jishushell 0.6.5 → 0.7.3

package/dist/services/app/openclaw-manager.js

@@ -1,1215 +0,0 @@
-/**
- * OpenClaw App-type Manager
- *
- * Encapsulates ALL logic specific to the "openclaw" app type:
- *   - Instance directory layout  (openclaw-home/.openclaw/openclaw.json)
- *   - defaultRuntime / starterConfig builders
- *   - Config load / save  (openclaw.json + env files)
- *   - IM channel plugin installation  (Feishu, WeChat, …)
- *   - Feishu / WeChat credential persistence
- *   - Pre-start validation and Docker config patching
- *
- * nomad-manager.ts owns the Nomad task/job spec builders; it imports
- * getOpenclawHome / getOpenclawConfigPath etc. from here.
- *
- * Generic utilities (port allocation, listInstances, …) are imported
- * from instance-manager.ts which is the public facade kept for backward
- * compatibility with all existing callers.
- */
-import { execFile, execFileSync } from "child_process";
-import { randomBytes } from "crypto";
-import { chmodSync, chownSync, copyFileSync, cpSync, existsSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, } from "fs";
-import { userInfo } from "os";
-import { dirname, join, resolve } from "path";
-import { INSTANCES_DIR, JISHUSHELL_HOME, getInstanceDir, getMaxAppMemoryMB, instanceMetaPath, } from "../../config.js";
-import { inspectDockerImage, toDockerInspectUserError } from "../../utils/docker-inspect.js";
-import { safeReadJson, safeWriteJson } from "../../utils/safe-json.js";
-import { ensureDirContainer, writeConfigFile } from "../../utils/fs.js";
-import { compileTaskRuntime } from "./app-compiler.js";
-import { getInstance, listInstances, resolveServiceUser, chownToServiceUser, getRuntimeEnvFiles, getRuntimeEnv, updateEnvFile, defaultGatewayPort, releasePort, inferProviderApiKeyEnvName, notifyConfigChange, getGatewayPort, getInstanceRuntime, } from "../instance-manager.js";
-import { decryptApiKey } from "../llm-proxy/encryption.js";
-import { getDefaultLlmProvider, normalizeProviderApi } from "../llm-proxy/providers.js";
-// ── OpenClaw-specific constants ──────────────────────────────────────────────
-export const INSTANCE_OPENCLAW_HOME_DIRNAME = "openclaw-home";
-export const INSTANCE_MODEL_ENV_FILENAME = "model.env";
-const OPENCLAW_STATE_DIRNAME = ".openclaw";
-const OPENCLAW_CONFIG_FILENAME = "openclaw.json";
-// ── Private utilities ────────────────────────────────────────────────────────
-function normalizePath(p) {
-    return resolve(p.replace(/^~/, userInfo().homedir));
-}
-function deepMerge(base, overlay) {
-    if (typeof base !== "object" || base === null ||
-        typeof overlay !== "object" || overlay === null ||
-        Array.isArray(base) || Array.isArray(overlay)) {
-        return structuredClone(overlay);
-    }
-    const merged = structuredClone(base);
-    for (const key of Object.keys(overlay)) {
-        merged[key] = key in merged ? deepMerge(merged[key], overlay[key]) : structuredClone(overlay[key]);
-    }
-    return merged;
-}
-function loadJson(path) {
-    try {
-        return JSON.parse(readFileSync(path, "utf-8"));
-    }
-    catch (e) {
-        console.warn(`[openclaw] Failed to parse ${path}: ${e.message}`);
-        return null;
-    }
-}
-// ── Path helpers ─────────────────────────────────────────────────────────────
-export function defaultOpenclawHome(instanceId) {
-    return join(getInstanceDir(instanceId), INSTANCE_OPENCLAW_HOME_DIRNAME);
-}
-export function defaultModelEnvFile(instanceId) {
-    return join(getInstanceDir(instanceId), INSTANCE_MODEL_ENV_FILENAME);
-}
-export function getOpenclawHome(instanceId) {
-    const meta = getInstance(instanceId);
-    return meta?.openclaw_home || defaultOpenclawHome(instanceId);
-}
-export function openclawStateDir(instanceId) {
-    return join(getOpenclawHome(instanceId), OPENCLAW_STATE_DIRNAME);
-}
-function legacyOpenclawConfigPath(instanceId) {
-    return join(getOpenclawHome(instanceId), OPENCLAW_CONFIG_FILENAME);
-}
-function openclawConfigPathInternal(instanceId) {
-    return join(openclawStateDir(instanceId), OPENCLAW_CONFIG_FILENAME);
-}
-export function getOpenclawConfigPath(instanceId) {
-    return openclawConfigPathInternal(instanceId);
-}
-export function getLegacyOpenclawConfigPath(instanceId) {
-    return legacyOpenclawConfigPath(instanceId);
-}
-function resolveExistingConfigPath(instanceId) {
-    const runtimePath = openclawConfigPathInternal(instanceId);
-    if (existsSync(runtimePath))
-        return runtimePath;
-    const legacyPath = legacyOpenclawConfigPath(instanceId);
-    if (existsSync(legacyPath))
-        return legacyPath;
-    return runtimePath;
-}
-export function getChannelExtensionsDir(instanceId) {
-    return join(getOpenclawHome(instanceId), OPENCLAW_STATE_DIRNAME, "extensions");
-}
-export function getStockExtensionsDir() {
-    return join(JISHUSHELL_HOME, "packages", "openclaw", "lib", "node_modules", "openclaw", "extensions");
-}
-// ── OpenClaw binary resolution ───────────────────────────────────────────────
-function resolveOpenclawBin() {
-    const candidates = [
-        join(JISHUSHELL_HOME, "packages", "openclaw", "bin", "openclaw"),
-        "/usr/local/bin/openclaw",
-        "/usr/bin/openclaw",
-    ];
-    for (const p of candidates) {
-        if (existsSync(p)) {
-            try {
-                execFileSync("chmod", ["+x", p], { timeout: 3000 });
-            }
-            catch { /* best effort */ }
-            try {
-                const real = realpathSync(p);
-                if (real !== p) {
-                    try {
-                        execFileSync("chmod", ["+x", real], { timeout: 3000 });
-                    }
-                    catch { /* best effort */ }
-                }
-            }
-            catch { /* best effort */ }
-            return p;
-        }
-    }
-    return candidates[0];
-}
-export function getResolvedOpenclawBin() {
-    return resolveOpenclawBin();
-}
-// ── Runtime / config builders ────────────────────────────────────────────────
-async function buildDefaultRuntime(instanceId, openclawHome) {
-    const port = await defaultGatewayPort(instanceId);
-    const svcUser = resolveServiceUser();
-    return {
-        runtime: {
-            command: resolveOpenclawBin(),
-            args: ["gateway", "run", "--port", String(port), "--allow-unconfigured"],
-            cwd: openclawHome,
-            user: svcUser?.username ?? userInfo().username,
-            env_files: [defaultModelEnvFile(instanceId)],
-            env: {
-                OPENCLAW_GATEWAY_PORT: String(port),
-                NODE_OPTIONS: "--max-old-space-size=2048",
-            },
-            resources: { CPU: 1000, MemoryMB: 2048 },
-        },
-        allocatedPort: port,
-    };
-}
-export function buildStarterConfig() {
-    const dp = getDefaultLlmProvider();
-    let providerName = "minimax";
-    let providerConfig = {
-        baseUrl: "https://api.minimaxi.com/v1",
-        api: "openai-completions",
-        models: [{ id: "MiniMax-M2.7", name: "MiniMax M2.7", contextWindow: 204800 }],
-    };
-    let defaultModel = "minimax/MiniMax-M2.7";
-    if (dp?.id) {
-        providerName = dp.id;
-        providerConfig = {
-            baseUrl: dp.baseUrl,
-            api: normalizeProviderApi(dp.api),
-            ...(dp.authHeader ? { authHeader: true } : {}),
-            models: dp.models || [],
-        };
-        const modelId = dp.selectedModelId || dp.models?.[0]?.id || "";
-        defaultModel = `${providerName}/${modelId}`;
-    }
-    const config = {
-        models: { providers: { [providerName]: providerConfig } },
-        agents: { defaults: { model: defaultModel, models: { [defaultModel]: {} } } },
-        channels: {},
-        gateway: {
-            mode: "local",
-            auth: { mode: "token", token: randomBytes(24).toString("hex") },
-            controlUi: { dangerouslyDisableDeviceAuth: true },
-        },
-        plugins: { entries: { feishu: { enabled: false } } },
-    };
-    if (dp?.id) {
-        config["x-jishushell"] = {
-            proxy: {
-                upstream: {
-                    providerId: dp.id,
-                    baseUrl: dp.baseUrl,
-                    api: normalizeProviderApi(dp.api),
-                    authHeader: dp.authHeader === true || typeof dp.authHeader === "string",
-                    models: dp.models || [],
-                    selectedModelId: dp.selectedModelId || dp.models?.[0]?.id || "",
-                    hasApiKey: !!dp.apiKey,
-                },
-            },
-        };
-    }
-    return config;
-}
-// backward-compat alias used by existing callers
-export { buildStarterConfig as starterConfig };
-// ── Config loading ───────────────────────────────────────────────────────────
-function loadEffectiveConfig(instanceId) {
-    const runtimePath = openclawConfigPathInternal(instanceId);
-    const legacyPath = legacyOpenclawConfigPath(instanceId);
-    const rExists = existsSync(runtimePath);
-    const lExists = existsSync(legacyPath);
-    if (rExists && lExists) {
-        const legacy = loadJson(legacyPath);
-        const runtime = loadJson(runtimePath);
-        if (legacy && runtime)
-            return deepMerge(legacy, runtime);
-        return runtime || legacy || null;
-    }
-    if (rExists)
-        return loadJson(runtimePath);
-    if (lExists)
-        return loadJson(legacyPath);
-    return null;
-}
-// ── Provider key helpers ─────────────────────────────────────────────────────
-function hasConfiguredValue(value) {
-    if (typeof value === "string")
-        return value.trim().length > 0;
-    if (typeof value === "object" && value !== null)
-        return Object.keys(value).length > 0;
-    return value != null;
-}
-function injectProviderApiKeys(instanceId, config) {
-    const merged = structuredClone(config);
-    const runtimeEnv = getRuntimeEnv(instanceId);
-    const providers = merged.models?.providers || {};
-    for (const [providerId, provider] of Object.entries(providers)) {
-        if (typeof provider !== "object" || provider === null)
-            continue;
-        const p = provider;
-        p.api = normalizeProviderApi(typeof p.api === "string" ? p.api : undefined);
-        const apiKey = runtimeEnv[inferProviderApiKeyEnvName(providerId)];
-        if (apiKey)
-            p.apiKey = apiKey;
-    }
-    return merged;
-}
-function applyFeishuDebugAccessDefaults(channel) {
-    if (channel.enabled === false)
-        return;
-    if (!hasConfiguredValue(channel.appId))
-        return;
-    if (!hasConfiguredValue(channel.appSecret))
-        return;
-    let dmPolicy = channel.dmPolicy;
-    if (typeof dmPolicy !== "string" || !dmPolicy.trim()) {
-        channel.dmPolicy = "open";
-        dmPolicy = "open";
-    }
-    if (dmPolicy !== "open")
-        return;
-    if (!("resolveSenderNames" in channel))
-        channel.resolveSenderNames = false;
-    let accounts = channel.accounts;
-    if (typeof accounts !== "object" || accounts === null) {
-        accounts = {};
-        channel.accounts = accounts;
-    }
-    let defaultAccount = accounts.default;
-    if (typeof defaultAccount !== "object" || defaultAccount === null) {
-        defaultAccount = {};
-        accounts.default = defaultAccount;
-    }
-    if (!("resolveSenderNames" in defaultAccount))
-        defaultAccount.resolveSenderNames = false;
-    const allowFrom = channel.allowFrom;
-    if (Array.isArray(allowFrom)) {
-        const normalized = allowFrom.map((e) => String(e).trim()).filter(Boolean);
-        if (!normalized.includes("*"))
-            normalized.push("*");
-        channel.allowFrom = normalized;
-        return;
-    }
-    channel.allowFrom = ["*"];
-}
-function prepareConfigForSave(instanceId, config) {
-    const configToWrite = structuredClone(config);
-    delete configToWrite["x-jishushell"];
-    const envUpdates = {};
-    const providers = configToWrite.models?.providers || {};
-    const envFiles = getRuntimeEnvFiles(instanceId);
-    const channels = configToWrite.channels || {};
-    const plugins = configToWrite.plugins ??= {};
-    const pluginEntries = plugins.entries ??= {};
-    for (const [providerId, provider] of Object.entries(providers)) {
-        if (typeof provider !== "object" || provider === null)
-            continue;
-        const p = provider;
-        p.api = normalizeProviderApi(typeof p.api === "string" ? p.api : undefined);
-        if (!("apiKey" in p))
-            continue;
-        if (typeof p.baseUrl === "string" && p.baseUrl.includes("/proxy/"))
-            continue;
-        const apiKey = p.apiKey;
-        delete p.apiKey;
-        if (envFiles.length) {
-            envUpdates[inferProviderApiKeyEnvName(providerId)] = decryptRuntimeProviderApiKey(apiKey);
-        }
-        else {
-            p.apiKey = apiKey;
-        }
-    }
-    for (const [channelId, channel] of Object.entries(channels)) {
-        if (typeof channel !== "object" || channel === null)
-            continue;
-        const ch = channel;
-        if (channelId === "feishu" || channelId === "lark")
-            applyFeishuDebugAccessDefaults(ch);
-        let pluginEntry = pluginEntries[channelId];
-        if (pluginEntry == null) {
-            pluginEntry = {};
-            pluginEntries[channelId] = pluginEntry;
-        }
-        if (typeof pluginEntry === "object") {
-            pluginEntry.enabled = ch.enabled !== false;
-        }
-    }
-    return [configToWrite, envUpdates];
-}
-function decryptRuntimeProviderApiKey(apiKey) {
-    const value = String(apiKey || "");
-    return value.startsWith("enc:") ? decryptApiKey(value) : value;
-}
-function decryptRuntimeProviderEnv(env) {
-    for (const [key, value] of Object.entries(env)) {
-        if (!key.endsWith("_API_KEY"))
-            continue;
-        if (!String(value || "").startsWith("enc:"))
-            continue;
-        env[key] = decryptApiKey(value);
-    }
-}
-// ── IM channel plugin helpers ────────────────────────────────────────────────
-const CHANNEL_EXT_DIR_ALIAS = {
-    feishu: "openclaw-lark",
-    lark: "openclaw-lark",
-};
-export const CHANNEL_PLUGIN_MAP = {
-    feishu: "@larksuite/openclaw-lark",
-    lark: "@larksuite/openclaw-lark",
-    telegram: "@openclaw/telegram",
-    discord: "@openclaw/discord",
-    slack: "@openclaw/slack",
-    whatsapp: "@openclaw/whatsapp",
-    signal: "@openclaw/signal",
-    line: "@openclaw/line",
-    msteams: "@openclaw/msteams",
-    "openclaw-weixin": "@tencent-weixin/openclaw-weixin",
-};
-const IM_PLUGIN_ENTRY_IDS = new Set([
-    ...Object.keys(CHANNEL_PLUGIN_MAP),
-    ...Object.values(CHANNEL_EXT_DIR_ALIAS),
-]);
-export function stripImBindings(config) {
-    if (config?.channels)
-        delete config.channels;
-    const entries = config?.plugins?.entries;
-    if (entries && typeof entries === "object") {
-        for (const key of Object.keys(entries)) {
-            if (IM_PLUGIN_ENTRY_IDS.has(key))
-                delete entries[key];
-        }
-    }
-}
-export function isChannelPluginInstalled(instanceId, channelId) {
-    const extDirName = CHANNEL_EXT_DIR_ALIAS[channelId] || channelId;
-    const stockExtDir = getStockExtensionsDir();
-    if (existsSync(join(getChannelExtensionsDir(instanceId), extDirName)))
-        return true;
-    if (existsSync(join(stockExtDir, extDirName)))
-        return true;
-    if (extDirName !== channelId && existsSync(join(stockExtDir, channelId)))
-        return true;
-    // OpenClaw's npm-backed plugin store lives at
-    // `<home>/.openclaw/npm/node_modules/<pkg>`. The CLI refuses to reinstall
-    // when that path is present ("plugin already exists ... delete it first"),
-    // even if the per-instance extensions/<name> dir is missing (e.g. the
-    // first install was interrupted, or the dir was manually cleaned). Treat
-    // the npm path as authoritative so re-saves stay idempotent.
-    const pkg = CHANNEL_PLUGIN_MAP[channelId];
-    if (pkg) {
-        const npmPath = join(getOpenclawHome(instanceId), OPENCLAW_STATE_DIRNAME, "npm", "node_modules", ...pkg.split("/"));
-        if (existsSync(npmPath))
-            return true;
-    }
-    return false;
-}
-export async function installChannelPlugin(instanceId, channelId) {
-    const pkg = CHANNEL_PLUGIN_MAP[channelId];
-    if (!pkg)
-        throw new Error(`Unknown channel: ${channelId}`);
-    if (isChannelPluginInstalled(instanceId, channelId))
-        return;
-    const openclawHome = getOpenclawHome(instanceId);
-    const extensionsDir = getChannelExtensionsDir(instanceId);
-    const { getNomadDriver } = await import("../../config.js");
-    if (getNomadDriver() === "docker") {
-        await installChannelPluginViaDocker(instanceId, channelId, pkg, extensionsDir);
-        return;
-    }
-    const openclawBin = resolveOpenclawBin();
-    const nodeBinDir = dirname(process.execPath);
-    const childPath = [nodeBinDir, process.env.PATH].filter(Boolean).join(":");
-    const proxyEnvKeys = [
-        "http_proxy", "HTTP_PROXY", "https_proxy", "HTTPS_PROXY",
-        "no_proxy", "NO_PROXY", "NODE_EXTRA_CA_CERTS", "NODE_TLS_REJECT_UNAUTHORIZED",
-    ];
-    const proxyEnv = {};
-    for (const key of proxyEnvKeys) {
-        if (process.env[key])
-            proxyEnv[key] = process.env[key];
-    }
-    const childEnv = {
-        PATH: childPath,
-        HOME: process.env.HOME,
-        LANG: process.env.LANG,
-        OPENCLAW_HOME: openclawHome,
-        ...proxyEnv,
-    };
-    const MAX_ATTEMPTS = 3;
-    const RETRY_DELAY_MS = 5_000;
-    const attemptInstall = () => new Promise((res, rej) => {
-        execFile(openclawBin, ["plugins", "install", pkg], { cwd: openclawHome, env: childEnv, timeout: 300_000 }, (err, stdout, stderr) => {
-            if (err && !isChannelPluginInstalled(instanceId, channelId)) {
-                const msg = [stderr?.trim(), stdout?.trim(), err.message].filter(Boolean).join(" | ");
-                console.error(`[openclaw-plugins] ${pkg} exit code ${err.code ?? "?"}`);
-                try {
-                    if (existsSync(extensionsDir)) {
-                        for (const entry of readdirSync(extensionsDir)) {
-                            if (entry.startsWith(".openclaw-install-stage-")) {
-                                rmSync(join(extensionsDir, entry), { recursive: true, force: true });
-                            }
-                        }
-                    }
-                }
-                catch { /* best effort */ }
-                rej(new Error(msg));
-            }
-            else {
-                res();
-            }
-        });
-    });
-    console.log(`[openclaw-plugins] Installing ${pkg} for ${channelId} (host)...`);
-    let lastErr;
-    for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
-        try {
-            await attemptInstall();
-            const extDirName = CHANNEL_EXT_DIR_ALIAS[channelId] || channelId;
-            const installedExtDir = join(extensionsDir, extDirName);
-            if (existsSync(installedExtDir)) {
-                ensureDirContainer(installedExtDir);
-                try {
-                    for (const entry of readdirSync(installedExtDir, { withFileTypes: true })) {
-                        if (entry.isDirectory())
-                            ensureDirContainer(join(installedExtDir, entry.name));
-                    }
-                }
-                catch { /* best effort */ }
-            }
-            ensureDirContainer(extensionsDir);
-            return;
-        }
-        catch (err) {
-            lastErr = err;
-            const isFetchError = /fetch failed/i.test(err.message ?? "");
-            if (isFetchError && attempt < MAX_ATTEMPTS) {
-                console.warn(`[openclaw-plugins] ${pkg} install attempt ${attempt}/${MAX_ATTEMPTS} failed, retrying...`);
-                await new Promise(r => setTimeout(r, RETRY_DELAY_MS));
-                continue;
-            }
-            break;
-        }
-    }
-    throw lastErr;
-}
-async function installChannelPluginViaDocker(instanceId, channelId, pkg, extensionsDir) {
-    const { exec } = await import("../nomad-manager.js");
-    const MAX_ATTEMPTS = 3;
-    const RETRY_DELAY_MS = 5_000;
-    console.log(`[openclaw-plugins] Installing ${pkg} for ${channelId} via docker exec (${instanceId})...`);
-    let lastErr;
-    for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
-        try {
-            const result = await exec(instanceId, ["openclaw", "plugins", "install", pkg], 300_000);
-            if (result.exitCode !== 0 && !isChannelPluginInstalled(instanceId, channelId)) {
-                const msg = [result.stderr?.trim(), result.stdout?.trim()].filter(Boolean).join(" | ");
-                throw new Error(msg || `openclaw plugins install exited with code ${result.exitCode}`);
-            }
-            console.log(`[openclaw-plugins] ${pkg} installed via docker`);
-            const extDirName = CHANNEL_EXT_DIR_ALIAS[channelId] || channelId;
-            const installedExtDir = join(extensionsDir, extDirName);
-            if (existsSync(installedExtDir)) {
-                ensureDirContainer(installedExtDir);
-                try {
-                    for (const entry of readdirSync(installedExtDir, { withFileTypes: true })) {
-                        if (entry.isDirectory())
-                            ensureDirContainer(join(installedExtDir, entry.name));
-                    }
-                }
-                catch { /* best effort */ }
-            }
-            ensureDirContainer(extensionsDir);
-            return;
-        }
-        catch (err) {
-            lastErr = err;
-            if (/not running/i.test(err.message ?? "")) {
-                throw new Error("请先启动实例后再安装插件（Docker 模式下插件需在容器内安装）");
-            }
-            const isTransient = /fetch failed|ECONNREFUSED/i.test(err.message ?? "");
-            if (isTransient && attempt < MAX_ATTEMPTS) {
-                await new Promise(r => setTimeout(r, RETRY_DELAY_MS));
-                continue;
-            }
-            break;
-        }
-    }
-    throw lastErr;
-}
-// ── Public config API ────────────────────────────────────────────────────────
-export function getConfig(instanceId) {
-    const config = loadEffectiveConfig(instanceId);
-    if (!config)
-        return null;
-    const meta = getInstance(instanceId);
-    if (meta?.["x-jishushell"])
-        config["x-jishushell"] = meta["x-jishushell"];
-    return injectProviderApiKeys(instanceId, config);
-}
-export function getStoredConfig(instanceId) {
-    const config = loadEffectiveConfig(instanceId);
-    if (!config)
-        return null;
-    const meta = getInstance(instanceId);
-    if (meta?.["x-jishushell"])
-        config["x-jishushell"] = meta["x-jishushell"];
-    return config;
-}
-export function saveConfig(instanceId, config) {
-    const configPath = openclawConfigPathInternal(instanceId);
-    if (!existsSync(getInstanceDir(instanceId)))
-        return false;
-    if (!existsSync(configPath)) {
-        const legacyPath = legacyOpenclawConfigPath(instanceId);
-        ensureDirContainer(dirname(configPath));
-        if (existsSync(legacyPath))
-            copyFileSync(legacyPath, configPath);
-    }
-    if (config["x-jishushell"]) {
-        const metaPath = instanceMetaPath(instanceId);
-        if (existsSync(metaPath)) {
-            const meta = JSON.parse(readFileSync(metaPath, "utf-8"));
-            meta["x-jishushell"] = config["x-jishushell"];
-            safeWriteJson(metaPath, meta);
-            chownToServiceUser(metaPath);
-        }
-    }
-    const [configToWrite, envUpdates] = prepareConfigForSave(instanceId, config);
-    if (configToWrite.plugins?.entries?.["openclaw-lark"]?.enabled) {
-        const stockExtDir = getStockExtensionsDir();
-        const stockFeishu = join(stockExtDir, "feishu");
-        const stockOcl = join(stockExtDir, "openclaw-lark");
-        const instanceOcl = join(getChannelExtensionsDir(instanceId), "openclaw-lark");
-        if (existsSync(stockFeishu) && !existsSync(stockOcl) && !existsSync(instanceOcl)) {
-            configToWrite.plugins.entries.feishu = { enabled: true };
-            delete configToWrite.plugins.entries["openclaw-lark"];
-        }
-        else if (existsSync(stockFeishu)) {
-            configToWrite.plugins.entries.feishu = { enabled: false };
-        }
-    }
-    if (existsSync(configPath)) {
-        try {
-            const existing = JSON.parse(readFileSync(configPath, "utf-8"));
-            if (existing.plugins?.installs) {
-                configToWrite.plugins ??= {};
-                configToWrite.plugins.installs = { ...existing.plugins.installs, ...configToWrite.plugins?.installs };
-            }
-            if (existing.plugins?.entries && configToWrite.plugins?.entries) {
-                for (const [key, val] of Object.entries(configToWrite.plugins.entries)) {
-                    const old = existing.plugins.entries[key];
-                    if (val && typeof val === "object" && !Array.isArray(val) && old && typeof old === "object") {
-                        configToWrite.plugins.entries[key] = { ...old, ...val };
-                    }
-                }
-            }
-            if (existing.channels && configToWrite.channels) {
-                for (const [key, val] of Object.entries(configToWrite.channels)) {
-                    const old = existing.channels[key];
-                    if (val && typeof val === "object" && !Array.isArray(val) && old && typeof old === "object") {
-                        configToWrite.channels[key] = { ...old, ...val };
-                    }
-                }
-            }
-        }
-        catch { /* best effort */ }
-    }
-    if (existsSync(configPath))
-        copyFileSync(configPath, configPath + ".bak");
-    const configJson = JSON.stringify(configToWrite, null, 2);
-    ensureDirContainer(dirname(configPath));
-    writeConfigFile(configPath + ".tmp", configJson);
-    JSON.parse(readFileSync(configPath + ".tmp", "utf-8"));
-    renameSync(configPath + ".tmp", configPath);
-    chownToServiceUser(configPath);
-    const legacyPath = legacyOpenclawConfigPath(instanceId);
-    if (existsSync(legacyPath))
-        copyFileSync(legacyPath, legacyPath + ".bak");
-    writeConfigFile(legacyPath + ".tmp", configJson);
-    JSON.parse(readFileSync(legacyPath + ".tmp", "utf-8"));
-    renameSync(legacyPath + ".tmp", legacyPath);
-    chownToServiceUser(legacyPath);
-    if (Object.keys(envUpdates).length) {
-        const envFiles = getRuntimeEnvFiles(instanceId);
-        if (envFiles.length)
-            updateEnvFile(envFiles[0], envUpdates);
-    }
-    notifyConfigChange(instanceId);
-    return true;
-}
-// ── Credential management ────────────────────────────────────────────────────
-const FEISHU_APP_ID_RE = /^cli_[a-zA-Z0-9]{8,64}$/;
-export function saveFeishuCredentials(instanceId, creds) {
-    if (!FEISHU_APP_ID_RE.test(creds.appId)) {
-        throw new Error(`Invalid Feishu appId format: expected cli_<alnum> (got "${creds.appId}")`);
-    }
-    if (!creds.appSecret || typeof creds.appSecret !== "string" || creds.appSecret.length < 4) {
-        throw new Error("Invalid Feishu appSecret: must be a non-empty string");
-    }
-    const configPath = openclawConfigPathInternal(instanceId);
-    const config = safeReadJson(configPath, "feishu-creds") || {};
-    config.plugins ??= {};
-    config.plugins.entries ??= {};
-    config.plugins.entries.feishu = { enabled: false };
-    config.plugins.entries["openclaw-lark"] = { enabled: true };
-    config.channels ??= {};
-    config.channels.feishu = {
-        ...config.channels.feishu,
-        enabled: true,
-        appId: creds.appId,
-        appSecret: creds.appSecret,
-        domain: creds.domain,
-        dmPolicy: "open",
-        allowFrom: ["*"],
-    };
-    safeWriteJson(configPath, config);
-    chownToServiceUser(configPath);
-    console.log(`[openclaw] Feishu credentials saved for ${instanceId}, domain=${creds.domain}`);
-}
-const SAFE_ACCOUNT_ID_RE = /^[a-zA-Z0-9@._-]{1,128}$/;
-export function saveWeixinCredentials(instanceId, creds) {
-    if (!creds.accountId || !SAFE_ACCOUNT_ID_RE.test(creds.accountId) || creds.accountId.includes("..")) {
-        throw new Error(`Invalid accountId: must be 1-128 chars of [a-zA-Z0-9@._-] without '..'`);
-    }
-    const home = getOpenclawHome(instanceId);
-    const stateDir = join(home, OPENCLAW_STATE_DIRNAME, "openclaw-weixin");
-    const accountsDir = join(stateDir, "accounts");
-    ensureDirContainer(accountsDir);
-    const credObj = {
-        token: creds.token,
-        baseUrl: creds.baseUrl,
-        userId: creds.userId,
-        savedAt: new Date().toISOString(),
-    };
-    safeWriteJson(join(accountsDir, `${creds.accountId}.json`), credObj);
-    safeWriteJson(join(accountsDir, "default.json"), credObj);
-    chownToServiceUser(join(accountsDir, `${creds.accountId}.json`), join(accountsDir, "default.json"));
-    const indexPath = join(stateDir, "accounts.json");
-    let index = [];
-    try {
-        index = JSON.parse(readFileSync(indexPath, "utf-8"));
-    }
-    catch { /* start fresh */ }
-    if (!Array.isArray(index))
-        index = [];
-    if (!index.includes(creds.accountId))
-        index.push(creds.accountId);
-    safeWriteJson(indexPath, index);
-    const configPath = openclawConfigPathInternal(instanceId);
-    const config = safeReadJson(configPath, "weixin-creds") || {};
-    config.plugins ??= {};
-    config.plugins.entries ??= {};
-    config.plugins.entries["openclaw-weixin"] ??= {};
-    config.plugins.entries["openclaw-weixin"].enabled = true;
-    config.channels ??= {};
-    config.channels["openclaw-weixin"] ??= {};
-    config.channels["openclaw-weixin"].enabled = true;
-    const normalizedId = creds.accountId.replace(/[@.]/g, "-");
-    const accounts = config.channels["openclaw-weixin"].accounts ??= {};
-    accounts[creds.accountId] = { enabled: true };
-    if (normalizedId !== creds.accountId)
-        accounts[normalizedId] = { enabled: true };
-    accounts["default"] = { enabled: true };
-    if (!config.channels["openclaw-weixin"].defaultAccount) {
-        config.channels["openclaw-weixin"].defaultAccount = "default";
-    }
-    safeWriteJson(configPath, config);
-    chownToServiceUser(configPath);
-    console.log(`[openclaw] WeChat credentials saved for ${instanceId}, account=${creds.accountId}`);
-}
-export function getWeixinAccounts(instanceId) {
-    const home = getOpenclawHome(instanceId);
-    const stateDir = join(home, OPENCLAW_STATE_DIRNAME, "openclaw-weixin");
-    const accountsDir = join(stateDir, "accounts");
-    if (!existsSync(accountsDir))
-        return [];
-    let indexedIds = [];
-    try {
-        indexedIds = JSON.parse(readFileSync(join(stateDir, "accounts.json"), "utf-8"));
-    }
-    catch { /* fallback */ }
-    const results = [];
-    for (const f of readdirSync(accountsDir)) {
-        if (!f.endsWith(".json"))
-            continue;
-        const id = f.replace(/\.json$/, "");
-        if (indexedIds.length > 0 && !indexedIds.includes(id))
-            continue;
-        if (id === "default")
-            continue;
-        try {
-            const data = JSON.parse(readFileSync(join(accountsDir, f), "utf-8"));
-            results.push({ accountId: id, userId: data.userId, savedAt: data.savedAt });
-        }
-        catch { /* skip */ }
-    }
-    return results;
-}
-// ── Docker config patching ───────────────────────────────────────────────────
-export function patchJsproxyBaseUrl(configPath) {
-    try {
-        const raw = readFileSync(configPath, "utf-8");
-        const patched = raw.replace(/http:\/\/127\.0\.0\.1:(\d+)\/proxy/g, `http://host.docker.internal:$1/proxy`);
-        if (patched !== raw) {
-            writeConfigFile(configPath, patched);
-            console.log(`[openclaw] Patched jsproxy baseUrl in ${configPath}`);
-        }
-    }
-    catch (e) {
-        console.warn(`[openclaw] Failed to patch jsproxy baseUrl in ${configPath}: ${e.message}`);
-    }
-}
-export function patchDockerBridgeGatewayBind(configPath) {
-    try {
-        const raw = readFileSync(configPath, "utf-8");
-        const parsed = JSON.parse(raw);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-            return;
-        const gatewayRaw = parsed.gateway;
-        const gateway = gatewayRaw && typeof gatewayRaw === "object" && !Array.isArray(gatewayRaw)
-            ? gatewayRaw
-            : (parsed.gateway = {});
-        const bind = typeof gateway.bind === "string" ? gateway.bind.trim() : "";
-        if (bind && bind !== "loopback")
-            return;
-        gateway.bind = "lan";
-        const next = JSON.stringify(parsed, null, 2);
-        const output = raw.endsWith("\n") ? `${next}\n` : next;
-        if (output === raw)
-            return;
-        writeConfigFile(configPath, output);
-        console.log(`[openclaw] Normalized gateway.bind to "lan" in ${configPath}`);
-    }
-    catch (e) {
-        console.warn(`[openclaw] Failed to patch gateway.bind in ${configPath}: ${e.message}`);
-    }
-}
-// ── prepareStart ─────────────────────────────────────────────────────────────
-export async function prepareStartOpenClaw(instanceId) {
-    const { getNomadDriver, getOpenclawDockerImage } = await import("../../config.js");
-    const { DOCKER_IMAGE_RE, MAX_DOCKER_IMAGE_NAME_LEN } = await import("../nomad-manager.js");
-    const configPath = getOpenclawConfigPath(instanceId);
-    if (!existsSync(configPath)) {
-        return { ok: false, error: "Config file not found" };
-    }
-    if (getNomadDriver() === "docker") {
-        const stateDir = dirname(configPath);
-        ensureDirContainer(stateDir);
-        try {
-            for (const entry of readdirSync(stateDir, { withFileTypes: true })) {
-                if (entry.isDirectory()) {
-                    const sub = join(stateDir, entry.name);
-                    ensureDirContainer(sub);
-                    try {
-                        for (const child of readdirSync(sub, { withFileTypes: true })) {
-                            if (child.isDirectory())
-                                ensureDirContainer(join(sub, child.name));
-                        }
-                    }
-                    catch { /* ignore */ }
-                }
-            }
-        }
-        catch { /* ignore */ }
-        if (existsSync(configPath))
-            chmodSync(configPath, 0o644);
-        patchDockerBridgeGatewayBind(configPath);
-        patchJsproxyBaseUrl(configPath);
-        const image = getOpenclawDockerImage();
-        if (!DOCKER_IMAGE_RE.test(image) || image.length > MAX_DOCKER_IMAGE_NAME_LEN) {
-            return { ok: false, error: `Invalid Docker image name: "${image}"` };
-        }
-        const imageCheck = inspectDockerImage(image, { timeout: 10000 });
-        if (!imageCheck.ok) {
-            const inspectError = toDockerInspectUserError(image, imageCheck);
-            if (imageCheck.reason !== "not_found") {
-                return {
-                    ok: false,
-                    error: inspectError.message,
-                    code: inspectError.code,
-                    statusCode: inspectError.statusCode,
-                };
-            }
-            console.log(`[openclaw] Docker image ${image} not found, starting background pull...`);
-            try {
-                const setupManager = await import("../setup-manager.js");
-                const result = setupManager.startBuildSlimOpenclawImage(image);
-                return {
-                    ok: false,
-                    error: `${inspectError.message} Pull started in background.`,
-                    code: inspectError.code,
-                    statusCode: 202,
-                    building: true,
-                    taskId: result.taskId,
-                };
-            }
-            catch (e) {
-                return { ok: false, error: `Docker image ${image} not available: ${e.message}` };
-            }
-        }
-    }
-    return { ok: true };
-}
-// ── createOpenclawInstance ────────────────────────────────────────────────────
-export async function createOpenclawInstance(instanceId, name, description, options) {
-    const { appSpec, cloneFrom, openclawHome: customHome, cloneOptions } = options;
-    const d = getInstanceDir(instanceId);
-    if (existsSync(d))
-        throw new Error(`Instance '${instanceId}' already exists`);
-    const home = customHome ? normalizePath(customHome) : defaultOpenclawHome(instanceId);
-    if (customHome) {
-        const resolved = resolve(home);
-        if (!resolved.startsWith(JISHUSHELL_HOME) && !resolved.startsWith("/home/")) {
-            throw new Error(`openclaw_home must be under ${JISHUSHELL_HOME} or /home/`);
-        }
-        const parentDir = dirname(resolved);
-        if (existsSync(parentDir)) {
-            const realParent = realpathSync(parentDir);
-            if (!realParent.startsWith(JISHUSHELL_HOME) && !realParent.startsWith("/home/")) {
-                throw new Error(`openclaw_home parent resolves outside allowed paths (symlink detected)`);
-            }
-        }
-        const shared = listInstances().filter((inst) => normalizePath(inst.openclaw_home || defaultOpenclawHome(inst.id)) === normalizePath(home));
-        if (shared.length) {
-            throw new Error(`OpenClaw home '${home}' is already used by instance(s): ${shared.map((i) => i.id).join(", ")}`);
-        }
-    }
-    if (existsSync(home)) {
-        try {
-            const entries = readdirSync(home);
-            if (entries.length > 0) {
-                throw new Error(`OpenClaw home directory '${home}' already exists and is not empty. Remove it manually or choose a different path.`);
-            }
-        }
-        catch (e) {
-            if (e.message.includes("not empty"))
-                throw e;
-        }
-    }
-    ensureDirContainer(d);
-    try {
-        const parentGid = statSync(INSTANCES_DIR).gid;
-        chownSync(d, -1, parentGid);
-    }
-    catch { /* non-root */ }
-    ensureDirContainer(home);
-    ensureDirContainer(join(home, OPENCLAW_STATE_DIRNAME));
-    const { runtime: baseRuntime, allocatedPort } = await buildDefaultRuntime(instanceId, home);
-    let runtime = baseRuntime;
-    if (appSpec) {
-        const serviceTask = appSpec.tasks.find((t) => t.role === "service");
-        if (serviceTask) {
-            const compiled = compileTaskRuntime(serviceTask, instanceId);
-            runtime = { ...baseRuntime, ...compiled };
-        }
-    }
-    try {
-        const meta = {
-            id: instanceId,
-            name,
-            description,
-            openclaw_home: home,
-            runtime,
-            created_at: new Date().toISOString(),
-            ...(appSpec ? { app_id: appSpec.app_id ?? appSpec.id } : {}),
-        };
-        safeWriteJson(instanceMetaPath(instanceId), meta);
-        const envFiles = (runtime.env_files || []).map((p) => normalizePath(p));
-        for (const ef of envFiles) {
-            if (!existsSync(ef))
-                writeConfigFile(ef, "");
-        }
-        try {
-            const runtimeUser = runtime.user;
-            if (runtimeUser && runtimeUser !== userInfo().username) {
-                for (const ef of envFiles) {
-                    execFileSync("chown", [runtimeUser, ef], { timeout: 5000 });
-                }
-            }
-        }
-        catch { /* ignore */ }
-        const configPath = openclawConfigPathInternal(instanceId);
-        ensureDirContainer(dirname(configPath));
-        if (cloneFrom && !existsSync(configPath)) {
-            const srcConfig = resolveExistingConfigPath(cloneFrom);
-            if (existsSync(srcConfig)) {
-                try {
-                    const cloned = JSON.parse(readFileSync(srcConfig, "utf-8"));
-                    const providers = cloned?.models?.providers;
-                    if (providers) {
-                        for (const [pid, prov] of Object.entries(providers)) {
-                            if (typeof prov?.baseUrl === "string" && prov.baseUrl.includes("/proxy/")) {
-                                delete providers[pid];
-                            }
-                        }
-                    }
-                    const dm = cloned?.agents?.defaults?.model;
-                    if (typeof dm === "string" && (dm.startsWith("jsproxy/") || dm.startsWith("js-"))) {
-                        delete cloned.agents.defaults.model;
-                    }
-                    stripImBindings(cloned);
-                    const subdirs = ["extensions", "workspace"];
-                    if (cloneOptions?.include_memory !== false) {
-                        const memDir = join(dirname(srcConfig), "memory");
-                        if (existsSync(memDir))
-                            subdirs.push("memory");
-                    }
-                    if (cloneOptions?.include_sessions) {
-                        const sessDir = join(dirname(srcConfig), "agents");
-                        if (existsSync(sessDir))
-                            subdirs.push("agents");
-                    }
-                    for (const subdir of subdirs) {
-                        const srcDir = join(dirname(srcConfig), subdir);
-                        const dstDir = join(dirname(configPath), subdir);
-                        if (existsSync(srcDir) && !existsSync(dstDir)) {
-                            try {
-                                cpSync(srcDir, dstDir, { recursive: true });
-                            }
-                            catch { /* best effort */ }
-                        }
-                    }
-                    writeConfigFile(configPath, JSON.stringify(cloned, null, 2));
-                    const srcMetaPath = join(getInstanceDir(cloneFrom), "instance.json");
-                    if (existsSync(srcMetaPath)) {
-                        try {
-                            const srcMeta = JSON.parse(readFileSync(srcMetaPath, "utf-8"));
-                            const srcXj = srcMeta?.["x-jishushell"];
-                            if (srcXj?.proxy?.upstream) {
-                                const dstXj = { proxy: { upstream: { ...srcXj.proxy.upstream } } };
-                                delete dstXj.proxy.upstream.apiKey;
-                                const metaPathDst = instanceMetaPath(instanceId);
-                                if (existsSync(metaPathDst)) {
-                                    const dstMeta = JSON.parse(readFileSync(metaPathDst, "utf-8"));
-                                    dstMeta["x-jishushell"] = dstXj;
-                                    writeConfigFile(metaPathDst, JSON.stringify(dstMeta, null, 2));
-                                }
-                            }
-                        }
-                        catch { /* ignore */ }
-                    }
-                }
-                catch {
-                    copyFileSync(srcConfig, configPath);
-                }
-            }
-        }
-        if (!existsSync(configPath)) {
-            writeConfigFile(configPath, JSON.stringify(buildStarterConfig(), null, 2));
-            const dp = getDefaultLlmProvider();
-            if (dp?.apiKey && dp?.id && envFiles.length) {
-                const envKey = inferProviderApiKeyEnvName(dp.id);
-                updateEnvFile(envFiles[0], { [envKey]: decryptRuntimeProviderApiKey(dp.apiKey) });
-                const providerEnv = join(dirname(envFiles[0]), "provider.env");
-                updateEnvFile(providerEnv, { UPSTREAM_API_KEY: dp.apiKey });
-            }
-        }
-        if (appSpec?.openclaw?.config_defaults && existsSync(configPath)) {
-            try {
-                const existing = JSON.parse(readFileSync(configPath, "utf-8"));
-                const defaults = appSpec.openclaw.config_defaults;
-                for (const [key, value] of Object.entries(defaults)) {
-                    if (typeof value === "object" && value !== null && !Array.isArray(value) && typeof existing[key] === "object" && existing[key] !== null) {
-                        existing[key] = { ...existing[key], ...value };
-                    }
-                    else {
-                        existing[key] = value;
-                    }
-                }
-                writeConfigFile(configPath, JSON.stringify(existing, null, 2));
-            }
-            catch { /* ignore */ }
-        }
-        if (appSpec?.openclaw?.skills && Array.isArray(appSpec.openclaw.skills)) {
-            try {
-                const skillsDir = join(dirname(configPath), "skills");
-                ensureDirContainer(skillsDir);
-                const skillMeta = join(skillsDir, ".app-skills.json");
-                safeWriteJson(skillMeta, { app_id: appSpec.app_id ?? appSpec.id, skills: appSpec.openclaw.skills });
-            }
-            catch { /* ignore */ }
-        }
-        if (cloneFrom && envFiles.length) {
-            const srcEnvFiles = getRuntimeEnvFiles(cloneFrom);
-            const srcEnvFile = srcEnvFiles[0];
-            const dstEnvFile = envFiles[0];
-            if (srcEnvFile) {
-                const srcProvider = join(dirname(srcEnvFile), "provider.env");
-                const dstProvider = join(dirname(dstEnvFile), "provider.env");
-                if (existsSync(srcProvider) && !existsSync(dstProvider)) {
-                    copyFileSync(srcProvider, dstProvider);
-                }
-            }
-        }
-        try {
-            const { bootstrapInstanceProxy } = await import("../llm-proxy/instance-proxy.js");
-            await bootstrapInstanceProxy(instanceId);
-        }
-        catch (e) {
-            console.warn(`[openclaw] Proxy bootstrap for ${instanceId} deferred: ${e.message}`);
-        }
-        const svcUser = resolveServiceUser();
-        if (svcUser) {
-            try {
-                execFileSync("chown", ["-R", `${svcUser.uid}:${svcUser.gid}`, d], { timeout: 10_000 });
-                if (!home.startsWith(d + "/") && existsSync(home)) {
-                    execFileSync("chown", ["-R", `${svcUser.uid}:${svcUser.gid}`, home], { timeout: 10_000 });
-                }
-            }
-            catch (e) {
-                console.warn(`[openclaw] chown for ${instanceId} failed:`, e.message);
-            }
-        }
-        return meta;
-    }
-    finally {
-        releasePort(allocatedPort);
-    }
-}
-// ── Nomad task & secrets for OpenClaw ──────────────────────────────────────
-import { getOpenclawDockerImage, } from "../../config.js";
-import { DEFAULT_PIDS_LIMIT, DEFAULT_RESOURCES, DEFAULT_ARGS, DEFAULT_USER, DEFAULT_CWD, DEFAULT_ENV, MAX_CPU_MHZ, VALID_USER_RE, resolveUidGid, normalizeDockerResources, nomadGet, nomadPut, jobId, } from "../nomad-manager.js";
-function buildOpenclawRuntime(instanceId) {
-    const runtime = getInstanceRuntime(instanceId);
-    const openclawHome = getOpenclawHome(instanceId);
-    if (runtime.user && !VALID_USER_RE.test(runtime.user)) {
-        throw new Error(`Invalid runtime user: ${runtime.user}`);
-    }
-    const command = runtime.command || "/usr/bin/openclaw";
-    let args = runtime.args;
-    if (!Array.isArray(args))
-        args = [...DEFAULT_ARGS];
-    else
-        args = args.map(String);
-    const env = { ...DEFAULT_ENV };
-    Object.assign(env, getRuntimeEnv(instanceId));
-    decryptRuntimeProviderEnv(env);
-    delete env.JSPROXY_API_KEY;
-    env.OPENCLAW_HOME = openclawHome;
-    env.OPENCLAW_INSTANCE_ID = instanceId;
-    const resources = { ...DEFAULT_RESOURCES };
-    for (const [key, value] of Object.entries(runtime.resources || {})) {
-        if (value != null)
-            resources[key] = Number(value);
-    }
-    resources.CPU = Math.max(1, Math.min(resources.CPU, MAX_CPU_MHZ));
-    resources.MemoryMB = Math.max(1, Math.min(resources.MemoryMB, getMaxAppMemoryMB()));
-    return {
-        command: String(command),
-        args,
-        user: runtime.user || DEFAULT_USER,
-        cwd: runtime.cwd || DEFAULT_CWD,
-        env,
-        resources,
-        image: runtime.image ?? null,
-    };
-}
-export function buildNomadTaskOpenClaw(instanceId, runtime, safeJobId) {
-    const openclawHome = getOpenclawHome(instanceId);
-    const image = runtime.image || getOpenclawDockerImage();
-    const volumes = [`${openclawHome}:${openclawHome}:rw`];
-    const containerEnv = { ...runtime.env };
-    containerEnv.HOME = openclawHome;
-    if (!containerEnv.OPENCLAW_STATE_DIR) {
-        containerEnv.OPENCLAW_STATE_DIR = `${openclawHome}/.openclaw`;
-    }
-    containerEnv.npm_config_prefix = `${openclawHome}/.npm-global`;
-    containerEnv.PIP_USER = "1";
-    containerEnv.PYTHONUSERBASE = `${openclawHome}/.local`;
-    containerEnv.NODE_ENV = "production";
-    containerEnv.NODE_PATH = [
-        `${openclawHome}/.npm-global/lib/node_modules`,
-        "/app/node_modules",
-    ].join(":");
-    containerEnv.PATH = [
-        `${openclawHome}/.npm-global/bin`,
-        `${openclawHome}/.local/bin`,
-        `${openclawHome}/go/bin`,
-        `${openclawHome}/.cargo/bin`,
-        "/usr/local/sbin",
-        "/usr/local/bin",
-        "/usr/sbin",
-        "/usr/bin",
-        "/sbin",
-        "/bin",
-    ].join(":");
-    const runtimeArgs = [...(runtime.args || [])];
-    const gatewayPort = getGatewayPort(instanceId);
-    const normalizedResources = normalizeDockerResources(instanceId, runtime);
-    return {
-        Name: "gateway",
-        Driver: "docker",
-        User: resolveUidGid(runtime.user),
-        Config: {
-            image,
-            force_pull: false,
-            args: runtimeArgs,
-            work_dir: openclawHome,
-            volumes,
-            extra_hosts: ["host.docker.internal:host-gateway"],
-            cap_drop: ["ALL"],
-            security_opt: ["no-new-privileges"],
-            pids_limit: DEFAULT_PIDS_LIMIT,
-            readonly_rootfs: true,
-            mounts: [
-                { type: "tmpfs", target: "/tmp", tmpfs_options: { size: 536870912 } },
-                { type: "tmpfs", target: "/var/tmp", tmpfs_options: { size: 67108864 } },
-                { type: "tmpfs", target: "/run", tmpfs_options: { size: 52428800 } },
-            ],
-        },
-        Env: containerEnv,
-        Resources: {
-            ...normalizedResources,
-            Networks: [{ ReservedPorts: [{ Label: "gateway", Value: gatewayPort }] }],
-        },
-        LogConfig: { MaxFiles: 3, MaxFileSizeMB: 10 },
-        Templates: [{
-                DestPath: "secrets/instance.env",
-                Envvars: true,
-                EmbeddedTmpl: [
-                    `{{ if nomadVarExists "nomad/jobs/${safeJobId}/openclaw/gateway" }}`,
-                    `JSPROXY_API_KEY={{ with nomadVar "nomad/jobs/${safeJobId}/openclaw/gateway" }}{{ .JSPROXY_API_KEY }}{{ end }}`,
-                    `{{ end }}`,
-                ].join("\n"),
-                ChangeMode: "restart",
-            }],
-    };
-}
-export async function writeNomadSecretsOpenClaw(instanceId) {
-    const jid = jobId(instanceId);
-    const ns = "default";
-    const varPath = `nomad/jobs/${jid}/openclaw/gateway`;
-    const encodedPath = encodeURIComponent(varPath);
-    const env = getRuntimeEnv(instanceId);
-    const proxyToken = env.JSPROXY_API_KEY || "";
-    if (!proxyToken)
-        return;
-    const items = { JSPROXY_API_KEY: proxyToken };
-    const MAX_ATTEMPTS = 3;
-    for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
-        let cas = 0;
-        try {
-            const existing = await nomadGet(`/v1/var/${encodedPath}?namespace=${ns}`);
-            if (existing.ok) {
-                const data = await existing.json();
-                cas = data.ModifyIndex || 0;
-            }
-        }
-        catch { /* variable may not exist yet — cas=0 creates a new one */ }
-        const resp = await nomadPut(`/v1/var/${encodedPath}?cas=${cas}&namespace=${ns}`, {
-            Namespace: ns,
-            Path: varPath,
-            Items: items,
-        });
-        if (resp.ok)
-            return;
-        const text = await resp.text();
-        if (resp.status === 409 && attempt < MAX_ATTEMPTS - 1) {
-            await new Promise(r => setTimeout(r, 100 * Math.pow(2, attempt)));
-            continue;
-        }
-        throw new Error(`Failed to write Nomad Variables for ${instanceId}` +
-            ` (attempt ${attempt + 1}/${MAX_ATTEMPTS}): HTTP ${resp.status} ${text}`);
-    }
-}
-// ── AppTypeManager export ──────────────────────────────────────────────────
-export const openclawManager = {
-    appType: "openclaw",
-    createInstance: createOpenclawInstance,
-    prepareStart: prepareStartOpenClaw,
-    writeNomadSecrets: writeNomadSecretsOpenClaw,
-    buildNomadTask: buildNomadTaskOpenClaw,
-    nomadTaskGroupName: () => "openclaw",
-    buildRuntime: buildOpenclawRuntime,
-};
-//# sourceMappingURL=openclaw-manager.js.map