services/connections/suggestions.js");
-        try {
-            await dismissSuggestion(req.params.id);
-            return { ok: true };
-        }
-        catch (e) {
-            return reply.status(400).send({ detail: e?.message ?? "Invalid suggestion id" });
-        }
-    });
 }
 //# sourceMappingURL=instances.js.map