jishushell 0.6.5 → 0.7.3

package/dist/services/system/runtime-ownership.js

@@ -0,0 +1,250 @@
+import { execFileSync } from "child_process";
+import { chmodSync, chownSync, existsSync, lstatSync, readdirSync, statSync } from "fs";
+import { join, resolve } from "path";
+import * as config from "../../config.js";
+import { resolveServiceUser } from "../../utils/service-user.js";
+import { DEFINITION_FILENAME, INSTANCE_METADATA_FILENAME, MANIFEST_FILENAME, RESOLVED_SPEC_FILENAME, resolveAppDir, } from "../app-common/paths.js";
+const BACKUP_SUFFIXES = [".bak", ".bak.1", ".bak.2"];
+function getConfigValue(name) {
+    return name in config ? config[name] : undefined;
+}
+const JISHUSHELL_HOME = String(getConfigValue("JISHUSHELL_HOME"));
+const APPS_DIR = String(getConfigValue("APPS_DIR") ?? join(JISHUSHELL_HOME, "apps"));
+const AUTH_FILE = String(getConfigValue("AUTH_FILE") ?? join(JISHUSHELL_HOME, "auth.json"));
+const CORE_CONFIG_FILE = String(getConfigValue("CORE_CONFIG_FILE") ?? join(JISHUSHELL_HOME, "core.json"));
+const FILES_ROOT = String(getConfigValue("FILES_ROOT") ?? join(JISHUSHELL_HOME, "files"));
+const TMP_DIR = String(getConfigValue("TMP_DIR") ?? join(JISHUSHELL_HOME, "tmp"));
+const NOMAD_DIR = join(JISHUSHELL_HOME, "nomad");
+const NOMAD_DATA_DIR = join(NOMAD_DIR, "data");
+function emptyResult() {
+    return { ok: true, repaired: [], skipped: [], errors: [] };
+}
+function finalize(result) {
+    result.ok = result.errors.length === 0;
+    return result;
+}
+function serviceUser() {
+    return resolveServiceUser({ jishuHome: JISHUSHELL_HOME });
+}
+function isRoot() {
+    return typeof process.getuid === "function" && process.getuid() === 0;
+}
+function sudoFileCommand(args, timeout = 5000) {
+    execFileSync("sudo", ["-n", ...args], { timeout, stdio: "pipe" });
+}
+function pathInside(child, parent) {
+    const childPath = resolve(child);
+    const parentPath = resolve(parent);
+    return childPath === parentPath || childPath.startsWith(`${parentPath}/`);
+}
+function shouldSkipPath(path, skip) {
+    return pathInside(path, NOMAD_DATA_DIR) || skip?.(path) === true;
+}
+function readLstat(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (e) {
+        if (e?.code === "ENOENT")
+            return null;
+        throw e;
+    }
+}
+function ensureOne(path, user, mode) {
+    const st = readLstat(path);
+    if (!st)
+        return "skipped";
+    if (st.isSymbolicLink())
+        return "skipped";
+    const needsOwner = st.uid !== user.uid || st.gid !== user.gid;
+    const currentMode = Number(st.mode) & 0o777;
+    if (needsOwner) {
+        if (isRoot())
+            chownSync(path, user.uid, user.gid);
+        else
+            sudoFileCommand(["chown", `${user.uid}:${user.gid}`, path]);
+    }
+    if (mode !== undefined && currentMode !== mode) {
+        try {
+            chmodSync(path, mode);
+        }
+        catch (e) {
+            if (e?.code !== "EACCES")
+                throw e;
+            sudoFileCommand(["chmod", mode.toString(8), path]);
+        }
+    }
+    return needsOwner || (mode !== undefined && currentMode !== mode) ? "repaired" : "ok";
+}
+export function ensureUserOwned(path, options = {}) {
+    const result = options.result ?? emptyResult();
+    const user = serviceUser();
+    if (!user) {
+        result.errors.push("Cannot determine service user");
+        return finalize(result);
+    }
+    if (shouldSkipPath(path, options.skip)) {
+        result.skipped.push(path);
+        return finalize(result);
+    }
+    try {
+        const st = readLstat(path);
+        if (!st) {
+            result.skipped.push(path);
+            return finalize(result);
+        }
+        if (st.isSymbolicLink()) {
+            result.skipped.push(path);
+            return finalize(result);
+        }
+        const mode = options.mode ?? (st.isDirectory() ? options.dirMode : options.fileMode);
+        const status = ensureOne(path, user, mode);
+        if (status === "repaired")
+            result.repaired.push(path);
+        else if (status === "skipped")
+            result.skipped.push(path);
+        if (options.recursive && st.isDirectory()) {
+            for (const entry of readdirSync(path)) {
+                ensureUserOwned(join(path, entry), { ...options, mode: undefined, result });
+            }
+        }
+    }
+    catch (e) {
+        result.errors.push(`${path}: ${e?.message || String(e)}`);
+    }
+    return finalize(result);
+}
+function ensureTargets(result, targets) {
+    for (const target of targets) {
+        ensureUserOwned(target.path, { ...target, result });
+    }
+}
+export function repairCoreRuntimeOwnership(options = {}) {
+    const result = emptyResult();
+    const includeApps = options.includeApps !== false;
+    const dirs = [
+        JISHUSHELL_HOME,
+        join(JISHUSHELL_HOME, "bin"),
+        join(JISHUSHELL_HOME, "packages"),
+        join(JISHUSHELL_HOME, "runtimes"),
+        ...(includeApps ? [APPS_DIR] : []),
+        FILES_ROOT,
+        TMP_DIR,
+        join(JISHUSHELL_HOME, "provider-credentials"),
+        NOMAD_DIR,
+    ];
+    ensureTargets(result, dirs.map((path) => ({ path, recursive: false, dirMode: 0o755 })));
+    const coreFiles = [
+        CORE_CONFIG_FILE,
+        ...BACKUP_SUFFIXES.map((suffix) => CORE_CONFIG_FILE + suffix),
+        AUTH_FILE,
+        join(JISHUSHELL_HOME, "jwt-secret"),
+        join(JISHUSHELL_HOME, "internal-mcp-token"),
+        join(JISHUSHELL_HOME, "nomad.env"),
+        join(NOMAD_DIR, "nomad.hcl"),
+    ];
+    ensureTargets(result, coreFiles.map((path) => ({
+        path,
+        recursive: false,
+        mode: path.endsWith("jwt-secret") || path.endsWith("internal-mcp-token") || path.endsWith("nomad.env") ? 0o600 : 0o644,
+    })));
+    return finalize(result);
+}
+export function repairNomadConfigOwnership() {
+    const result = emptyResult();
+    ensureTargets(result, [
+        { path: NOMAD_DIR, dirMode: 0o755 },
+        { path: join(NOMAD_DIR, "nomad.hcl"), mode: 0o644 },
+        { path: join(JISHUSHELL_HOME, "nomad.env"), mode: 0o600 },
+    ]);
+    return finalize(result);
+}
+export function repairInstanceWorkspaceOwnership(instanceId) {
+    const result = emptyResult();
+    const appDir = resolveAppDir(instanceId);
+    const metadataFiles = [
+        DEFINITION_FILENAME,
+        RESOLVED_SPEC_FILENAME,
+        MANIFEST_FILENAME,
+        INSTANCE_METADATA_FILENAME,
+        "jobspec.nomad.hcl",
+        "browser-temp-allowlist.json",
+    ];
+    const filesWithBackups = metadataFiles.flatMap((filename) => [
+        join(appDir, filename),
+        ...BACKUP_SUFFIXES.map((suffix) => join(appDir, filename + suffix)),
+    ]);
+    ensureTargets(result, [
+        { path: appDir, recursive: false, dirMode: 0o755 },
+        ...filesWithBackups.map((path) => ({ path, recursive: false, mode: 0o644 })),
+    ]);
+    return finalize(result);
+}
+function inspectTarget(path, user, drifts) {
+    try {
+        if (!existsSync(path))
+            return;
+        const st = lstatSync(path);
+        if (st.isSymbolicLink()) {
+            drifts.push({ path, expectedUid: user.uid, expectedGid: user.gid, symlink: true });
+            return;
+        }
+        if (st.uid !== user.uid || st.gid !== user.gid) {
+            drifts.push({
+                path,
+                expectedUid: user.uid,
+                expectedGid: user.gid,
+                actualUid: st.uid,
+                actualGid: st.gid,
+            });
+        }
+    }
+    catch (e) {
+        drifts.push({ path, expectedUid: user.uid, expectedGid: user.gid, error: e?.message || String(e) });
+    }
+}
+export function inspectRuntimeOwnership(options = {}) {
+    const user = serviceUser();
+    if (!user)
+        return [];
+    const drifts = [];
+    const includeApps = options.includeApps !== false;
+    const targets = [
+        JISHUSHELL_HOME,
+        CORE_CONFIG_FILE,
+        ...BACKUP_SUFFIXES.map((suffix) => CORE_CONFIG_FILE + suffix),
+        AUTH_FILE,
+        join(JISHUSHELL_HOME, "jwt-secret"),
+        join(JISHUSHELL_HOME, "internal-mcp-token"),
+        join(JISHUSHELL_HOME, "nomad.env"),
+        join(JISHUSHELL_HOME, "bin"),
+        join(JISHUSHELL_HOME, "packages"),
+        join(JISHUSHELL_HOME, "runtimes"),
+        ...(includeApps ? [APPS_DIR] : []),
+        FILES_ROOT,
+        TMP_DIR,
+        join(JISHUSHELL_HOME, "provider-credentials"),
+        NOMAD_DIR,
+        join(NOMAD_DIR, "nomad.hcl"),
+    ];
+    for (const target of targets)
+        inspectTarget(target, user, drifts);
+    try {
+        if (existsSync(NOMAD_DATA_DIR)) {
+            const st = statSync(NOMAD_DATA_DIR);
+            if (st.uid === user.uid && st.gid === user.gid) {
+                // User-owned Nomad data is not a repair target, but it is not reported as drift:
+                // ownership may be valid on macOS or legacy non-systemd installs.
+            }
+        }
+    }
+    catch {
+        // ignored: Nomad data is outside the Core user zone.
+    }
+    return drifts;
+}
+export const RUNTIME_OWNERSHIP_PATHS = {
+    NOMAD_DIR,
+    NOMAD_DATA_DIR,
+};
+//# sourceMappingURL=runtime-ownership.js.map

package/dist/services/system/runtime-ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-ownership.js","sourceRoot":"","sources":["../../../src/services/system/runtime-ownership.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAErC,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAoB,MAAM,6BAA6B,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAoBhC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACrD,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,IAAI,MAAM,CAAC,CAAC,CAAE,MAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;AACrF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;AAC5F,MAAM,gBAAgB,GAAG,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1G,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1F,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AAClF,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AACjD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAE/C,SAAS,WAAW;IAClB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,QAAQ,CAAC,MAA6B;IAC7C,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,kBAAkB,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,MAAM;IACb,OAAO,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,eAAe,CAAC,IAAc,EAAE,OAAO,GAAG,IAAI;IACrD,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,MAAc;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,IAAgC;IACpE,OAAO,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,IAAiB,EAAE,IAAa;IAC/D,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,IAAI,EAAE,CAAC,cAAc,EAAE;QAAE,OAAO,SAAS,CAAC;IAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;IAC9D,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC5C,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,MAAM,EAAE;YAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;;YAC7C,eAAe,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;YAClC,eAAe,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,UAAU,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,UAOI,EAAE;IAEN,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACpD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;YACxB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,UAAU;YAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACjD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzD,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,MAA6B,EAAE,OAAyG;IAC7J,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAAqC,EAAE;IAChF,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG;QACX,eAAe;QACf,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC;QAC5B,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC;QACjC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC;QACjC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,UAAU;QACV,OAAO;QACP,IAAI,CAAC,eAAe,EAAE,sBAAsB,CAAC;QAC7C,SAAS;KACV,CAAC;IACF,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAExF,MAAM,SAAS,GAAG;QAChB,gBAAgB;QAChB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,GAAG,MAAM,CAAC;QAC7D,SAAS;QACT,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC;QACnC,IAAI,CAAC,eAAe,EAAE,oBAAoB,CAAC;QAC3C,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC;QAClC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;KAC7B,CAAC;IACF,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI;QACJ,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;KACvH,CAAC,CAAC,CAAC,CAAC;IACL,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,aAAa,CAAC,MAAM,EAAE;QACpB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QACnC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;QACnD,EAAE,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;KAC1D,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,UAAkB;IACjE,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG;QACpB,mBAAmB;QACnB,sBAAsB;QACtB,iBAAiB;QACjB,0BAA0B;QAC1B,mBAAmB;QACnB,6BAA6B;KAC9B,CAAC;IACF,MAAM,gBAAgB,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;QACtB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC,CAAC;KACpE,CAAC,CAAC;IAEH,aAAa,CAAC,MAAM,EAAE;QACpB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE;QAClD,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;KAC7E,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAAiB,EAAE,MAA4B;IAClF,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,WAAW,EAAE,IAAI,CAAC,GAAG;gBACrB,WAAW,EAAE,IAAI,CAAC,GAAG;gBACrB,SAAS,EAAE,EAAE,CAAC,GAAG;gBACjB,SAAS,EAAE,EAAE,CAAC,GAAG;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAAqC,EAAE;IAC7E,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC;IAClD,MAAM,OAAO,GAAG;QACd,eAAe;QACf,gBAAgB;QAChB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,GAAG,MAAM,CAAC;QAC7D,SAAS;QACT,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC;QACnC,IAAI,CAAC,eAAe,EAAE,oBAAoB,CAAC;QAC3C,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC;QAClC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC;QAC5B,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC;QACjC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC;QACjC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,UAAU;QACV,OAAO;QACP,IAAI,CAAC,eAAe,EAAE,sBAAsB,CAAC;QAC7C,SAAS;QACT,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;KAC7B,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;YACpC,IAAI,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC/C,iFAAiF;gBACjF,kEAAkE;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS;IACT,cAAc;CACf,CAAC"}

package/dist/services/system/system-monitor.js

@@ -0,0 +1,96 @@
+import { execFile, execSync } from "child_process";
+import { promisify } from "util";
+import si from "systeminformation";
+import { TtlCache } from "../../utils/ttl-cache.js";
+const execFileAsync = promisify(execFile);
+const _cache = new TtlCache(5_000);
+let _inflight = null;
+const SYSTEM_INFO_TIMEOUT_MS = 10_000;
+async function withTimeout(promise, timeoutMs, label) {
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs);
+                timer.unref?.();
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+export async function getSystemStatus() {
+    const cached = _cache.peek();
+    if (cached)
+        return cached;
+    // Singleflight: if a fetch is already in progress, share its result
+    // instead of firing parallel system info queries (expensive on RPi)
+    if (_inflight)
+        return _inflight;
+    _inflight = _fetchSystemStatus().finally(() => { _inflight = null; });
+    return _inflight;
+}
+async function _fetchSystemStatus() {
+    const [cpu, mem, disk] = await withTimeout(Promise.all([
+        si.currentLoad(),
+        si.mem(),
+        si.fsSize(),
+    ]), SYSTEM_INFO_TIMEOUT_MS, "system information probe");
+    const rootDisk = disk.find((d) => d.mount === "/") || disk[0];
+    let temperature = null;
+    try {
+        const { stdout } = await execFileAsync("vcgencmd", ["measure_temp"], {
+            timeout: 5000,
+        });
+        const match = stdout.match(/temp=([\d.]+)/);
+        if (match)
+            temperature = parseFloat(match[1]);
+    }
+    catch {
+        try {
+            const temps = await si.cpuTemperature();
+            if (temps.main > 0)
+                temperature = temps.main;
+        }
+        catch { /* ignore */ }
+    }
+    let nomad_running = false;
+    try {
+        if (process.platform === "darwin") {
+            const out = execSync("lsof -iTCP:4646 -sTCP:LISTEN -t 2>/dev/null", { encoding: "utf-8", timeout: 3000 });
+            nomad_running = out.trim().length > 0;
+        }
+        else {
+            try {
+                const out = execSync('ss -tlnp 2>/dev/null | grep ":4646 "', { encoding: "utf-8", timeout: 3000 });
+                nomad_running = out.trim().length > 0;
+            }
+            catch {
+                const out = execSync('netstat -tlnp 2>/dev/null | grep ":4646 "', { encoding: "utf-8", timeout: 3000 });
+                nomad_running = out.trim().length > 0;
+            }
+        }
+    }
+    catch { }
+    const result = {
+        cpu_percent: Math.round(cpu.currentLoad * 10) / 10,
+        memory: {
+            total_mb: Math.round(mem.total / (1024 * 1024)),
+            used_mb: Math.round((mem.total - mem.available) / (1024 * 1024)),
+            percent: Math.round(((mem.total - mem.available) / mem.total) * 1000) / 10,
+        },
+        disk: {
+            total_gb: rootDisk ? Math.round((rootDisk.size / 1024 ** 3) * 10) / 10 : 0,
+            used_gb: rootDisk ? Math.round((rootDisk.used / 1024 ** 3) * 10) / 10 : 0,
+            percent: rootDisk ? Math.round(rootDisk.use * 10) / 10 : 0,
+        },
+        temperature,
+        nomad_running,
+    };
+    _cache.set(result);
+    return result;
+}
+//# sourceMappingURL=system-monitor.js.map

package/dist/services/system/system-monitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-monitor.js","sourceRoot":"","sources":["../../../src/services/system/system-monitor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAsB,KAAK,CAAC,CAAC;AACxD,IAAI,SAAS,GAAwC,IAAI,CAAC;AAC1D,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC,KAAK,UAAU,WAAW,CAAI,OAAmB,EAAE,SAAiB,EAAE,KAAa;IACjF,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,OAAO;YACP,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC3B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,SAAS,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAClG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,oEAAoE;IACpE,oEAAoE;IACpE,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,SAAS,GAAG,kBAAkB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,kBAAkB;IAE/B,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,WAAW,CACxC,OAAO,CAAC,GAAG,CAAC;QACV,EAAE,CAAC,WAAW,EAAE;QAChB,EAAE,CAAC,GAAG,EAAE;QACR,EAAE,CAAC,MAAM,EAAE;KACZ,CAAC,EACF,sBAAsB,EACtB,0BAA0B,CAC3B,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAE9D,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE;YACnE,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,KAAK;YAAE,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,cAAc,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;gBAAE,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,6CAA6C,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1G,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,QAAQ,CAAC,sCAAsC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnG,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,GAAG,QAAQ,CAAC,2CAA2C,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxG,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,CAAC;IAEX,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,GAAG,EAAE;QAClD,MAAM,EAAE;YACN,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YAC/C,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YAChE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;SAC3E;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1E,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACzE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;SAC3D;QACD,WAAW;QACX,aAAa;KACd,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/services/system/system-ollama-provider.d.ts

@@ -0,0 +1,14 @@
+import type { CapabilityEntry } from "../capabilities/registry.js";
+export declare const SYSTEM_OLLAMA_PROVIDER_ID = "system-ollama";
+export declare const SYSTEM_OLLAMA_PROXY_PATH = "/_jishushell/ollama";
+interface SystemOllamaDetection {
+    upstreamBaseUrl: string;
+    provider: CapabilityEntry;
+}
+export declare function detectSystemOllama(options?: {
+    force?: boolean;
+    timeoutMs?: number;
+}): Promise<SystemOllamaDetection | null>;
+export declare function resolveSystemOllamaProxyTarget(pathSuffix: string): Promise<string | null>;
+export declare function resetSystemOllamaDetectionCache(): void;
+export {};

package/dist/services/system/system-ollama-provider.js

@@ -0,0 +1,129 @@
+import { getCoreLanHost, getCorePort } from "../../config.js";
+export const SYSTEM_OLLAMA_PROVIDER_ID = "system-ollama";
+export const SYSTEM_OLLAMA_PROXY_PATH = "/_jishushell/ollama";
+const DETECTION_TTL_MS = 5_000;
+const DEFAULT_OLLAMA_BASES = [
+    "http://127.0.0.1:11434",
+    "http://localhost:11434",
+    "http://[::1]:11434",
+];
+let detectionCache = {
+    expiresAt: 0,
+    value: null,
+};
+function normalizeCandidateBaseUrl(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `http://${trimmed}`;
+    try {
+        const parsed = new URL(withScheme);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+            return null;
+        parsed.pathname = "";
+        parsed.search = "";
+        parsed.hash = "";
+        return parsed.toString().replace(/\/+$/, "");
+    }
+    catch {
+        return null;
+    }
+}
+function candidateBaseUrls() {
+    const candidates = new Set();
+    const envValue = process.env.OLLAMA_HOST;
+    if (typeof envValue === "string" && envValue.trim()) {
+        const normalized = normalizeCandidateBaseUrl(envValue);
+        if (normalized)
+            candidates.add(normalized);
+    }
+    for (const value of DEFAULT_OLLAMA_BASES) {
+        const normalized = normalizeCandidateBaseUrl(value);
+        if (normalized)
+            candidates.add(normalized);
+    }
+    return Array.from(candidates);
+}
+async function probeOllama(baseUrl, timeoutMs) {
+    try {
+        const response = await fetch(`${baseUrl}/api/tags`, {
+            method: "GET",
+            headers: { accept: "application/json" },
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+}
+function buildProvider(nowIso) {
+    let host = "127.0.0.1";
+    try {
+        const candidate = getCoreLanHost();
+        if (candidate.trim())
+            host = candidate.trim();
+    }
+    catch {
+        // fall back to loopback in tests / partial config environments
+    }
+    const hostPort = getCorePort();
+    return {
+        instanceId: SYSTEM_OLLAMA_PROVIDER_ID,
+        name: "System Ollama",
+        capabilityId: "ollama",
+        capability: "llm-ollama",
+        kind: "llm",
+        interface: "openai-compatible",
+        providerKind: "ollama",
+        host,
+        hostPort,
+        path: SYSTEM_OLLAMA_PROXY_PATH,
+        address: `${host}:${hostPort}${SYSTEM_OLLAMA_PROXY_PATH}`,
+        protocol: "http",
+        visibility: "internal",
+        status: "running",
+        registeredAt: nowIso,
+        updatedAt: nowIso,
+    };
+}
+export async function detectSystemOllama(options = {}) {
+    const now = Date.now();
+    if (!options.force && now < detectionCache.expiresAt) {
+        return detectionCache.value;
+    }
+    const timeoutMs = typeof options.timeoutMs === "number" ? options.timeoutMs : 1_200;
+    let detected = null;
+    for (const baseUrl of candidateBaseUrls()) {
+        if (!await probeOllama(baseUrl, timeoutMs))
+            continue;
+        detected = {
+            upstreamBaseUrl: baseUrl,
+            provider: buildProvider(new Date().toISOString()),
+        };
+        break;
+    }
+    detectionCache = {
+        expiresAt: now + DETECTION_TTL_MS,
+        value: detected,
+    };
+    return detected;
+}
+export async function resolveSystemOllamaProxyTarget(pathSuffix) {
+    const detected = await detectSystemOllama();
+    if (!detected)
+        return null;
+    const normalizedSuffix = pathSuffix.replace(/^\/+/, "");
+    if (!normalizedSuffix)
+        return detected.upstreamBaseUrl;
+    if (!/^(api|v1)(\/|$)/.test(normalizedSuffix))
+        return null;
+    return `${detected.upstreamBaseUrl}/${normalizedSuffix}`;
+}
+export function resetSystemOllamaDetectionCache() {
+    detectionCache = {
+        expiresAt: 0,
+        value: null,
+    };
+}
+//# sourceMappingURL=system-ollama-provider.js.map

package/dist/services/system/system-ollama-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-ollama-provider.js","sourceRoot":"","sources":["../../../src/services/system/system-ollama-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AACzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,oBAAoB,GAAG;IAC3B,wBAAwB;IACxB,wBAAwB;IACxB,oBAAoB;CACZ,CAAC;AAOX,IAAI,cAAc,GAGd;IACF,SAAS,EAAE,CAAC;IACZ,KAAK,EAAE,IAAI;CACZ,CAAC;AAEF,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,EAAE,CAAC;IAC5F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7E,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,UAAU;YAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,UAAU;YAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,SAAiB;IAC3D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,WAAW,EAAE;YAClD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,IAAI,GAAG,WAAW,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,IAAI,EAAE;YAAE,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,OAAO;QACL,UAAU,EAAE,yBAAyB;QACrC,IAAI,EAAE,eAAe;QACrB,YAAY,EAAE,QAAQ;QACtB,UAAU,EAAE,YAAY;QACxB,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,mBAAmB;QAC9B,YAAY,EAAE,QAAQ;QACtB,IAAI;QACJ,QAAQ;QACR,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,GAAG,IAAI,IAAI,QAAQ,GAAG,wBAAwB,EAAE;QACzD,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,MAAM;QACpB,SAAS,EAAE,MAAM;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAmD,EAAE;IAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;QACrD,OAAO,cAAc,CAAC,KAAK,CAAC;IAC9B,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACpF,IAAI,QAAQ,GAAiC,IAAI,CAAC;IAClD,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC;YAAE,SAAS;QACrD,QAAQ,GAAG;YACT,eAAe,EAAE,OAAO;YACxB,QAAQ,EAAE,aAAa,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClD,CAAC;QACF,MAAM;IACR,CAAC;IACD,cAAc,GAAG;QACf,SAAS,EAAE,GAAG,GAAG,gBAAgB;QACjC,KAAK,EAAE,QAAQ;KAChB,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,UAAkB;IACrE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,gBAAgB;QAAE,OAAO,QAAQ,CAAC,eAAe,CAAC;IACvD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,GAAG,QAAQ,CAAC,eAAe,IAAI,gBAAgB,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,cAAc,GAAG;QACf,SAAS,EAAE,CAAC;QACZ,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC"}

package/dist/services/system/system-reconciler.d.ts

@@ -0,0 +1,59 @@
+/**
+ * src/services/system/system-reconciler.ts
+ *
+ * Compares the system state rendered by the currently installed code against
+ * host files/services, then applies the shared setup-manager installers when
+ * privileged, domain-specific changes are needed.
+ */
+export type ReconcileFix = "none" | "system-reload" | "docker-pull" | "manual";
+export interface ReconcileItemResult {
+    component: string;
+    status: "ok" | "updated" | "skipped" | "error";
+    message: string;
+    /** Stable resource id from the expected-state renderer */
+    id?: string;
+    /** Host path that was compared */
+    path?: string;
+    /** True if this item requires sudo/root to fix */
+    requiresSudo?: boolean;
+    /** True if service reload/restart is needed before the rendered state is active */
+    reloadRequired?: boolean;
+    /** True if an operator action is required */
+    manualRequired?: boolean;
+    /** Machine-readable fix category */
+    fix?: ReconcileFix;
+    /** Exact command the user should run to fix this item */
+    command?: string;
+    /** Hashes are over normalized text, so irrelevant final newlines do not churn */
+    expectedHash?: string;
+    actualHash?: string;
+    /** Additional technical details for debugging */
+    details?: string;
+    /** Severity for UI display prioritization */
+    severity?: "info" | "warning" | "error";
+}
+export interface ReconcileResult {
+    timestamp: string;
+    items: ReconcileItemResult[];
+    /** True if any items require sudo and were not fixed */
+    hasPendingSudoActions: boolean;
+    /** True if current rendered system state is not active until reload/restart */
+    reloadRequired: boolean;
+    /** True if an operator action is required */
+    manualRequired: boolean;
+    /** True when the local process has enough privilege to apply reload-required fixes */
+    canAutoReload: boolean;
+    /** Standard command to converge system state */
+    command: string;
+}
+export interface SystemReloadStartResult {
+    accepted: true;
+    command: string;
+    message: string;
+    state: ReconcileResult | null;
+    unit?: string;
+}
+export declare function getStoredReconcileState(): ReconcileResult | null;
+export declare function inspectSystemDrift(): Promise<ReconcileResult>;
+export declare function reconcileSystem(): Promise<ReconcileResult>;
+export declare function startSystemReloadWithSudo(sudoPassword: string): Promise<SystemReloadStartResult>;