jishushell 0.6.5 → 0.6.18

package/dist/services/runtime/job-id.d.ts

@@ -1,7 +1,7 @@
 /**
  * Resolve the Nomad job id for a runtime instance without double-prefixing.
  *
- * App-dir instances are commonly stored with their adapter prefix already
+ * App-dir instances are commonly stored with their integration prefix already
  * included (for example `openclaw-123`). Legacy instances may still use a bare
  * id (`123`). This helper keeps both forms valid and must be shared anywhere a
  * Nomad variable/template path is built.

package/dist/services/runtime/job-id.js

@@ -1,7 +1,7 @@
 /**
  * Resolve the Nomad job id for a runtime instance without double-prefixing.
  *
- * App-dir instances are commonly stored with their adapter prefix already
+ * App-dir instances are commonly stored with their integration prefix already
  * included (for example `openclaw-123`). Legacy instances may still use a bare
  * id (`123`). This helper keeps both forms valid and must be shared anywhere a
  * Nomad variable/template path is built.

package/dist/services/runtime/mcp-shims/firewall.d.ts

@@ -1,7 +1,7 @@
 /**
- * Generic MCP firewall — see docs/app-interconnect-design.md §17.
+ * Generic MCP firewall for third-party MCP tool wrapping.
  *
- * Exports the firewall .mjs source as a string so adapters can drop it
+ * Exports the firewall .mjs source as a string so integrations can drop it
  * into agent-home at applyConnectionEnv time. Single source of truth for
  * all third-party MCP wrapping; replaces the per-capability shim files
  * introduced in PR 7 (which remain only as a one-release fallback).

package/dist/services/runtime/mcp-shims/firewall.js

@@ -1,7 +1,7 @@
 /**
- * Generic MCP firewall — see docs/app-interconnect-design.md §17.
+ * Generic MCP firewall for third-party MCP tool wrapping.
  *
- * Exports the firewall .mjs source as a string so adapters can drop it
+ * Exports the firewall .mjs source as a string so integrations can drop it
  * into agent-home at applyConnectionEnv time. Single source of truth for
  * all third-party MCP wrapping; replaces the per-capability shim files
  * introduced in PR 7 (which remain only as a one-release fallback).

package/dist/services/runtime/mcp-shims/searxng-shim.d.ts

@@ -14,11 +14,9 @@
  *   - translate the query to English,
  *   - auto-fill `time_range=day`.
  *
- * OpenClaw's built-in `searxng` web-search tool exposes a deliberately
- * minimal description (`Search the web using a self-hosted SearXNG
- * instance. Returns titles, URLs, and snippets.`) and the same model
- * leaves the user query untouched. We mirror OpenClaw's surface here so
- * Hermes' MCP-bound search behaves identically to OpenClaw's plugin path.
+ * This shim exposes a deliberately minimal description (`Search the web using
+ * a self-hosted SearXNG instance. Returns titles, URLs, and snippets.`), which
+ * keeps the model from rewriting user queries before dispatch.
  *
  * The shim is pure stdio MCP (JSON-RPC 2.0 over NDJSON) implemented
  * against Node built-ins — no npm install needed inside the runtime.

package/dist/services/runtime/mcp-shims/searxng-shim.js

@@ -14,11 +14,9 @@
  *   - translate the query to English,
  *   - auto-fill `time_range=day`.
  *
- * OpenClaw's built-in `searxng` web-search tool exposes a deliberately
- * minimal description (`Search the web using a self-hosted SearXNG
- * instance. Returns titles, URLs, and snippets.`) and the same model
- * leaves the user query untouched. We mirror OpenClaw's surface here so
- * Hermes' MCP-bound search behaves identically to OpenClaw's plugin path.
+ * This shim exposes a deliberately minimal description (`Search the web using
+ * a self-hosted SearXNG instance. Returns titles, URLs, and snippets.`), which
+ * keeps the model from rewriting user queries before dispatch.
  *
  * The shim is pure stdio MCP (JSON-RPC 2.0 over NDJSON) implemented
  * against Node built-ins — no npm install needed inside the runtime.

package/dist/services/runtime/mcp-shims/searxng-shim.js.map

@@ -1 +1 @@
-{"version":3,"file":"searxng-shim.js","sourceRoot":"","sources":["../../../../src/services/runtime/mcp-shims/searxng-shim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAkE4B,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+B1F,CAAC"}
+{"version":3,"file":"searxng-shim.js","sourceRoot":"","sources":["../../../../src/services/runtime/mcp-shims/searxng-shim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEAkE4B,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+B1F,CAAC"}

package/dist/services/runtime/mcp-shims/write-mcp-entry.d.ts

@@ -1,38 +1,38 @@
 /**
- * writeMcpEntry — adapter helper that materializes the MCP firewall
- * (see firewall.ts) into an instance's agent-home and returns the
- * `mcp_servers.<X>` block the adapter should write into its own config.
+ * writeMcpEntry — integration helper that materializes the MCP firewall
+ * (see firewall.ts) into an instance's integration home and returns the
+ * `mcp_servers.<X>` block the integration should write into its own config.
  *
- * Called by adapters from `applyConnectionEnv` (PR 8 / docs §17.3.3).
+ * Called by integrations from `applyConnectionEnv` (PR 8 / docs §17.3.3).
  *
  * Side effects on the host filesystem:
- *   - <agentHomeDir>/__mcp_shims__/<capabilityId>/firewall.mjs
- *   - <agentHomeDir>/__mcp_shims__/<capabilityId>/config.json
+ *   - <integrationHomeDir>/__mcp_shims__/<capabilityId>/firewall.mjs
+ *   - <integrationHomeDir>/__mcp_shims__/<capabilityId>/config.json
  *   - chown both to serviceUser if provided (best-effort)
  *
- * Pure return value (the adapter applies it to its own config schema):
+ * Pure return value (the integration applies it to its own config schema):
  *   {
  *     command: "node",
- *     args: ["<containerHomeDir>/__mcp_shims__/<id>/firewall.mjs",
+ *     args: ["<containerIntegrationHomeDir>/__mcp_shims__/<id>/firewall.mjs",
  *            "--config",
- *            "<containerHomeDir>/__mcp_shims__/<id>/config.json"],
- *     env: {}     // upstream env is encoded in config.json — keep adapter env clean
+ *            "<containerIntegrationHomeDir>/__mcp_shims__/<id>/config.json"],
+ *     env: {}     // upstream env is encoded in config.json — keep integration env clean
  *   }
  *
- * The adapter is responsible for:
+ * The integration is responsible for:
  *   - Adding `enabled: true` (or whatever flag its config schema needs).
  *   - Picking the `mcp_servers` map key (typically capabilityId).
  */
 import type { ToolSchema } from "../../../types.js";
 export interface WriteMcpEntryArgs {
-    /** Host-side path where the agent's home directory lives. */
-    agentHomeDir: string;
+    /** Host-side path where the integration-managed home directory lives. */
+    integrationHomeDir: string;
     /**
-     * Container-side equivalent of agentHomeDir — used to compose the
-     * absolute path the agent process will exec. For Hermes that's
+     * Container-side equivalent of integrationHomeDir — used to compose the
+     * absolute path the integration process will exec. For Hermes that's
      * `/opt/data` (HERMES_CONTAINER_HOME).
      */
-    containerHomeDir: string;
+    containerIntegrationHomeDir: string;
     /** Capability ID (e.g. "search-searxng"); also used as the on-disk subdir. */
     capabilityId: string;
     /** Canonical tool surface — copied into config.json verbatim. */
@@ -55,8 +55,8 @@ export interface WriteMcpEntryResult {
     args: string[];
     /**
      * Env to put under `mcp_servers.<key>.env`. Always empty — upstream
-     * env is funneled through firewall config.json so adapter config
-     * stays minimal. Adapters should still write this key so any prior
+     * env is funneled through firewall config.json so integration config
+     * stays minimal. Integrations should still write this key so any prior
      * env entries get cleared on overwrite.
      */
     env: Record<string, string>;
@@ -73,8 +73,8 @@ export declare function writeMcpEntry(args: WriteMcpEntryArgs): WriteMcpEntryRes
  *
  * Note: this returns the host:port as the registry resolved at the time
  * the consumer's PUT /connections was processed. To keep this fresh
- * across host IP changes, the framework re-runs adapter.applyConnectionEnv
- * before each instance start (see nomad-manager.phaseRefreshConnections,
+ * across host IP changes, the framework re-runs integration.applyConnectionEnv
+ * before each instance start (see the Nomad driver's connection refresh phase,
  * §17/PR 9). That re-render path passes a fresh env map here.
  *
  * Unresolved placeholders are left as-is (caller can decide whether to

package/dist/services/runtime/mcp-shims/write-mcp-entry.js

@@ -1,25 +1,25 @@
 /**
- * writeMcpEntry — adapter helper that materializes the MCP firewall
- * (see firewall.ts) into an instance's agent-home and returns the
- * `mcp_servers.<X>` block the adapter should write into its own config.
+ * writeMcpEntry — integration helper that materializes the MCP firewall
+ * (see firewall.ts) into an instance's integration home and returns the
+ * `mcp_servers.<X>` block the integration should write into its own config.
  *
- * Called by adapters from `applyConnectionEnv` (PR 8 / docs §17.3.3).
+ * Called by integrations from `applyConnectionEnv` (PR 8 / docs §17.3.3).
  *
  * Side effects on the host filesystem:
- *   - <agentHomeDir>/__mcp_shims__/<capabilityId>/firewall.mjs
- *   - <agentHomeDir>/__mcp_shims__/<capabilityId>/config.json
+ *   - <integrationHomeDir>/__mcp_shims__/<capabilityId>/firewall.mjs
+ *   - <integrationHomeDir>/__mcp_shims__/<capabilityId>/config.json
  *   - chown both to serviceUser if provided (best-effort)
  *
- * Pure return value (the adapter applies it to its own config schema):
+ * Pure return value (the integration applies it to its own config schema):
  *   {
  *     command: "node",
- *     args: ["<containerHomeDir>/__mcp_shims__/<id>/firewall.mjs",
+ *     args: ["<containerIntegrationHomeDir>/__mcp_shims__/<id>/firewall.mjs",
  *            "--config",
- *            "<containerHomeDir>/__mcp_shims__/<id>/config.json"],
- *     env: {}     // upstream env is encoded in config.json — keep adapter env clean
+ *            "<containerIntegrationHomeDir>/__mcp_shims__/<id>/config.json"],
+ *     env: {}     // upstream env is encoded in config.json — keep integration env clean
  *   }
  *
- * The adapter is responsible for:
+ * The integration is responsible for:
  *   - Adding `enabled: true` (or whatever flag its config schema needs).
  *   - Picking the `mcp_servers` map key (typically capabilityId).
  */
@@ -30,8 +30,8 @@ const SHIM_ROOT = "__mcp_shims__";
 const FIREWALL_FILENAME = "firewall.mjs";
 const CONFIG_FILENAME = "config.json";
 export function writeMcpEntry(args) {
-    const { agentHomeDir, containerHomeDir, capabilityId, toolSchema, upstreamEnv, serviceUser, } = args;
-    const hostShimDir = join(agentHomeDir, SHIM_ROOT, capabilityId);
+    const { integrationHomeDir, containerIntegrationHomeDir, capabilityId, toolSchema, upstreamEnv, serviceUser, } = args;
+    const hostShimDir = join(integrationHomeDir, SHIM_ROOT, capabilityId);
     const hostFirewall = join(hostShimDir, FIREWALL_FILENAME);
     const hostConfig = join(hostShimDir, CONFIG_FILENAME);
     mkdirSync(hostShimDir, { recursive: true });
@@ -67,7 +67,7 @@ export function writeMcpEntry(args) {
     }
     // Build container-side absolute path. Always POSIX-style — container
     // OSes are Linux even when host is not.
-    const containerShimDir = posix.join(containerHomeDir, SHIM_ROOT, capabilityId);
+    const containerShimDir = posix.join(containerIntegrationHomeDir, SHIM_ROOT, capabilityId);
     return {
         command: "node",
         args: [
@@ -89,8 +89,8 @@ export function writeMcpEntry(args) {
  *
  * Note: this returns the host:port as the registry resolved at the time
  * the consumer's PUT /connections was processed. To keep this fresh
- * across host IP changes, the framework re-runs adapter.applyConnectionEnv
- * before each instance start (see nomad-manager.phaseRefreshConnections,
+ * across host IP changes, the framework re-runs integration.applyConnectionEnv
+ * before each instance start (see the Nomad driver's connection refresh phase,
  * §17/PR 9). That re-render path passes a fresh env map here.
  *
  * Unresolved placeholders are left as-is (caller can decide whether to

package/dist/services/runtime/mcp-shims/write-mcp-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-mcp-entry.js","sourceRoot":"","sources":["../../../../src/services/runtime/mcp-shims/write-mcp-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAuCpD,MAAM,SAAS,GAAG,eAAe,CAAC;AAClC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,eAAe,GAAG,aAAa,CAAC;AAEtC,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,MAAM,EACJ,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,WAAW,GACZ,GAAG,IAAI,CAAC;IAET,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAEtD,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,oEAAoE;IACpE,2EAA2E;IAC3E,aAAa,CAAC,YAAY,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAElE,wBAAwB;IACxB,MAAM,MAAM,GAAG;QACb,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE;YACX,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,gEAAgE;YAChE,WAAW,EAAE,UAAU,CAAC,UAAU;SACnC;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO;YACpC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE;YACpC,GAAG,EAAE,WAAW;SACjB;QACD,YAAY,EAAE,UAAU,CAAC,YAAY,KAAK,KAAK;KAChD,CAAC;IACF,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5E,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YACnE,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YAC1D,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,wCAAwC;IACxC,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC/E,OAAO;QACL,OAAO,EAAE,MAAM;QACf,IAAI,EAAE;YACJ,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;YAC/C,UAAU;YACV,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC;SAC9C;QACD,GAAG,EAAE,EAAE;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA4C,EAC5C,SAAiC;IAEjC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE;YACjE,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBAClD,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;oBAC3C,IAAI,CAAC;wBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;wBAC3B,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU;4BAAE,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;wBAC3E,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACzC,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,OAAO,CAAC;oBACjB,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC5B,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"write-mcp-entry.js","sourceRoot":"","sources":["../../../../src/services/runtime/mcp-shims/write-mcp-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAuCpD,MAAM,SAAS,GAAG,eAAe,CAAC;AAClC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,eAAe,GAAG,aAAa,CAAC;AAEtC,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,MAAM,EACJ,kBAAkB,EAClB,2BAA2B,EAC3B,YAAY,EACZ,UAAU,EACV,WAAW,EACX,WAAW,GACZ,GAAG,IAAI,CAAC;IAET,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAEtD,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,oEAAoE;IACpE,2EAA2E;IAC3E,aAAa,CAAC,YAAY,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAElE,wBAAwB;IACxB,MAAM,MAAM,GAAG;QACb,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE;YACX,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,gEAAgE;YAChE,WAAW,EAAE,UAAU,CAAC,UAAU;SACnC;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO;YACpC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE;YACpC,GAAG,EAAE,WAAW;SACjB;QACD,YAAY,EAAE,UAAU,CAAC,YAAY,KAAK,KAAK;KAChD,CAAC;IACF,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5E,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YACnE,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YAC1D,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,wCAAwC;IACxC,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,2BAA2B,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC1F,OAAO;QACL,OAAO,EAAE,MAAM;QACf,IAAI,EAAE;YACJ,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;YAC/C,UAAU;YACV,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC;SAC9C;QACD,GAAG,EAAE,EAAE;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA4C,EAC5C,SAAiC;IAEjC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE;YACjE,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBAClD,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;oBAC3C,IAAI,CAAC;wBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;wBAC3B,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU;4BAAE,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;wBAC3E,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACzC,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,OAAO,CAAC;oBACjB,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC5B,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/services/runtime/ownership-marker.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Ownership marker for integration home directories (Step 5 of the App
+ * Lifecycle Runtime architecture decision).
+ *
+ * Problem this module solves:
+ *   OpenClaw and Hermes bootstrap create a "home" directory that lives
+ *   either inside the per-instance dir (default Hermes, default OpenClaw)
+ *   or at a user-specified custom OpenClaw integration-home path.
+ *   The pre-Step-5 logic used "directory exists and is non-empty" as the
+ *   sole signal during install / rollback / uninstall, which conflates
+ *   three very different situations:
+ *
+ *     - Our previous install attempt failed and left a partial tree.
+ *     - Another instance owns this directory.
+ *     - The directory is a user-pre-existing tree (e.g. a hand-curated
+ *       `~/.openclaw-data` populated by the operator before installing
+ *       JishuShell) that must NEVER be deleted by our rollback path.
+ *
+ *   This module disambiguates the three by writing a small JSON marker
+ *   file at install time. Marker presence + matching `instanceId` is the
+ *   single canonical proof that "Core created and owns this tree".
+ *
+ * Strict invariants (doc Section 10, Step 5 禁止误判):
+ *   - Marker presence does NOT imply the instance is running. The marker
+ *     is consulted ONLY at create-time pre-check, install rollback, and
+ *     uninstall — never by status / start / proxy / reconciler paths.
+ *   - Marker absence on a non-empty directory means "user data" and our
+ *     code MUST refuse to wipe it.
+ *   - The marker carries no secrets; the `instanceId` is already exposed
+ *     in URL paths and process listings.
+ *   - Marker writes are atomic via fs `writeFileSync` of the final path;
+ *     a partially-written marker is treated the same as a missing one by
+ *     `readOwnershipMarker` (JSON parse failure → null).
+ */
+export declare const OWNERSHIP_MARKER_FILENAME = ".jishushell-owned";
+export interface OwnershipMarker {
+    /** Canonical Core instance id (`AppInstance.id`). */
+    instanceId: string;
+    /**
+     * The runtime integration kind that created the directory tree
+     * (e.g. "openclaw", "hermes"). Useful for diagnostics and future
+     * integration-aware migration; the install/rollback path does NOT branch
+     * on this field for ownership decisions — `instanceId` match alone is
+     * the authoritative signal.
+     */
+    integrationKind: string;
+    /** ISO-8601 timestamp captured at marker write time. */
+    createdAt: string;
+    /**
+     * Marker schema version. Bumped only when on-disk shape changes; the
+     * reader treats unknown future versions as "owned but opaque" so an
+     * older Core does not accidentally wipe a tree owned by a newer Core.
+     */
+    schemaVersion: 1;
+}
+/**
+ * Write the ownership marker into `dir`. Caller MUST have already
+ * ensured `dir` exists. Overwrites an existing marker (e.g. when
+ * recovering from a previous failed install for the same `instanceId`).
+ */
+export declare function writeOwnershipMarker(dir: string, info: {
+    instanceId: string;
+    integrationKind: string;
+}): void;
+/**
+ * Read the ownership marker from `dir`. Returns `null` for:
+ *   - missing file (most common; either the directory is user data,
+ *     legacy-migrated state, or has never been touched by Core),
+ *   - unreadable or non-JSON file (treated as "no proof of ownership",
+ *     consistent with the "refuse to wipe without proof" invariant),
+ *   - JSON missing required fields,
+ *   - schemaVersion newer than this Core knows how to interpret (we
+ *     refuse to assume ownership for a tree that a newer Core may
+ *     still depend on).
+ */
+export declare function readOwnershipMarker(dir: string): OwnershipMarker | null;
+/**
+ * True if and only if `dir` has a valid marker whose `instanceId`
+ * matches `instanceId`. This is the canonical "Core created this tree
+ * as part of THIS instance" check and is the only signal install
+ * rollback / uninstall may use to decide whether to remove `dir`.
+ */
+export declare function isOwnedByInstance(dir: string, instanceId: string): boolean;

package/dist/services/runtime/ownership-marker.js

@@ -0,0 +1,109 @@
+/**
+ * Ownership marker for integration home directories (Step 5 of the App
+ * Lifecycle Runtime architecture decision).
+ *
+ * Problem this module solves:
+ *   OpenClaw and Hermes bootstrap create a "home" directory that lives
+ *   either inside the per-instance dir (default Hermes, default OpenClaw)
+ *   or at a user-specified custom OpenClaw integration-home path.
+ *   The pre-Step-5 logic used "directory exists and is non-empty" as the
+ *   sole signal during install / rollback / uninstall, which conflates
+ *   three very different situations:
+ *
+ *     - Our previous install attempt failed and left a partial tree.
+ *     - Another instance owns this directory.
+ *     - The directory is a user-pre-existing tree (e.g. a hand-curated
+ *       `~/.openclaw-data` populated by the operator before installing
+ *       JishuShell) that must NEVER be deleted by our rollback path.
+ *
+ *   This module disambiguates the three by writing a small JSON marker
+ *   file at install time. Marker presence + matching `instanceId` is the
+ *   single canonical proof that "Core created and owns this tree".
+ *
+ * Strict invariants (doc Section 10, Step 5 禁止误判):
+ *   - Marker presence does NOT imply the instance is running. The marker
+ *     is consulted ONLY at create-time pre-check, install rollback, and
+ *     uninstall — never by status / start / proxy / reconciler paths.
+ *   - Marker absence on a non-empty directory means "user data" and our
+ *     code MUST refuse to wipe it.
+ *   - The marker carries no secrets; the `instanceId` is already exposed
+ *     in URL paths and process listings.
+ *   - Marker writes are atomic via fs `writeFileSync` of the final path;
+ *     a partially-written marker is treated the same as a missing one by
+ *     `readOwnershipMarker` (JSON parse failure → null).
+ */
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+export const OWNERSHIP_MARKER_FILENAME = ".jishushell-owned";
+/**
+ * Write the ownership marker into `dir`. Caller MUST have already
+ * ensured `dir` exists. Overwrites an existing marker (e.g. when
+ * recovering from a previous failed install for the same `instanceId`).
+ */
+export function writeOwnershipMarker(dir, info) {
+    const marker = {
+        instanceId: info.instanceId,
+        integrationKind: info.integrationKind,
+        createdAt: new Date().toISOString(),
+        schemaVersion: 1,
+    };
+    writeFileSync(join(dir, OWNERSHIP_MARKER_FILENAME), JSON.stringify(marker, null, 2) + "\n", "utf-8");
+}
+/**
+ * Read the ownership marker from `dir`. Returns `null` for:
+ *   - missing file (most common; either the directory is user data,
+ *     legacy-migrated state, or has never been touched by Core),
+ *   - unreadable or non-JSON file (treated as "no proof of ownership",
+ *     consistent with the "refuse to wipe without proof" invariant),
+ *   - JSON missing required fields,
+ *   - schemaVersion newer than this Core knows how to interpret (we
+ *     refuse to assume ownership for a tree that a newer Core may
+ *     still depend on).
+ */
+export function readOwnershipMarker(dir) {
+    const path = join(dir, OWNERSHIP_MARKER_FILENAME);
+    if (!existsSync(path))
+        return null;
+    let raw;
+    try {
+        raw = readFileSync(path, "utf-8");
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object")
+        return null;
+    const obj = parsed;
+    if (typeof obj.instanceId !== "string" || !obj.instanceId)
+        return null;
+    if (typeof obj.integrationKind !== "string" || !obj.integrationKind)
+        return null;
+    if (typeof obj.createdAt !== "string" || !obj.createdAt)
+        return null;
+    if (obj.schemaVersion !== 1)
+        return null;
+    return {
+        instanceId: obj.instanceId,
+        integrationKind: obj.integrationKind,
+        createdAt: obj.createdAt,
+        schemaVersion: 1,
+    };
+}
+/**
+ * True if and only if `dir` has a valid marker whose `instanceId`
+ * matches `instanceId`. This is the canonical "Core created this tree
+ * as part of THIS instance" check and is the only signal install
+ * rollback / uninstall may use to decide whether to remove `dir`.
+ */
+export function isOwnedByInstance(dir, instanceId) {
+    const marker = readOwnershipMarker(dir);
+    return marker !== null && marker.instanceId === instanceId;
+}
+//# sourceMappingURL=ownership-marker.js.map

package/dist/services/runtime/ownership-marker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership-marker.js","sourceRoot":"","sources":["../../../src/services/runtime/ownership-marker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAuB7D;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,IAAqD;IAErD,MAAM,MAAM,GAAoB;QAC9B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,aAAa,EAAE,CAAC;KACjB,CAAC;IACF,aAAa,CACX,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,EACpC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACtC,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACjF,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,GAAG,CAAC,aAAa,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,aAAa,EAAE,CAAC;KACjB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,UAAkB;IAC/D,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC;AAC7D,CAAC"}