Upload 4 files

Dockerfile

@@ -1,6 +1,20 @@
 # ============================================================
 # Dify 1.17.0 All-in-One for Hugging Face Spaces
-# Core structure kept from the previous HF deployment.
+#
+# Keeps the previous compact HF layout:
+#   - Dify API 1.17.0
+#   - Dify Web 1.17.0
+#   - Dify Plugin Daemon 0.6.10-local
+#   - Celery worker
+#   - Nginx :7860
+#   - Neon PostgreSQL
+#   - Upstash Redis
+#   - Low-transfer HF State Keeper
+#
+# FIX:
+# Dify Web 1.17.0 image no longer stores the runtime at /app/web.
+# Its production image stores the Next/Vinext runtimes under /app/targets
+# and its launcher at /app/entrypoint.sh.
 # ============================================================
 
 FROM langgenius/dify-web:1.17.0 AS web
@@ -11,10 +25,26 @@ USER root
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
-        nginx redis-server redis-tools locales curl ffmpeg git \
-        build-essential cmake pkg-config libcairo2-dev libjpeg62-turbo-dev libgif-dev \
+        nginx \
+        redis-server \
+        redis-tools \
+        locales \
+        curl \
+        ffmpeg \
+        git \
+        build-essential \
+        cmake \
+        pkg-config \
+        libcairo2-dev \
+        libjpeg62-turbo-dev \
+        libgif-dev \
     && rm -rf /var/lib/apt/lists/* \
-    && localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8 || true
+    && localedef \
+        -i en_US \
+        -c \
+        -f UTF-8 \
+        -A /usr/share/locale/locale.alias \
+        en_US.UTF-8 || true
 
 ENV LANG=en_US.UTF-8 \
     LC_ALL=en_US.UTF-8 \
@@ -22,14 +52,20 @@ ENV LANG=en_US.UTF-8 \
     MALLOC_ARENA_MAX=2 \
     NODE_OPTIONS=--max-old-space-size=2048
 
-COPY --from=web /app/web /app/web
+# Dify Web 1.17 production image layout:
+#   /app/targets/next
+#   /app/targets/vinext
+#   /app/entrypoint.sh
+COPY --from=web /app/targets /app/web/targets
+COPY --from=web /app/entrypoint.sh /app/web/entrypoint.sh
+
 COPY --from=plugin_daemon /app/main /opt/dify-plugin-daemon/main
 
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY start.sh /app/start.sh
 COPY hf_state_keeper.py /app/hf_state_keeper.py
 
-ARG FORCE_REBUILD=20260908_DIFY_1170_HF_FRESH_V1
+ARG FORCE_REBUILD=20260908_DIFY_1170_HF_WEBPATH_FIX1
 RUN echo "${FORCE_REBUILD}" > /tmp/dify-build-version
 
 RUN install -d -o dify -g dify -m 0755 /home/dify \
@@ -45,7 +81,9 @@ RUN mkdir -p \
         /app/storage/plugin_packages \
         /app/storage/assets \
         /app/.tiktoken \
+        /app/web \
         /var/log/nginx \
+        /var/lib/nginx \
         /var/lib/nginx/body \
         /var/lib/nginx/proxy \
         /var/lib/nginx/fastcgi \
@@ -54,11 +92,16 @@ RUN mkdir -p \
         /var/cache/nginx \
         /run
 
-RUN chmod +x /app/start.sh /app/hf_state_keeper.py /opt/dify-plugin-daemon/main \
+RUN chmod +x \
+        /app/start.sh \
+        /app/hf_state_keeper.py \
+        /app/web/entrypoint.sh \
+        /opt/dify-plugin-daemon/main \
     && chown -R dify:dify \
         /home/dify \
         /app/api/storage \
         /app/storage \
+        /app/web \
         /opt/dify-plugin-daemon \
         /var/log/nginx \
         /var/lib/nginx \
@@ -71,7 +114,10 @@ RUN su -s /bin/bash dify -c '\
     touch /home/dify/.cache/uv/.write-test && \
     rm -f /home/dify/.cache/uv/.write-test && \
     /usr/local/bin/uv --version && \
-    echo "UV PERMISSION TEST = OK" \
+    node --version && \
+    test -f /app/web/entrypoint.sh && \
+    test -d /app/web/targets/next && \
+    echo "DIFY 1.17 WEB RUNTIME TEST = OK" \
     '
 
 ENV PORT=7860 \

README-FIX1.txt

@@ -0,0 +1,22 @@
+Dify 1.17.0 HF FIX 1
+
+Cause of previous build error:
+- dify-web:1.17.0 does NOT have /app/web in its production image.
+- Runtime is under /app/targets and launcher is /app/entrypoint.sh.
+
+Files to replace:
+- Dockerfile
+- start.sh
+
+Unchanged:
+- hf_state_keeper.py (low-transfer version)
+- nginx.conf
+- HF Variables/Secrets
+
+Neon:
+- neondb
+- dify_plugin
+
+Redis:
+- keep existing Upstash settings
+- REDIS_DB=0

start.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # ============================================================
 # Dify 1.17.0 All-in-One for Hugging Face Spaces
-# Fresh Neon DB + existing Upstash Redis + Low-Transfer State Keeper
+# Fresh Neon + Upstash Redis + Low-Transfer State Keeper
 # ============================================================
 
 set -E -o pipefail
@@ -18,21 +18,28 @@ PUBLIC_ORIGIN="${PUBLIC_ORIGIN%/}"
 echo "🌍 HF_HOST       = ${HF_HOST}"
 echo "🌍 PUBLIC_ORIGIN = ${PUBLIC_ORIGIN}"
 
+# ============================================================
+# Core runtime
+# ============================================================
 export LANG="${LANG:-en_US.UTF-8}"
 export LC_ALL="${LC_ALL:-en_US.UTF-8}"
 export PYTHONIOENCODING="${PYTHONIOENCODING:-utf-8}"
+
 export MODE="api"
 export DEBUG="false"
 export DEPLOY_ENV="${DEPLOY_ENV:-PRODUCTION}"
 export EDITION="SELF_HOSTED"
 export DB_TYPE="${DB_TYPE:-postgresql}"
+
 export DIFY_BIND_ADDRESS="127.0.0.1"
 export DIFY_PORT="5001"
 
+# ============================================================
+# Storage
+# ============================================================
 export STORAGE_TYPE="local"
 export STORAGE_LOCAL_PATH="/app/api/storage"
 
-# Dify 1.17 official plugin-daemon local root.
 export PLUGIN_STORAGE_TYPE="local"
 export PLUGIN_STORAGE_LOCAL_ROOT="/app/storage"
 export PLUGIN_WORKING_PATH="${PLUGIN_STORAGE_LOCAL_ROOT}/cwd"
@@ -49,6 +56,9 @@ mkdir -p \
     "${PLUGIN_STORAGE_LOCAL_ROOT}/${PLUGIN_PACKAGE_CACHE_PATH}" \
     "${PLUGIN_STORAGE_LOCAL_ROOT}/${PLUGIN_MEDIA_CACHE_PATH}"
 
+# ============================================================
+# Public URLs
+# ============================================================
 export CONSOLE_API_URL="${PUBLIC_ORIGIN}"
 export CONSOLE_WEB_URL="${PUBLIC_ORIGIN}"
 export APP_API_URL="${PUBLIC_ORIGIN}"
@@ -59,71 +69,84 @@ export INTERNAL_FILES_URL="http://127.0.0.1:5001"
 export TRIGGER_URL="${PUBLIC_ORIGIN}"
 export ENDPOINT_URL_TEMPLATE="${PUBLIC_ORIGIN}/e/{hook_id}"
 
-# Dify 1.17 web server-side routing.
 export SERVER_CONSOLE_API_URL="http://127.0.0.1:5001"
 export SERVER_APP_API_URL="http://127.0.0.1:5001"
 
 export COOKIE_DOMAIN=""
 export NEXT_PUBLIC_COOKIE_DOMAIN=""
+
+# ============================================================
+# Web runtime environment
+# ============================================================
 export NEXT_PUBLIC_DEPLOY_ENV="${DEPLOY_ENV}"
 export NEXT_PUBLIC_EDITION="${EDITION}"
 export NEXT_PUBLIC_BASE_PATH=""
-export NEXT_PUBLIC_API_PREFIX="${CONSOLE_API_URL}/console/api"
-export NEXT_PUBLIC_PUBLIC_API_PREFIX="${APP_API_URL}/api"
 
 export MARKETPLACE_API_URL="${MARKETPLACE_API_URL:-https://marketplace.dify.ai}"
 export MARKETPLACE_URL="${MARKETPLACE_URL:-https://marketplace.dify.ai}"
-export NEXT_PUBLIC_MARKETPLACE_API_PREFIX="${MARKETPLACE_API_URL}/api/v1"
-export NEXT_PUBLIC_MARKETPLACE_URL_PREFIX="${MARKETPLACE_URL}"
-export NEXT_PUBLIC_SENTRY_DSN="${SENTRY_DSN:-}"
+
 export NEXT_TELEMETRY_DISABLED="${NEXT_TELEMETRY_DISABLED:-1}"
-export NEXT_PUBLIC_TEXT_GENERATION_TIMEOUT_MS="${TEXT_GENERATION_TIMEOUT_MS:-60000}"
-export NEXT_PUBLIC_CSP_WHITELIST="${CSP_WHITELIST:-}"
-export NEXT_PUBLIC_ALLOW_EMBED="${ALLOW_EMBED:-false}"
-export NEXT_PUBLIC_ALLOW_UNSAFE_DATA_SCHEME="${ALLOW_UNSAFE_DATA_SCHEME:-false}"
+export EXPERIMENTAL_ENABLE_VINEXT="${EXPERIMENTAL_ENABLE_VINEXT:-false}"
+export TEXT_GENERATION_TIMEOUT_MS="${TEXT_GENERATION_TIMEOUT_MS:-60000}"
+export CSP_WHITELIST="${CSP_WHITELIST:-}"
+export ALLOW_EMBED="${ALLOW_EMBED:-false}"
+export ALLOW_UNSAFE_DATA_SCHEME="${ALLOW_UNSAFE_DATA_SCHEME:-false}"
 
+# ============================================================
+# Plugin Daemon
+# ============================================================
 export DB_PLUGIN_DATABASE="${DB_PLUGIN_DATABASE:-dify_plugin}"
+
 export PLUGIN_DAEMON_PORT="${PLUGIN_DAEMON_PORT:-5002}"
 export PLUGIN_DAEMON_URL="http://127.0.0.1:${PLUGIN_DAEMON_PORT}"
 export PLUGIN_DIFY_INNER_API_URL="http://127.0.0.1:5001"
+
 export PLUGIN_DEBUGGING_HOST="127.0.0.1"
 export PLUGIN_DEBUGGING_PORT="${PLUGIN_DEBUGGING_PORT:-5003}"
+
 export PLUGIN_MAX_PACKAGE_SIZE="${PLUGIN_MAX_PACKAGE_SIZE:-52428800}"
-export PLUGIN_MAX_FILE_SIZE="${PLUGIN_MAX_FILE_SIZE:-52428800}"
-export PLUGIN_MODEL_SCHEMA_CACHE_TTL="${PLUGIN_MODEL_SCHEMA_CACHE_TTL:-3600}"
 export PLUGIN_PYTHON_ENV_INIT_TIMEOUT="${PLUGIN_PYTHON_ENV_INIT_TIMEOUT:-120}"
 export PLUGIN_MAX_EXECUTION_TIMEOUT="${PLUGIN_MAX_EXECUTION_TIMEOUT:-600}"
 export PLUGIN_STDIO_BUFFER_SIZE="${PLUGIN_STDIO_BUFFER_SIZE:-1024}"
 export PLUGIN_STDIO_MAX_BUFFER_SIZE="${PLUGIN_STDIO_MAX_BUFFER_SIZE:-5242880}"
+
 export FORCE_VERIFYING_SIGNATURE="${FORCE_VERIFYING_SIGNATURE:-true}"
 export MARKETPLACE_ENABLED="${MARKETPLACE_ENABLED:-true}"
 
 if [ -z "${PLUGIN_DAEMON_KEY:-}" ]; then
-    export PLUGIN_DAEMON_KEY="$(python - <<'PY'
+    export PLUGIN_DAEMON_KEY="$(
+        python - <<'PY'
 import hashlib, os
 secret = os.environ.get("SECRET_KEY", "dify")
 print(hashlib.sha256(("plugin-daemon:" + secret).encode()).hexdigest())
 PY
-)"
+    )"
 fi
 
 if [ -z "${PLUGIN_DIFY_INNER_API_KEY:-}" ]; then
-    export PLUGIN_DIFY_INNER_API_KEY="$(python - <<'PY'
+    export PLUGIN_DIFY_INNER_API_KEY="$(
+        python - <<'PY'
 import hashlib, os
 secret = os.environ.get("SECRET_KEY", "dify")
 print(hashlib.sha256(("plugin-inner-api:" + secret).encode()).hexdigest())
 PY
-)"
+    )"
 fi
 
 export INNER_API_KEY_FOR_PLUGIN="${PLUGIN_DIFY_INNER_API_KEY}"
 
+# ============================================================
+# Validate settings
+# ============================================================
 if [ -z "${SECRET_KEY:-}" ]; then
     echo "❌ SECRET_KEY is missing"
     exit 1
 fi
 
-if [ -z "${DB_HOST:-}" ] || [ -z "${DB_DATABASE:-}" ] || [ -z "${DB_USERNAME:-}" ] || [ -z "${DB_PASSWORD:-}" ]; then
+if [ -z "${DB_HOST:-}" ] || \
+   [ -z "${DB_DATABASE:-}" ] || \
+   [ -z "${DB_USERNAME:-}" ] || \
+   [ -z "${DB_PASSWORD:-}" ]; then
     echo "❌ Neon DB settings are incomplete"
     exit 1
 fi
@@ -141,6 +164,9 @@ echo "STORAGE_LOCAL_PATH  = ${STORAGE_LOCAL_PATH}"
 echo "PLUGIN_STORAGE      = ${PLUGIN_STORAGE_LOCAL_ROOT}"
 echo "-----------------------------------------"
 
+# ============================================================
+# State Keeper restore
+# ============================================================
 echo ""
 echo "============================================================"
 echo "💾 Restoring HF runtime state from Neon"
@@ -160,19 +186,25 @@ else
     exit 1
 fi
 
+# ============================================================
+# Redis
+# ============================================================
 LOCAL_REDIS_ACTIVE=0
 REDIS_MODE="UNKNOWN"
 
 test_redis_connection() {
 python - <<'PY'
 import os, ssl, sys, redis
+
 host = os.environ.get("REDIS_HOST", "")
 port = int(os.environ.get("REDIS_PORT", "6379"))
 username = os.environ.get("REDIS_USERNAME", "") or None
 password = os.environ.get("REDIS_PASSWORD", "") or None
-use_ssl = os.environ.get("REDIS_USE_SSL", "false").strip().lower() in ("true", "1", "yes", "on")
+use_ssl = os.environ.get("REDIS_USE_SSL", "false").strip().lower() in ("true","1","yes","on")
+
 if not host:
     sys.exit(1)
+
 kwargs = {
     "host": host,
     "port": port,
@@ -182,11 +214,17 @@ kwargs = {
     "socket_connect_timeout": 5,
     "socket_timeout": 5,
 }
+
 if use_ssl:
     kwargs["ssl"] = True
     cert_value = os.environ.get("REDIS_SSL_CERT_REQS", "CERT_NONE").upper()
-    cert_map = {"CERT_NONE": ssl.CERT_NONE, "CERT_OPTIONAL": ssl.CERT_OPTIONAL, "CERT_REQUIRED": ssl.CERT_REQUIRED}
+    cert_map = {
+        "CERT_NONE": ssl.CERT_NONE,
+        "CERT_OPTIONAL": ssl.CERT_OPTIONAL,
+        "CERT_REQUIRED": ssl.CERT_REQUIRED,
+    }
     kwargs["ssl_cert_reqs"] = cert_map.get(cert_value, ssl.CERT_NONE)
+
 try:
     client = redis.Redis(**kwargs)
     client.ping()
@@ -204,6 +242,7 @@ echo "🔎 Checking Redis"
 echo "============================================================"
 
 EXTERNAL_REDIS_OK=0
+
 if [ -n "${REDIS_HOST:-}" ]; then
     for attempt in 1 2 3 4 5; do
         echo "Redis attempt ${attempt}/5"
@@ -221,7 +260,18 @@ if [ "${EXTERNAL_REDIS_OK}" = "1" ]; then
 else
     echo "⚠️ External Redis unavailable"
     echo "⚠️ Starting local Redis fallback"
-    redis-server --bind 127.0.0.1 --protected-mode yes --port 6379 --save "" --appendonly no --daemonize yes --dir /tmp --pidfile /tmp/dify-local-redis.pid --logfile /tmp/dify-local-redis.log
+
+    redis-server \
+        --bind 127.0.0.1 \
+        --protected-mode yes \
+        --port 6379 \
+        --save "" \
+        --appendonly no \
+        --daemonize yes \
+        --dir /tmp \
+        --pidfile /tmp/dify-local-redis.pid \
+        --logfile /tmp/dify-local-redis.log
+
     export REDIS_HOST="127.0.0.1"
     export REDIS_PORT="6379"
     export REDIS_USERNAME=""
@@ -231,6 +281,7 @@ else
     export REDIS_DB="0"
     export REDIS_USE_SENTINEL="false"
     export REDIS_USE_CLUSTERS="false"
+
     REDIS_MODE="LOCAL_FALLBACK"
     LOCAL_REDIS_ACTIVE=1
     sleep 2
@@ -243,37 +294,52 @@ fi
 
 echo "✅ Redis mode = ${REDIS_MODE}"
 
-export CELERY_BROKER_URL="$(python - <<'PY'
+# ============================================================
+# Celery broker
+# ============================================================
+export CELERY_BROKER_URL="$(
+python - <<'PY'
 import os
 from urllib.parse import quote
+
 host = os.environ.get("REDIS_HOST", "127.0.0.1")
 port = os.environ.get("REDIS_PORT", "6379")
 username = os.environ.get("REDIS_USERNAME", "")
 password = os.environ.get("REDIS_PASSWORD", "")
 redis_db = os.environ.get("REDIS_DB", "0")
-ssl_enabled = os.environ.get("REDIS_USE_SSL", "false").lower() in ("true", "1", "yes", "on")
+ssl_enabled = os.environ.get("REDIS_USE_SSL", "false").lower() in ("true","1","yes","on")
 cert_reqs = os.environ.get("REDIS_SSL_CERT_REQS", "CERT_NONE").upper()
+
 scheme = "rediss" if ssl_enabled else "redis"
+
 if username:
     auth = quote(username, safe="") + ":" + quote(password, safe="") + "@"
 elif password:
     auth = ":" + quote(password, safe="") + "@"
 else:
     auth = ""
+
 query = f"?ssl_cert_reqs={cert_reqs}" if ssl_enabled else ""
 print(f"{scheme}://{auth}{host}:{port}/{redis_db}{query}")
 PY
 )"
+
 export CELERY_BACKEND="redis"
 
+# ============================================================
+# Main DB migration
+# ============================================================
 cd /app/api
+
 MIGRATION_VALUE="$(echo "${MIGRATION_ENABLED:-true}" | tr '[:upper:]' '[:lower:]')"
+
 case "${MIGRATION_VALUE}" in
     true|1|yes|on)
         echo ""
         echo "============================================================"
         echo "🗄️ Running Dify 1.17 DB Migration"
         echo "============================================================"
+
         if flask upgrade-db; then
             echo "✅ Database migration OK"
         else
@@ -281,21 +347,25 @@ case "${MIGRATION_VALUE}" in
             exit 1
         fi
         ;;
-    *) echo "ℹ️ Migration disabled" ;;
+    *)
+        echo "ℹ️ Migration disabled"
+        ;;
 esac
 
-# Fresh install: do NOT force reset-encrypt-key-pair.
 if python /app/hf_state_keeper.py has-private-key; then
     echo "✅ Tenant RSA private key already present/restored"
 else
-    echo "ℹ️ No tenant private.pem yet - normal for a fresh Dify setup"
-    echo "ℹ️ State Keeper will back it up automatically after setup creates it"
+    echo "ℹ️ No tenant private.pem yet - normal for fresh Dify setup"
 fi
 
+# ============================================================
+# Start API
+# ============================================================
 echo ""
 echo "============================================================"
 echo "🧠 Starting Dify API :5001"
 echo "============================================================"
+
 cd /app/api
 
 gunicorn \
@@ -308,63 +378,100 @@ gunicorn \
     --access-logfile "-" \
     --error-logfile "-" \
     app:app &
+
 API_PID=$!
 
 API_READY=0
 for attempt in $(seq 1 120); do
-    if ! kill -0 "${API_PID}" 2>/dev/null; then echo "❌ API stopped"; exit 1; fi
-    HTTP_CODE="$(curl --silent --output /dev/null --write-out "%{http_code}" --connect-timeout 2 --max-time 5 http://127.0.0.1:5001/console/api/setup || true)"
+    if ! kill -0 "${API_PID}" 2>/dev/null; then
+        echo "❌ API stopped"
+        exit 1
+    fi
+
+    HTTP_CODE="$(
+        curl --silent --output /dev/null --write-out "%{http_code}" \
+            --connect-timeout 2 --max-time 5 \
+            http://127.0.0.1:5001/console/api/setup || true
+    )"
+
     case "${HTTP_CODE}" in
-        2*|3*|4*) API_READY=1; echo "✅ API ready HTTP ${HTTP_CODE}"; break ;;
+        2*|3*|4*)
+            API_READY=1
+            echo "✅ API ready HTTP ${HTTP_CODE}"
+            break
+            ;;
     esac
     sleep 1
 done
-if [ "${API_READY}" != "1" ]; then echo "❌ API unavailable"; exit 1; fi
 
+if [ "${API_READY}" != "1" ]; then
+    echo "❌ API unavailable"
+    exit 1
+fi
+
+# ============================================================
+# Plugin Daemon
+# ============================================================
 echo ""
 echo "============================================================"
 echo "🧩 Starting Plugin Daemon 0.6.10 :5002"
 echo "============================================================"
+
 (
     export DB_DATABASE="${DB_PLUGIN_DATABASE}"
     export SERVER_PORT="${PLUGIN_DAEMON_PORT}"
     export SERVER_KEY="${PLUGIN_DAEMON_KEY}"
     export MAX_PLUGIN_PACKAGE_SIZE="${PLUGIN_MAX_PACKAGE_SIZE}"
     export PPROF_ENABLED="false"
+
     export DIFY_INNER_API_URL="${PLUGIN_DIFY_INNER_API_URL}"
     export DIFY_INNER_API_KEY="${PLUGIN_DIFY_INNER_API_KEY}"
+
     export PLUGIN_REMOTE_INSTALLING_HOST="${PLUGIN_DEBUGGING_HOST}"
     export PLUGIN_REMOTE_INSTALLING_PORT="${PLUGIN_DEBUGGING_PORT}"
     export PLUGIN_WORKING_PATH="${PLUGIN_WORKING_PATH}"
+
     export FORCE_VERIFYING_SIGNATURE="${FORCE_VERIFYING_SIGNATURE}"
     export PYTHON_ENV_INIT_TIMEOUT="${PLUGIN_PYTHON_ENV_INIT_TIMEOUT}"
     export PLUGIN_MAX_EXECUTION_TIMEOUT="${PLUGIN_MAX_EXECUTION_TIMEOUT}"
     export PLUGIN_STDIO_BUFFER_SIZE="${PLUGIN_STDIO_BUFFER_SIZE}"
     export PLUGIN_STDIO_MAX_BUFFER_SIZE="${PLUGIN_STDIO_MAX_BUFFER_SIZE}"
+
     export PLUGIN_STORAGE_TYPE="${PLUGIN_STORAGE_TYPE}"
     export PLUGIN_STORAGE_LOCAL_ROOT="${PLUGIN_STORAGE_LOCAL_ROOT}"
     export PLUGIN_INSTALLED_PATH="${PLUGIN_INSTALLED_PATH}"
     export PLUGIN_PACKAGE_CACHE_PATH="${PLUGIN_PACKAGE_CACHE_PATH}"
     export PLUGIN_MEDIA_CACHE_PATH="${PLUGIN_MEDIA_CACHE_PATH}"
+
     export MARKETPLACE_ENABLED="${MARKETPLACE_ENABLED}"
     export MARKETPLACE_API_URL="${MARKETPLACE_API_URL}"
+
     export UV_PATH="/usr/local/bin/uv"
     export PYTHON_INTERPRETER_PATH="/usr/local/bin/python3.12"
     export PLATFORM="local"
     export GIN_MODE="release"
     export TIKTOKEN_CACHE_DIR="/app/.tiktoken"
+
     exec /opt/dify-plugin-daemon/main
 ) &
+
 PLUGIN_PID=$!
 
 PLUGIN_READY=0
 for attempt in $(seq 1 120); do
-    if ! kill -0 "${PLUGIN_PID}" 2>/dev/null; then echo "❌ Plugin Daemon stopped"; break; fi
+    if ! kill -0 "${PLUGIN_PID}" 2>/dev/null; then
+        echo "❌ Plugin Daemon stopped"
+        break
+    fi
+
     if python - <<'PY'
 import socket, sys
-sock = socket.socket(); sock.settimeout(1)
+sock = socket.socket()
+sock.settimeout(1)
 try:
-    sock.connect(("127.0.0.1", 5002)); sock.close(); sys.exit(0)
+    sock.connect(("127.0.0.1", 5002))
+    sock.close()
+    sys.exit(0)
 except Exception:
     sys.exit(1)
 PY
@@ -373,66 +480,137 @@ PY
         echo "✅ Plugin Daemon ready"
         break
     fi
+
     sleep 1
 done
-if [ "${PLUGIN_READY}" != "1" ]; then echo "⚠️ Plugin Daemon unavailable"; fi
 
+if [ "${PLUGIN_READY}" != "1" ]; then
+    echo "⚠️ Plugin Daemon unavailable"
+fi
+
+# ============================================================
+# Celery worker
+# ============================================================
 echo ""
 echo "============================================================"
 echo "⚙️ Starting Celery Worker"
 echo "============================================================"
+
 (
     export MODE="worker"
     export MIGRATION_ENABLED="false"
     export CELERY_WORKER_AMOUNT="${CELERY_WORKER_AMOUNT:-1}"
     export CELERY_AUTO_SCALE="false"
-    # Experimental 1.17 Agent backend is intentionally not bundled in this compact HF layout.
-    export AGENT_BACKEND_BASE_URL="${AGENT_BACKEND_BASE_URL:-http://127.0.0.1:5050}"
     exec /bin/bash /entrypoint.sh
 ) &
+
 WORKER_PID=$!
+
 sleep 5
 
+# ============================================================
+# Web 1.17
+#
+# IMPORTANT:
+# 1.17 web image runtime lives in /app/targets, not /app/web.
+# Dockerfile copies it to /app/web/targets and copies the official
+# /app/entrypoint.sh to /app/web/entrypoint.sh.
+# Use Dify's official web entrypoint rather than assuming server.js
+# is directly at /app/web/server.js.
+# ============================================================
 echo ""
 echo "============================================================"
-echo "🌐 Starting Dify Web :3000"
+echo "🌐 Starting Dify Web 1.17 :3000"
 echo "============================================================"
-cd /app/web
-export NODE_ENV="production"
-export PORT="3000"
-export HOSTNAME="0.0.0.0"
-node server.js &
+
+(
+    cd /app/web
+
+    export NODE_ENV="production"
+    export PORT="3000"
+    export HOSTNAME="0.0.0.0"
+    export CONSOLE_API_URL="${PUBLIC_ORIGIN}"
+    export SERVER_CONSOLE_API_URL="http://127.0.0.1:5001"
+    export APP_API_URL="${PUBLIC_ORIGIN}"
+    export MARKETPLACE_API_URL="${MARKETPLACE_API_URL}"
+    export MARKETPLACE_URL="${MARKETPLACE_URL}"
+    export NEXT_PUBLIC_COOKIE_DOMAIN=""
+    export NEXT_TELEMETRY_DISABLED="${NEXT_TELEMETRY_DISABLED:-1}"
+    export EXPERIMENTAL_ENABLE_VINEXT="${EXPERIMENTAL_ENABLE_VINEXT:-false}"
+    export TEXT_GENERATION_TIMEOUT_MS="${TEXT_GENERATION_TIMEOUT_MS:-60000}"
+    export CSP_WHITELIST="${CSP_WHITELIST:-}"
+    export ALLOW_EMBED="${ALLOW_EMBED:-false}"
+    export ALLOW_UNSAFE_DATA_SCHEME="${ALLOW_UNSAFE_DATA_SCHEME:-false}"
+
+    exec /bin/sh /app/web/entrypoint.sh
+) &
+
 WEB_PID=$!
 
 WEB_READY=0
 for attempt in $(seq 1 120); do
-    if ! kill -0 "${WEB_PID}" 2>/dev/null; then echo "❌ Web stopped"; exit 1; fi
-    HTTP_CODE="$(curl --silent --output /dev/null --write-out "%{http_code}" --connect-timeout 2 --max-time 5 http://127.0.0.1:3000/signin || true)"
+    if ! kill -0 "${WEB_PID}" 2>/dev/null; then
+        echo "❌ Web stopped"
+        exit 1
+    fi
+
+    HTTP_CODE="$(
+        curl --silent --output /dev/null --write-out "%{http_code}" \
+            --connect-timeout 2 --max-time 5 \
+            http://127.0.0.1:3000/signin || true
+    )"
+
     case "${HTTP_CODE}" in
-        2*|3*|4*) WEB_READY=1; echo "✅ Web ready HTTP ${HTTP_CODE}"; break ;;
+        2*|3*|4*)
+            WEB_READY=1
+            echo "✅ Web ready HTTP ${HTTP_CODE}"
+            break
+            ;;
     esac
     sleep 1
 done
-if [ "${WEB_READY}" != "1" ]; then echo "❌ Web unavailable"; exit 1; fi
 
+if [ "${WEB_READY}" != "1" ]; then
+    echo "❌ Web unavailable"
+    exit 1
+fi
+
+# ============================================================
+# Nginx
+# ============================================================
 echo ""
 echo "============================================================"
 echo "🚦 Starting Nginx :7860"
 echo "============================================================"
-if ! nginx -t; then echo "❌ Nginx configuration invalid"; exit 1; fi
+
+if ! nginx -t; then
+    echo "❌ Nginx configuration invalid"
+    exit 1
+fi
+
 nginx
 sleep 2
 
+# ============================================================
+# Low-transfer State Keeper
+# ============================================================
 echo ""
 echo "============================================================"
 echo "💾 Starting Low-Transfer State Keeper"
 echo "============================================================"
-# No --force: avoid unnecessary large Neon transfers.
+
 python /app/hf_state_keeper.py sync-once || true
 python /app/hf_state_keeper.py watch &
 STATE_KEEPER_PID=$!
+
 sleep 1
-if kill -0 "${STATE_KEEPER_PID}" 2>/dev/null; then echo "✅ State Keeper running"; else echo "❌ State Keeper stopped"; exit 1; fi
+
+if kill -0 "${STATE_KEEPER_PID}" 2>/dev/null; then
+    echo "✅ State Keeper running"
+else
+    echo "❌ State Keeper stopped"
+    exit 1
+fi
 
 echo ""
 echo "============================================================"
@@ -444,31 +622,63 @@ echo "API:           READY"
 echo "Web:           READY"
 echo "Plugin Daemon: $([ "${PLUGIN_READY}" = "1" ] && echo READY || echo NOT_READY)"
 echo "State Keeper:  RUNNING"
-echo "Agent backend: NOT INCLUDED (same compact HF structure)"
 echo "============================================================"
+
 python /app/hf_state_keeper.py status || true
 
 cleanup() {
     echo ""
     echo "🛑 Stopping Dify..."
+
     python /app/hf_state_keeper.py sync-once || true
+
     nginx -s quit 2>/dev/null || true
+
     kill "${STATE_KEEPER_PID}" 2>/dev/null || true
     kill "${WEB_PID}" 2>/dev/null || true
     kill "${WORKER_PID}" 2>/dev/null || true
     kill "${PLUGIN_PID}" 2>/dev/null || true
     kill "${API_PID}" 2>/dev/null || true
-    if [ "${LOCAL_REDIS_ACTIVE}" = "1" ]; then redis-cli -h 127.0.0.1 -p 6379 shutdown nosave >/dev/null 2>&1 || true; fi
+
+    if [ "${LOCAL_REDIS_ACTIVE}" = "1" ]; then
+        redis-cli -h 127.0.0.1 -p 6379 shutdown nosave >/dev/null 2>&1 || true
+    fi
 }
+
 trap cleanup EXIT TERM INT
 
 PLUGIN_WARNING_SHOWN=0
 WORKER_WARNING_SHOWN=0
+
 while true; do
-    if ! kill -0 "${API_PID}" 2>/dev/null; then echo "❌ API stopped"; exit 1; fi
-    if ! kill -0 "${WEB_PID}" 2>/dev/null; then echo "❌ Web stopped"; exit 1; fi
-    if ! kill -0 "${STATE_KEEPER_PID}" 2>/dev/null; then echo "❌ State Keeper stopped"; exit 1; fi
-    if ! kill -0 "${PLUGIN_PID}" 2>/dev/null && [ "${PLUGIN_WARNING_SHOWN}" = "0" ]; then echo "⚠️ Plugin Daemon stopped"; PLUGIN_WARNING_SHOWN=1; fi
-    if ! kill -0 "${WORKER_PID}" 2>/dev/null && [ "${WORKER_WARNING_SHOWN}" = "0" ]; then echo "⚠️ Worker stopped"; WORKER_WARNING_SHOWN=1; fi
+    if ! kill -0 "${API_PID}" 2>/dev/null; then
+        echo "❌ API stopped"
+        exit 1
+    fi
+
+    if ! kill -0 "${WEB_PID}" 2>/dev/null; then
+        echo "❌ Web stopped"
+        exit 1
+    fi
+
+    if ! kill -0 "${STATE_KEEPER_PID}" 2>/dev/null; then
+        echo "❌ State Keeper stopped"
+        exit 1
+    fi
+
+    if ! kill -0 "${PLUGIN_PID}" 2>/dev/null; then
+        if [ "${PLUGIN_WARNING_SHOWN}" = "0" ]; then
+            echo "⚠️ Plugin Daemon stopped"
+            PLUGIN_WARNING_SHOWN=1
+        fi
+    fi
+
+    if ! kill -0 "${WORKER_PID}" 2>/dev/null; then
+        if [ "${WORKER_WARNING_SHOWN}" = "0" ]; then
+            echo "⚠️ Worker stopped"
+            WORKER_WARNING_SHOWN=1
+        fi
+    fi
+
     sleep 10
 done