chore: update agent version

Author: zhengkunwang223

.github/workflows/deepseek-harness-release.yml

@@ -6,7 +6,7 @@ on:
     inputs:
       dshVersion:
         description: "@deepseek-ai/dsh npm version"
-        default: "0.2.0-rc.2"
+        default: "0.2.1-rc.2"
         required: true
       platforms:
         description: "Platforms"

.github/workflows/hermes-agent-release.yml

@@ -6,7 +6,7 @@ on:
     inputs:
       hermesAgentTag:
         description: "Hermes Agent release tag"
-        default: "0.21.6"
+        default: "0.22.2"
         required: true
       platforms:
         description: "Platforms"

.github/workflows/openclaw-release.yml

@@ -8,8 +8,8 @@ on:
   workflow_dispatch:
     inputs:
       openclawTag:
-        default: "2026.9.9"
-        description: "OpenClaw release and Docker Hub tag, for example 2026.9.9"
+        default: "2026.10.5"
+        description: "OpenClaw release and Docker Hub tag, for example 2026.10.5"
         required: true
       pushLatest:
         description: "Push latest tag"
@@ -94,9 +94,10 @@ jobs:
           mkdir -p _src/openclaw
           curl -fsSL "https://github.com/openclaw/openclaw/archive/refs/tags/v${{ needs.resolve.outputs.openclaw_tag }}.tar.gz" \
             | tar -xz -C _src/openclaw --strip-components=1
+          test -d _src/openclaw/examples || { echo "::error::OpenClaw source is missing examples/. Check openclawTag matches this Dockerfile."; exit 1; }
           test -d _src/openclaw/packages || { echo "::error::OpenClaw source is missing packages/. Check openclawTag matches this Dockerfile."; exit 1; }
           test -f _src/openclaw/node-version.mjs || { echo "::error::OpenClaw source is missing node-version.mjs. Check openclawTag matches this Dockerfile."; exit 1; }
-          for required_file in cli-root-options.mjs gateway-run-argv.mjs gateway-shutdown-budget.mjs node-host-launcher.mjs node-compile-cache.mjs docker-entrypoint.mjs scripts/lib/fs-safe-prebuild.mjs scripts/lib/javascript-statements.mjs; do
+          for required_file in cli-root-options.mjs gateway-run-argv.mjs gateway-shutdown-budget.mjs node-host-launcher.mjs node-compile-cache.mjs node-runtime-env.mjs docker-entrypoint.mjs scripts/lib/fs-safe-prebuild.mjs scripts/lib/javascript-statements.mjs scripts/docker/copy-bootstrap-scripts.mjs scripts/lib/guard-inventory-utils.mjs; do
             test -f "_src/openclaw/$required_file" || { echo "::error::OpenClaw source is missing $required_file. Check openclawTag matches this Dockerfile."; exit 1; }
           done
           test -f _src/openclaw/scripts/docker/verify-native-addons.sh || { echo "::error::OpenClaw source is missing scripts/docker/verify-native-addons.sh. Check openclawTag matches this Dockerfile."; exit 1; }
@@ -146,9 +147,10 @@ jobs:
           mkdir -p _src/openclaw
           curl -fsSL "https://github.com/openclaw/openclaw/archive/refs/tags/v${{ needs.resolve.outputs.openclaw_tag }}.tar.gz" \
             | tar -xz -C _src/openclaw --strip-components=1
+          test -d _src/openclaw/examples || { echo "::error::OpenClaw source is missing examples/. Check openclawTag matches this Dockerfile."; exit 1; }
           test -d _src/openclaw/packages || { echo "::error::OpenClaw source is missing packages/. Check openclawTag matches this Dockerfile."; exit 1; }
           test -f _src/openclaw/node-version.mjs || { echo "::error::OpenClaw source is missing node-version.mjs. Check openclawTag matches this Dockerfile."; exit 1; }
-          for required_file in cli-root-options.mjs gateway-run-argv.mjs gateway-shutdown-budget.mjs node-host-launcher.mjs node-compile-cache.mjs docker-entrypoint.mjs scripts/lib/fs-safe-prebuild.mjs scripts/lib/javascript-statements.mjs; do
+          for required_file in cli-root-options.mjs gateway-run-argv.mjs gateway-shutdown-budget.mjs node-host-launcher.mjs node-compile-cache.mjs node-runtime-env.mjs docker-entrypoint.mjs scripts/lib/fs-safe-prebuild.mjs scripts/lib/javascript-statements.mjs scripts/docker/copy-bootstrap-scripts.mjs scripts/lib/guard-inventory-utils.mjs; do
             test -f "_src/openclaw/$required_file" || { echo "::error::OpenClaw source is missing $required_file. Check openclawTag matches this Dockerfile."; exit 1; }
           done
           test -f _src/openclaw/scripts/docker/verify-native-addons.sh || { echo "::error::OpenClaw source is missing scripts/docker/verify-native-addons.sh. Check openclawTag matches this Dockerfile."; exit 1; }

deepseek-harness/Caddyfile

@@ -22,14 +22,6 @@ https://{$CADDY_ACCESS_HOST}:8443 {
 	@unexpected_origin `{http.request.header.Origin} != "" && {http.request.header.Origin} != "https://" + {http.request.hostport}`
 	@settings_api path /api/settings.describe /api/settings.update /api/settings.replace /api/settings.mutate /api/credentials.describe /api/credentials.set /api/credentials.unset /api/llm.discoverModels
 
-	route /dsh-deployment.js {
-		header {
-			Content-Type "application/javascript; charset=utf-8"
-			Cache-Control "no-store"
-		}
-		respond "globalThis.__DSH_AUTHENTICATED_SETTINGS__ = true;" 200
-	}
-
 	route @settings_api {
 		respond @unexpected_origin "Forbidden" 403
 		reverse_proxy 127.0.0.1:3080 {

deepseek-harness/Dockerfile

@@ -2,7 +2,7 @@ FROM caddy:2.11.4 AS caddy
 
 FROM node:24-bookworm-slim AS dsh-builder
 
-ARG DSH_VERSION=0.2.0-rc.2
+ARG DSH_VERSION=0.2.1-rc.2
 
 RUN apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \

deepseek-harness/docker-entrypoint.sh

@@ -67,7 +67,7 @@ gosu node env \
   DSH_TELEMETRY_DISABLED=1 \
   ONEPANEL_DSH_AUTH_PROXY=1 \
   node --expose-internals /usr/local/lib/node_modules/@deepseek-ai/dsh/lib/bin.js \
-    web --host 127.0.0.1 --port 3080 \
+    web --no-open --host 127.0.0.1 --port 3080 \
       --trusted-host 127.0.0.1:3080 "$access_host" &
 dsh_pid=$!
 pids+=("$dsh_pid")

deepseek-harness/patch-dsh-authenticated-settings.mjs

@@ -4,7 +4,6 @@ import { dirname, join, resolve } from 'node:path'
 
 const dshRoot = resolve(process.argv[2] ?? '/usr/local/lib/node_modules/@deepseek-ai/dsh')
 const requireFromDsh = createRequire(join(dshRoot, 'package.json'))
-const flag = 'globalThis.__DSH_AUTHENTICATED_SETTINGS__ === true'
 const proxyAuthFlag = 'process.env.ONEPANEL_DSH_AUTH_PROXY === "1"'
 
 async function packageRoot(name) {
@@ -22,49 +21,21 @@ function replaceOnce(source, original, replacement, label) {
   return source.replace(original, replacement)
 }
 
-const settingsPath = join(
-  await packageRoot('@deepseek-ai/dsh-client-ui-settings'),
-  'lib/client.js',
-)
-let settings = await readFile(settingsPath, 'utf8')
-settings = replaceOnce(
-  settings,
-  'const persistence = ctx.remote.$host.isLoopback ? "host" : "memory";',
-  `const persistence = ctx.remote.$host.isLoopback || ${flag} ? "host" : "memory";`,
-  'settings persistence',
-)
-await writeFile(settingsPath, settings, 'utf8')
-
+// DSH 0.2.1 persists settings through remote.settings for authenticated clients.
+// Only adapt browser authentication for the loopback backend protected by Caddy.
 const connectionPath = join(
   await packageRoot('@deepseek-ai/dsh-client-connection'),
   'lib/index.js',
 )
 let connection = await readFile(connectionPath, 'utf8')
 connection = replaceOnce(
   connection,
-  'isAuthenticated(request) {\n\t\tconst authority = requestAuthority(request.headers);',
-  `isAuthenticated(request) {\n\t\tif (${proxyAuthFlag}) return true;\n\t\tconst authority = requestAuthority(request.headers);`,
+  'isAuthenticated(request, secure = false) {\n\t\treturn this.authenticate(request, secure)?.version === COOKIE_PAYLOAD_VERSION;',
+  `isAuthenticated(request, secure = false) {\n\t\tif (${proxyAuthFlag}) return true;\n\t\treturn this.authenticate(request, secure)?.version === COOKIE_PAYLOAD_VERSION;`,
   'browser proxy authentication',
 )
 await writeFile(connectionPath, connection, 'utf8')
 
-const frontendPath = join(
-  await packageRoot('@deepseek-ai/dsh-web-frontend'),
-  'dist/index.html',
-)
-let frontend = await readFile(frontendPath, 'utf8')
-const bootstrap = '<script src="/dsh-deployment.js"></script>'
-const moduleScripts = frontend.match(/  <script type="module"[^>]*><\/script>/gu) ?? []
-if (moduleScripts.length !== 1 || frontend.includes(bootstrap)) {
-  throw new Error(`unexpected frontend source shape: module=${moduleScripts.length}`)
-}
-frontend = frontend.replace(moduleScripts[0], `  ${bootstrap}\n${moduleScripts[0]}`)
-await writeFile(frontendPath, frontend, 'utf8')
-
-if (
-  (settings.split(flag).length - 1) !== 1 ||
-  (connection.split(proxyAuthFlag).length - 1) !== 1 ||
-  !frontend.includes(`${bootstrap}\n${moduleScripts[0]}`)
-) {
-  throw new Error('authenticated settings patch verification failed')
+if ((connection.split(proxyAuthFlag).length - 1) !== 1) {
+  throw new Error('browser proxy authentication patch verification failed')
 }

hermes-agent/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.7
 
-ARG BASE_IMAGE=nousresearch/hermes-agent:v0.21.6
+ARG BASE_IMAGE=nousresearch/hermes-agent:v0.22.2
 FROM ${BASE_IMAGE}
 
 LABEL org.opencontainers.image.source="https://github.com/1Panel-dev/runtime" \

openclaw/Dockerfile

@@ -33,7 +33,8 @@ ARG OPENCLAW_BUN_IMAGE="docker.io/oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5
 FROM ${OPENCLAW_NODE_BOOKWORM_IMAGE} AS workspace-deps
 ARG OPENCLAW_EXTENSIONS
 ARG OPENCLAW_BUNDLED_PLUGIN_DIR
-# Copy package.json files for workspace packages used by the install layer.
+# Frozen installs validate every lockfile importer's manifest, including unselected plugins.
+# Stage all workspace manifests, then filter dependency installation separately.
 # Manifest-only bundled plugins remain valid selections but need no workspace metadata.
 # Use COPY because build-context bind mounts are unreliable across supported
 # Podman/Buildah hosts. Full trees stay in this disposable stage; later stages
@@ -42,28 +43,21 @@ COPY scripts/lib/docker-plugin-selection.mjs /tmp/docker-plugin-selection.mjs
 COPY scripts/lib/root-package-bundled-plugin-excludes.mjs /tmp/root-package-bundled-plugin-excludes.mjs
 COPY package.json /tmp/package.json
 COPY packages /tmp/packages
+COPY examples /tmp/examples
 COPY ${OPENCLAW_BUNDLED_PLUGIN_DIR} /tmp/${OPENCLAW_BUNDLED_PLUGIN_DIR}
-RUN mkdir -p /out/packages "/out/${OPENCLAW_BUNDLED_PLUGIN_DIR}" && \
-    for manifest in /tmp/packages/*/package.json; do \
+RUN mkdir -p /out/packages /out/examples "/out/${OPENCLAW_BUNDLED_PLUGIN_DIR}" && \
+    for manifest in /tmp/packages/*/package.json /tmp/examples/*/package.json "/tmp/${OPENCLAW_BUNDLED_PLUGIN_DIR}"/*/package.json; do \
       [ -f "$manifest" ] || continue; \
-      pkg_dir="${manifest%/package.json}"; \
-      pkg_name="${pkg_dir##*/}"; \
-      mkdir -p "/out/packages/$pkg_name" && \
-      cp "$manifest" "/out/packages/$pkg_name/package.json"; \
+      manifest_path="${manifest#/tmp/}"; \
+      mkdir -p "/out/${manifest_path%/package.json}" && \
+      cp "$manifest" "/out/$manifest_path"; \
     done && \
     node /tmp/docker-plugin-selection.mjs "/tmp/${OPENCLAW_BUNDLED_PLUGIN_DIR}" "$OPENCLAW_EXTENSIONS" \
       > /out/openclaw-selected-plugin-dirs && \
     node /tmp/docker-plugin-selection.mjs "/tmp/${OPENCLAW_BUNDLED_PLUGIN_DIR}" "$OPENCLAW_EXTENSIONS" \
       --required-platform-packages > /out/openclaw-required-platform-packages && \
     node /tmp/docker-plugin-selection.mjs "/tmp/${OPENCLAW_BUNDLED_PLUGIN_DIR}" "$OPENCLAW_EXTENSIONS" \
-      --required-bundled /tmp/package.json > /tmp/openclaw-workspace-plugin-dirs && \
-    while IFS= read -r ext; do \
-      ext_dir="/tmp/${OPENCLAW_BUNDLED_PLUGIN_DIR}/$ext"; \
-      if [ -f "$ext_dir/package.json" ]; then \
-        mkdir -p "/out/${OPENCLAW_BUNDLED_PLUGIN_DIR}/$ext" && \
-        cp "$ext_dir/package.json" "/out/${OPENCLAW_BUNDLED_PLUGIN_DIR}/$ext/package.json"; \
-      fi; \
-    done < /tmp/openclaw-workspace-plugin-dirs
+      --required-bundled /tmp/package.json > /out/openclaw-workspace-plugin-dirs
 
 # Shared manifest-only inputs. Both installs start without node_modules so pnpm
 # never has to rename a dependency directory inherited from an OverlayFS layer.
@@ -79,6 +73,7 @@ COPY node-version.mjs ./
 COPY node-sqlite.mjs ./
 COPY node-runtime-update.mjs ./
 COPY node-runtime-recovery.mjs ./
+COPY node-runtime-env.mjs ./
 COPY cli-root-options.mjs gateway-run-argv.mjs gateway-shutdown-budget.mjs ./
 COPY node-host-launcher.mjs ./
 COPY node-compile-cache.mjs ./
@@ -95,15 +90,21 @@ COPY scripts/docker/verify-fs-safe-native.mjs ./scripts/docker/verify-fs-safe-na
 COPY scripts/docker/verify-native-addons.sh ./scripts/docker/verify-native-addons.sh
 
 COPY --from=workspace-deps /out/packages/ ./packages/
+COPY --from=workspace-deps /out/examples/ ./examples/
 COPY --from=workspace-deps /out/${OPENCLAW_BUNDLED_PLUGIN_DIR}/ ./${OPENCLAW_BUNDLED_PLUGIN_DIR}/
+COPY --from=workspace-deps /out/openclaw-workspace-plugin-dirs /tmp/openclaw-workspace-plugin-dirs
 COPY --from=workspace-deps /out/openclaw-selected-plugin-dirs /tmp/openclaw-selected-plugin-dirs
 COPY --from=workspace-deps /out/openclaw-required-platform-packages /tmp/openclaw-required-platform-packages
 
 # Production dependencies are installed separately so runtime assets never
 # depend on pruning an inherited development node_modules tree.
 FROM dependency-inputs AS production-deps
 RUN --mount=type=cache,id=openclaw-pnpm-store,target=/root/.local/share/pnpm/store,sharing=locked \
-    NODE_OPTIONS=--max-old-space-size=2048 pnpm install --frozen-lockfile --prod \
+    set -eu; set -- --filter . --filter ./ui --filter './packages/*'; \
+    while IFS= read -r ext; do \
+      set -- "$@" --filter "./${OPENCLAW_BUNDLED_PLUGIN_DIR}/$ext"; \
+    done < /tmp/openclaw-workspace-plugin-dirs; \
+    NODE_OPTIONS=--max-old-space-size=2048 pnpm install --frozen-lockfile --prod "$@" \
       --config.supportedArchitectures.os=linux \
       --config.supportedArchitectures.cpu="$(node -p 'process.arch')" \
       --config.supportedArchitectures.libc=glibc
@@ -121,6 +122,8 @@ COPY --from=bun-binary /usr/local/bin/bun /usr/local/bin/bun
 
 # Reduce OOM risk on low-memory hosts during dependency installation.
 # Docker builds on small VMs may otherwise fail with "Killed" (exit 137).
+# Source asset preparation builds external plugins before runtime pruning.
+# Its build dependencies stay in this disposable stage; production remains filtered.
 RUN --mount=type=cache,id=openclaw-pnpm-store,target=/root/.local/share/pnpm/store,sharing=locked \
     NODE_OPTIONS=--max-old-space-size=2048 pnpm install --frozen-lockfile \
       --config.supportedArchitectures.os=linux \
@@ -226,7 +229,8 @@ RUN node scripts/postinstall-bundled-plugins.mjs && \
         -name 'claude-agent-sdk-linux-*' -exec rm -rf {} +; \
     fi && \
     node --input-type=module -e 'await import("grammy")' && \
-    node scripts/check-package-dist-imports.mjs /app
+    node scripts/check-package-dist-imports.mjs /app && \
+    node scripts/docker/copy-bootstrap-scripts.mjs /app/.runtime-bootstrap
 
 FROM ${OPENCLAW_NODE_BOOKWORM_SLIM_IMAGE} AS base-runtime
 ARG OPENCLAW_NODE_BOOKWORM_SLIM_DIGEST
@@ -280,11 +284,14 @@ COPY --from=runtime-assets --chown=node:node /app/node-version.mjs .
 COPY --from=runtime-assets --chown=node:node /app/node-sqlite.mjs .
 COPY --from=runtime-assets --chown=node:node /app/node-runtime-update.mjs .
 COPY --from=runtime-assets --chown=node:node /app/node-runtime-recovery.mjs .
+COPY --from=runtime-assets --chown=node:node /app/node-runtime-env.mjs .
 COPY --from=runtime-assets --chown=node:node /app/cli-root-options.mjs /app/gateway-run-argv.mjs /app/gateway-shutdown-budget.mjs ./
 COPY --from=runtime-assets --chown=node:node /app/node-host-launcher.mjs .
 COPY --from=runtime-assets --chown=node:node /app/node-compile-cache.mjs .
 COPY --from=runtime-assets --chown=node:node /app/docker-entrypoint.mjs .
 COPY --from=runtime-assets --chown=node:node /app/openclaw.mjs .
+COPY --from=runtime-assets --chown=node:node /app/.runtime-bootstrap/scripts ./scripts
+COPY --from=runtime-assets --chown=node:node /app/scripts/lib/guard-inventory-utils.mjs ./scripts/lib/
 COPY --from=runtime-assets --chown=node:node /app/${OPENCLAW_BUNDLED_PLUGIN_DIR} ./${OPENCLAW_BUNDLED_PLUGIN_DIR}
 COPY --from=runtime-assets --chown=node:node /app/skills ./skills
 COPY --from=runtime-assets --chown=node:node /app/docs ./docs