Upload 4 files

Dockerfile

@@ -1,20 +1,14 @@
 # ============================================================
 # Dify 1.17.0 All-in-One for Hugging Face Spaces
 #
-# Keeps the previous compact HF layout:
-#   - Dify API 1.17.0
-#   - Dify Web 1.17.0
-#   - Dify Plugin Daemon 0.6.10-local
-#   - Celery worker
-#   - Nginx :7860
-#   - Neon PostgreSQL
-#   - Upstash Redis
-#   - Low-transfer HF State Keeper
-#
-# FIX:
-# Dify Web 1.17.0 image no longer stores the runtime at /app/web.
-# Its production image stores the Next/Vinext runtimes under /app/targets
-# and its launcher at /app/entrypoint.sh.
+# FIX 2:
+# - Keep Dify Web 1.17 runtime at its ORIGINAL absolute paths:
+#       /app/targets
+#       /app/entrypoint.sh
+#   because the official web entrypoint calls
+#       /app/targets/next/web/server.js
+# - Add ca-certificates for verified Upstash Redis TLS.
+# - Keep API/Web/Worker/Plugin/Nginx in one HF container.
 # ============================================================
 
 FROM langgenius/dify-web:1.17.0 AS web
@@ -28,6 +22,7 @@ RUN apt-get update \
         nginx \
         redis-server \
         redis-tools \
+        ca-certificates \
         locales \
         curl \
         ffmpeg \
@@ -38,6 +33,7 @@ RUN apt-get update \
         libcairo2-dev \
         libjpeg62-turbo-dev \
         libgif-dev \
+    && update-ca-certificates \
     && rm -rf /var/lib/apt/lists/* \
     && localedef \
         -i en_US \
@@ -52,26 +48,32 @@ ENV LANG=en_US.UTF-8 \
     MALLOC_ARENA_MAX=2 \
     NODE_OPTIONS=--max-old-space-size=2048
 
-# Dify Web 1.17 production image layout:
-#   /app/targets/next
-#   /app/targets/vinext
-#   /app/entrypoint.sh
-COPY --from=web /app/targets /app/web/targets
-COPY --from=web /app/entrypoint.sh /app/web/entrypoint.sh
-
+# ------------------------------------------------------------
+# Dify Web 1.17 official runtime layout.
+#
+# IMPORTANT:
+# Do not relocate these into /app/web.
+# /app/entrypoint.sh contains absolute /app/targets/... paths.
+# ------------------------------------------------------------
+COPY --from=web /app/targets /app/targets
+COPY --from=web /app/entrypoint.sh /app/entrypoint.sh
+
+# Plugin daemon binary.
 COPY --from=plugin_daemon /app/main /opt/dify-plugin-daemon/main
 
 COPY nginx.conf /etc/nginx/nginx.conf
 COPY start.sh /app/start.sh
 COPY hf_state_keeper.py /app/hf_state_keeper.py
 
-ARG FORCE_REBUILD=20260908_DIFY_1170_HF_WEBPATH_FIX1
+ARG FORCE_REBUILD=20260908_DIFY_1170_HF_FIX2
 RUN echo "${FORCE_REBUILD}" > /tmp/dify-build-version
 
+# Writable uv cache for local plugins.
 RUN install -d -o dify -g dify -m 0755 /home/dify \
     && install -d -o dify -g dify -m 0755 /home/dify/.cache \
     && install -d -o dify -g dify -m 0755 /home/dify/.cache/uv
 
+# Runtime storage.
 RUN mkdir -p \
         /app/api/storage \
         /app/api/storage/privkeys \
@@ -81,7 +83,6 @@ RUN mkdir -p \
         /app/storage/plugin_packages \
         /app/storage/assets \
         /app/.tiktoken \
-        /app/web \
         /var/log/nginx \
         /var/lib/nginx \
         /var/lib/nginx/body \
@@ -95,13 +96,14 @@ RUN mkdir -p \
 RUN chmod +x \
         /app/start.sh \
         /app/hf_state_keeper.py \
-        /app/web/entrypoint.sh \
+        /app/entrypoint.sh \
         /opt/dify-plugin-daemon/main \
     && chown -R dify:dify \
         /home/dify \
         /app/api/storage \
         /app/storage \
-        /app/web \
+        /app/targets \
+        /app/entrypoint.sh \
         /opt/dify-plugin-daemon \
         /var/log/nginx \
         /var/lib/nginx \
@@ -109,15 +111,17 @@ RUN chmod +x \
         /run \
         /etc/nginx
 
-RUN su -s /bin/bash dify -c '\
-    test -w /home/dify/.cache/uv && \
-    touch /home/dify/.cache/uv/.write-test && \
-    rm -f /home/dify/.cache/uv/.write-test && \
-    /usr/local/bin/uv --version && \
-    node --version && \
-    test -f /app/web/entrypoint.sh && \
-    test -d /app/web/targets/next && \
-    echo "DIFY 1.17 WEB RUNTIME TEST = OK" \
+# Fail the Docker build immediately if the 1.17 web runtime was copied wrong.
+RUN test -f /app/entrypoint.sh \
+    && test -f /app/targets/next/web/server.js \
+    && test -f /etc/ssl/certs/ca-certificates.crt \
+    && su -s /bin/bash dify -c '\
+        test -w /home/dify/.cache/uv && \
+        touch /home/dify/.cache/uv/.write-test && \
+        rm -f /home/dify/.cache/uv/.write-test && \
+        /usr/local/bin/uv --version && \
+        node --version && \
+        echo "DIFY 1.17 HF FIX2 BUILD TEST = OK" \
     '
 
 ENV PORT=7860 \

README-FIX2.txt

@@ -0,0 +1,32 @@
+Dify 1.17.0 HF FIX 2
+
+What this fixes
+---------------
+1) Web runtime
+   Official Dify 1.17 web entrypoint uses absolute paths under /app/targets.
+   This package keeps /app/targets and /app/entrypoint.sh exactly there.
+
+2) Plugin database
+   start.sh checks for DB_PLUGIN_DATABASE (default dify_plugin) and creates it
+   automatically on Neon when the current DB user has permission.
+
+3) Redis TLS
+   If REDIS_SSL_CERT_REQS=CERT_REQUIRED and REDIS_SSL_CA_CERTS is unset,
+   start.sh uses:
+       /etc/ssl/certs/ca-certificates.crt
+   No new HF Secret is required.
+
+Files to replace
+----------------
+- Dockerfile
+- start.sh
+
+Keep unchanged
+--------------
+- nginx.conf
+- hf_state_keeper.py (low-transfer version)
+- existing HF DB/Redis Secrets
+- REDIS_DB=0
+
+No need to drop neondb again:
+the fresh Dify 1.17 migration already completed successfully in the latest log.

start.sh

@@ -1,14 +1,22 @@
 #!/bin/bash
 # ============================================================
 # Dify 1.17.0 All-in-One for Hugging Face Spaces
-# Fresh Neon + Upstash Redis + Low-Transfer State Keeper
+# FIX 2
+#
+# Fixes:
+#   1. Web 1.17 runs with official /app/entrypoint.sh and /app/targets.
+#   2. Creates dify_plugin automatically if the fresh Neon project
+#      does not already have it.
+#   3. When Redis TLS uses CERT_REQUIRED, provides the system CA bundle
+#      required by Plugin Daemon 0.6.10.
+#   4. Keeps the Low-Transfer State Keeper.
 # ============================================================
 
 set -E -o pipefail
 
 echo ""
 echo "============================================================"
-echo "🚀 Dify 1.17.0 - HF All-in-One + Low-Transfer State Keeper"
+echo "🚀 Dify 1.17.0 - HF All-in-One FIX 2"
 echo "============================================================"
 
 HF_HOST="${SPACE_HOST:-pommsn-dify.hf.space}"
@@ -19,7 +27,7 @@ echo "🌍 HF_HOST       = ${HF_HOST}"
 echo "🌍 PUBLIC_ORIGIN = ${PUBLIC_ORIGIN}"
 
 # ============================================================
-# Core runtime
+# 1. Core runtime
 # ============================================================
 export LANG="${LANG:-en_US.UTF-8}"
 export LC_ALL="${LC_ALL:-en_US.UTF-8}"
@@ -35,7 +43,7 @@ export DIFY_BIND_ADDRESS="127.0.0.1"
 export DIFY_PORT="5001"
 
 # ============================================================
-# Storage
+# 2. Storage
 # ============================================================
 export STORAGE_TYPE="local"
 export STORAGE_LOCAL_PATH="/app/api/storage"
@@ -57,7 +65,7 @@ mkdir -p \
     "${PLUGIN_STORAGE_LOCAL_ROOT}/${PLUGIN_MEDIA_CACHE_PATH}"
 
 # ============================================================
-# Public URLs
+# 3. URLs
 # ============================================================
 export CONSOLE_API_URL="${PUBLIC_ORIGIN}"
 export CONSOLE_WEB_URL="${PUBLIC_ORIGIN}"
@@ -76,7 +84,7 @@ export COOKIE_DOMAIN=""
 export NEXT_PUBLIC_COOKIE_DOMAIN=""
 
 # ============================================================
-# Web runtime environment
+# 4. Web
 # ============================================================
 export NEXT_PUBLIC_DEPLOY_ENV="${DEPLOY_ENV}"
 export NEXT_PUBLIC_EDITION="${EDITION}"
@@ -87,13 +95,14 @@ export MARKETPLACE_URL="${MARKETPLACE_URL:-https://marketplace.dify.ai}"
 
 export NEXT_TELEMETRY_DISABLED="${NEXT_TELEMETRY_DISABLED:-1}"
 export EXPERIMENTAL_ENABLE_VINEXT="${EXPERIMENTAL_ENABLE_VINEXT:-false}"
+
 export TEXT_GENERATION_TIMEOUT_MS="${TEXT_GENERATION_TIMEOUT_MS:-60000}"
 export CSP_WHITELIST="${CSP_WHITELIST:-}"
 export ALLOW_EMBED="${ALLOW_EMBED:-false}"
 export ALLOW_UNSAFE_DATA_SCHEME="${ALLOW_UNSAFE_DATA_SCHEME:-false}"
 
 # ============================================================
-# Plugin Daemon
+# 5. Plugin Daemon
 # ============================================================
 export DB_PLUGIN_DATABASE="${DB_PLUGIN_DATABASE:-dify_plugin}"
 
@@ -116,7 +125,9 @@ export MARKETPLACE_ENABLED="${MARKETPLACE_ENABLED:-true}"
 if [ -z "${PLUGIN_DAEMON_KEY:-}" ]; then
     export PLUGIN_DAEMON_KEY="$(
         python - <<'PY'
-import hashlib, os
+import hashlib
+import os
+
 secret = os.environ.get("SECRET_KEY", "dify")
 print(hashlib.sha256(("plugin-daemon:" + secret).encode()).hexdigest())
 PY
@@ -126,7 +137,9 @@ fi
 if [ -z "${PLUGIN_DIFY_INNER_API_KEY:-}" ]; then
     export PLUGIN_DIFY_INNER_API_KEY="$(
         python - <<'PY'
-import hashlib, os
+import hashlib
+import os
+
 secret = os.environ.get("SECRET_KEY", "dify")
 print(hashlib.sha256(("plugin-inner-api:" + secret).encode()).hexdigest())
 PY
@@ -136,7 +149,7 @@ fi
 export INNER_API_KEY_FOR_PLUGIN="${PLUGIN_DIFY_INNER_API_KEY}"
 
 # ============================================================
-# Validate settings
+# 6. Validate required settings
 # ============================================================
 if [ -z "${SECRET_KEY:-}" ]; then
     echo "❌ SECRET_KEY is missing"
@@ -165,7 +178,7 @@ echo "PLUGIN_STORAGE      = ${PLUGIN_STORAGE_LOCAL_ROOT}"
 echo "-----------------------------------------"
 
 # ============================================================
-# State Keeper restore
+# 7. State Keeper restore
 # ============================================================
 echo ""
 echo "============================================================"
@@ -187,20 +200,39 @@ else
 fi
 
 # ============================================================
-# Redis
+# 8. Redis
 # ============================================================
 LOCAL_REDIS_ACTIVE=0
 REDIS_MODE="UNKNOWN"
 
+# Plugin Daemon 0.6.10 requires an explicit CA bundle when
+# REDIS_SSL_CERT_REQS=CERT_REQUIRED.
+if [ "${REDIS_USE_SSL:-false}" = "true" ] || \
+   [ "${REDIS_USE_SSL:-false}" = "TRUE" ] || \
+   [ "${REDIS_USE_SSL:-false}" = "1" ]; then
+
+    if [ "${REDIS_SSL_CERT_REQS:-}" = "CERT_REQUIRED" ] && \
+       [ -z "${REDIS_SSL_CA_CERTS:-}" ]; then
+
+        export REDIS_SSL_CA_CERTS="/etc/ssl/certs/ca-certificates.crt"
+        echo "🔐 Redis CA bundle = ${REDIS_SSL_CA_CERTS}"
+    fi
+fi
+
 test_redis_connection() {
 python - <<'PY'
-import os, ssl, sys, redis
+import os
+import ssl
+import sys
+import redis
 
 host = os.environ.get("REDIS_HOST", "")
 port = int(os.environ.get("REDIS_PORT", "6379"))
 username = os.environ.get("REDIS_USERNAME", "") or None
 password = os.environ.get("REDIS_PASSWORD", "") or None
-use_ssl = os.environ.get("REDIS_USE_SSL", "false").strip().lower() in ("true","1","yes","on")
+use_ssl = os.environ.get("REDIS_USE_SSL", "false").strip().lower() in (
+    "true", "1", "yes", "on"
+)
 
 if not host:
     sys.exit(1)
@@ -217,21 +249,44 @@ kwargs = {
 
 if use_ssl:
     kwargs["ssl"] = True
-    cert_value = os.environ.get("REDIS_SSL_CERT_REQS", "CERT_NONE").upper()
+
+    cert_value = os.environ.get(
+        "REDIS_SSL_CERT_REQS",
+        "CERT_NONE"
+    ).upper()
+
     cert_map = {
         "CERT_NONE": ssl.CERT_NONE,
         "CERT_OPTIONAL": ssl.CERT_OPTIONAL,
         "CERT_REQUIRED": ssl.CERT_REQUIRED,
     }
-    kwargs["ssl_cert_reqs"] = cert_map.get(cert_value, ssl.CERT_NONE)
+
+    kwargs["ssl_cert_reqs"] = cert_map.get(
+        cert_value,
+        ssl.CERT_NONE
+    )
+
+    ca_certs = os.environ.get("REDIS_SSL_CA_CERTS", "")
+    if ca_certs:
+        kwargs["ssl_ca_certs"] = ca_certs
 
 try:
     client = redis.Redis(**kwargs)
     client.ping()
-    print(f"✅ Redis PING OK: {host}:{port} ssl={use_ssl}")
+
+    print(
+        f"✅ Redis PING OK: "
+        f"{host}:{port} ssl={use_ssl}"
+    )
+
     sys.exit(0)
+
 except Exception as exc:
-    print(f"❌ Redis connection failed: {type(exc).__name__}: {exc}")
+    print(
+        f"❌ Redis connection failed: "
+        f"{type(exc).__name__}: {exc}"
+    )
+
     sys.exit(1)
 PY
 }
@@ -244,20 +299,29 @@ echo "============================================================"
 EXTERNAL_REDIS_OK=0
 
 if [ -n "${REDIS_HOST:-}" ]; then
-    for attempt in 1 2 3 4 5; do
+
+    for attempt in 1 2 3 4 5
+    do
         echo "Redis attempt ${attempt}/5"
+
         if test_redis_connection; then
             EXTERNAL_REDIS_OK=1
             break
         fi
+
         sleep 3
     done
+
 fi
 
 if [ "${EXTERNAL_REDIS_OK}" = "1" ]; then
+
     REDIS_MODE="EXTERNAL"
     echo "✅ Using external Redis"
+
 else
+
+    echo ""
     echo "⚠️ External Redis unavailable"
     echo "⚠️ Starting local Redis fallback"
 
@@ -278,13 +342,16 @@ else
     export REDIS_PASSWORD=""
     export REDIS_USE_SSL="false"
     export REDIS_SSL_CERT_REQS="CERT_NONE"
+    export REDIS_SSL_CA_CERTS=""
     export REDIS_DB="0"
     export REDIS_USE_SENTINEL="false"
     export REDIS_USE_CLUSTERS="false"
 
     REDIS_MODE="LOCAL_FALLBACK"
     LOCAL_REDIS_ACTIVE=1
+
     sleep 2
+
 fi
 
 if ! test_redis_connection; then
@@ -295,7 +362,7 @@ fi
 echo "✅ Redis mode = ${REDIS_MODE}"
 
 # ============================================================
-# Celery broker
+# 9. Celery broker
 # ============================================================
 export CELERY_BROKER_URL="$(
 python - <<'PY'
@@ -307,34 +374,60 @@ port = os.environ.get("REDIS_PORT", "6379")
 username = os.environ.get("REDIS_USERNAME", "")
 password = os.environ.get("REDIS_PASSWORD", "")
 redis_db = os.environ.get("REDIS_DB", "0")
-ssl_enabled = os.environ.get("REDIS_USE_SSL", "false").lower() in ("true","1","yes","on")
-cert_reqs = os.environ.get("REDIS_SSL_CERT_REQS", "CERT_NONE").upper()
+
+ssl_enabled = os.environ.get(
+    "REDIS_USE_SSL",
+    "false"
+).lower() in ("true", "1", "yes", "on")
+
+cert_reqs = os.environ.get(
+    "REDIS_SSL_CERT_REQS",
+    "CERT_NONE"
+).upper()
 
 scheme = "rediss" if ssl_enabled else "redis"
 
 if username:
-    auth = quote(username, safe="") + ":" + quote(password, safe="") + "@"
+    auth = (
+        quote(username, safe="")
+        + ":"
+        + quote(password, safe="")
+        + "@"
+    )
 elif password:
     auth = ":" + quote(password, safe="") + "@"
 else:
     auth = ""
 
-query = f"?ssl_cert_reqs={cert_reqs}" if ssl_enabled else ""
-print(f"{scheme}://{auth}{host}:{port}/{redis_db}{query}")
+query = (
+    f"?ssl_cert_reqs={cert_reqs}"
+    if ssl_enabled
+    else ""
+)
+
+print(
+    f"{scheme}://{auth}"
+    f"{host}:{port}/{redis_db}{query}"
+)
 PY
 )"
 
 export CELERY_BACKEND="redis"
 
 # ============================================================
-# Main DB migration
+# 10. Main DB migration
 # ============================================================
 cd /app/api
 
-MIGRATION_VALUE="$(echo "${MIGRATION_ENABLED:-true}" | tr '[:upper:]' '[:lower:]')"
+MIGRATION_VALUE="$(
+    echo "${MIGRATION_ENABLED:-true}" |
+    tr '[:upper:]' '[:lower:]'
+)"
 
 case "${MIGRATION_VALUE}" in
+
     true|1|yes|on)
+
         echo ""
         echo "============================================================"
         echo "🗄️ Running Dify 1.17 DB Migration"
@@ -347,19 +440,129 @@ case "${MIGRATION_VALUE}" in
             exit 1
         fi
         ;;
+
     *)
+
         echo "ℹ️ Migration disabled"
         ;;
+
 esac
 
+# ============================================================
+# 11. Ensure plugin database exists
+#
+# This makes a fresh Neon project easier to deploy. If dify_plugin
+# already exists, no change is made.
+# ============================================================
+echo ""
+echo "============================================================"
+echo "🧩 Checking Neon plugin database"
+echo "============================================================"
+
+if python - <<'PY'
+import os
+import sys
+
+import psycopg2
+from psycopg2 import sql
+
+host = os.environ["DB_HOST"]
+port = int(os.environ.get("DB_PORT", "5432"))
+user = os.environ["DB_USERNAME"]
+password = os.environ["DB_PASSWORD"]
+main_db = os.environ.get("DB_DATABASE", "neondb")
+plugin_db = os.environ.get(
+    "DB_PLUGIN_DATABASE",
+    "dify_plugin"
+)
+sslmode = os.environ.get(
+    "DB_SSL_MODE",
+    "require"
+)
+
+try:
+    conn = psycopg2.connect(
+        host=host,
+        port=port,
+        user=user,
+        password=password,
+        dbname=main_db,
+        sslmode=sslmode,
+        connect_timeout=15,
+    )
+
+    conn.autocommit = True
+
+    with conn.cursor() as cur:
+
+        cur.execute(
+            "SELECT 1 "
+            "FROM pg_database "
+            "WHERE datname = %s",
+            (plugin_db,),
+        )
+
+        exists = cur.fetchone() is not None
+
+        if exists:
+            print(
+                f"✅ Plugin database exists: "
+                f"{plugin_db}"
+            )
+        else:
+            print(
+                f"ℹ️ Creating plugin database: "
+                f"{plugin_db}"
+            )
+
+            cur.execute(
+                sql.SQL(
+                    "CREATE DATABASE {}"
+                ).format(
+                    sql.Identifier(plugin_db)
+                )
+            )
+
+            print(
+                f"✅ Plugin database created: "
+                f"{plugin_db}"
+            )
+
+    conn.close()
+    sys.exit(0)
+
+except Exception as exc:
+    print(
+        "❌ Plugin database check/create failed: "
+        f"{type(exc).__name__}: {exc}"
+    )
+
+    sys.exit(1)
+PY
+then
+    echo "✅ Plugin database ready"
+else
+    echo "❌ Plugin database is not ready"
+    echo "❌ Create database '${DB_PLUGIN_DATABASE}' in Neon manually"
+    exit 1
+fi
+
+# ============================================================
+# 12. Fresh-install RSA status
+# ============================================================
 if python /app/hf_state_keeper.py has-private-key; then
+
     echo "✅ Tenant RSA private key already present/restored"
+
 else
+
     echo "ℹ️ No tenant private.pem yet - normal for fresh Dify setup"
+    echo "ℹ️ State Keeper will back it up after Dify creates it"
+
 fi
 
 # ============================================================
-# Start API
+# 13. Start API
 # ============================================================
 echo ""
 echo "============================================================"
@@ -382,16 +585,24 @@ gunicorn \
 API_PID=$!
 
 API_READY=0
-for attempt in $(seq 1 120); do
+
+for attempt in $(seq 1 120)
+do
+
     if ! kill -0 "${API_PID}" 2>/dev/null; then
         echo "❌ API stopped"
         exit 1
     fi
 
     HTTP_CODE="$(
-        curl --silent --output /dev/null --write-out "%{http_code}" \
-            --connect-timeout 2 --max-time 5 \
-            http://127.0.0.1:5001/console/api/setup || true
+        curl \
+            --silent \
+            --output /dev/null \
+            --write-out "%{http_code}" \
+            --connect-timeout 2 \
+            --max-time 5 \
+            http://127.0.0.1:5001/console/api/setup \
+            || true
     )"
 
     case "${HTTP_CODE}" in
@@ -401,7 +612,9 @@ for attempt in $(seq 1 120); do
             break
             ;;
     esac
+
     sleep 1
+
 done
 
 if [ "${API_READY}" != "1" ]; then
@@ -410,7 +623,7 @@ if [ "${API_READY}" != "1" ]; then
 fi
 
 # ============================================================
-# Plugin Daemon
+# 14. Start Plugin Daemon
 # ============================================================
 echo ""
 echo "============================================================"
@@ -419,6 +632,7 @@ echo "============================================================"
 
 (
     export DB_DATABASE="${DB_PLUGIN_DATABASE}"
+
     export SERVER_PORT="${PLUGIN_DAEMON_PORT}"
     export SERVER_KEY="${PLUGIN_DAEMON_KEY}"
     export MAX_PLUGIN_PACKAGE_SIZE="${PLUGIN_MAX_PACKAGE_SIZE}"
@@ -448,26 +662,34 @@ echo "============================================================"
 
     export UV_PATH="/usr/local/bin/uv"
     export PYTHON_INTERPRETER_PATH="/usr/local/bin/python3.12"
+
     export PLATFORM="local"
     export GIN_MODE="release"
     export TIKTOKEN_CACHE_DIR="/app/.tiktoken"
 
     exec /opt/dify-plugin-daemon/main
+
 ) &
 
 PLUGIN_PID=$!
 
 PLUGIN_READY=0
-for attempt in $(seq 1 120); do
+
+for attempt in $(seq 1 120)
+do
+
     if ! kill -0 "${PLUGIN_PID}" 2>/dev/null; then
         echo "❌ Plugin Daemon stopped"
         break
     fi
 
     if python - <<'PY'
-import socket, sys
+import socket
+import sys
+
 sock = socket.socket()
 sock.settimeout(1)
+
 try:
     sock.connect(("127.0.0.1", 5002))
     sock.close()
@@ -476,12 +698,15 @@ except Exception:
     sys.exit(1)
 PY
     then
+
         PLUGIN_READY=1
         echo "✅ Plugin Daemon ready"
         break
+
     fi
 
     sleep 1
+
 done
 
 if [ "${PLUGIN_READY}" != "1" ]; then
@@ -489,7 +714,7 @@ if [ "${PLUGIN_READY}" != "1" ]; then
 fi
 
 # ============================================================
-# Celery worker
+# 15. Celery Worker
 # ============================================================
 echo ""
 echo "============================================================"
@@ -501,7 +726,9 @@ echo "============================================================"
     export MIGRATION_ENABLED="false"
     export CELERY_WORKER_AMOUNT="${CELERY_WORKER_AMOUNT:-1}"
     export CELERY_AUTO_SCALE="false"
+
     exec /bin/bash /entrypoint.sh
+
 ) &
 
 WORKER_PID=$!
@@ -509,14 +736,13 @@ WORKER_PID=$!
 sleep 5
 
 # ============================================================
-# Web 1.17
+# 16. Dify Web 1.17
+#
+# Official web entrypoint has absolute paths:
+#   /app/targets/next/web/server.js
+#   /app/targets/vinext/server.js
 #
-# IMPORTANT:
-# 1.17 web image runtime lives in /app/targets, not /app/web.
-# Dockerfile copies it to /app/web/targets and copies the official
-# /app/entrypoint.sh to /app/web/entrypoint.sh.
-# Use Dify's official web entrypoint rather than assuming server.js
-# is directly at /app/web/server.js.
+# Therefore Dockerfile keeps the runtime at /app/targets.
 # ============================================================
 echo ""
 echo "============================================================"
@@ -524,50 +750,67 @@ echo "🌐 Starting Dify Web 1.17 :3000"
 echo "============================================================"
 
 (
-    cd /app/web
+    cd /app
 
     export NODE_ENV="production"
     export PORT="3000"
     export HOSTNAME="0.0.0.0"
+
     export CONSOLE_API_URL="${PUBLIC_ORIGIN}"
     export SERVER_CONSOLE_API_URL="http://127.0.0.1:5001"
     export APP_API_URL="${PUBLIC_ORIGIN}"
+
     export MARKETPLACE_API_URL="${MARKETPLACE_API_URL}"
     export MARKETPLACE_URL="${MARKETPLACE_URL}"
+
     export NEXT_PUBLIC_COOKIE_DOMAIN=""
     export NEXT_TELEMETRY_DISABLED="${NEXT_TELEMETRY_DISABLED:-1}"
     export EXPERIMENTAL_ENABLE_VINEXT="${EXPERIMENTAL_ENABLE_VINEXT:-false}"
+
     export TEXT_GENERATION_TIMEOUT_MS="${TEXT_GENERATION_TIMEOUT_MS:-60000}"
     export CSP_WHITELIST="${CSP_WHITELIST:-}"
     export ALLOW_EMBED="${ALLOW_EMBED:-false}"
     export ALLOW_UNSAFE_DATA_SCHEME="${ALLOW_UNSAFE_DATA_SCHEME:-false}"
 
-    exec /bin/sh /app/web/entrypoint.sh
+    exec /bin/sh /app/entrypoint.sh
+
 ) &
 
 WEB_PID=$!
 
 WEB_READY=0
-for attempt in $(seq 1 120); do
+
+for attempt in $(seq 1 120)
+do
+
     if ! kill -0 "${WEB_PID}" 2>/dev/null; then
         echo "❌ Web stopped"
         exit 1
     fi
 
     HTTP_CODE="$(
-        curl --silent --output /dev/null --write-out "%{http_code}" \
-            --connect-timeout 2 --max-time 5 \
-            http://127.0.0.1:3000/signin || true
+        curl \
+            --silent \
+            --output /dev/null \
+            --write-out "%{http_code}" \
+            --connect-timeout 2 \
+            --max-time 5 \
+            http://127.0.0.1:3000/signin \
+            || true
     )"
 
     case "${HTTP_CODE}" in
+
         2*|3*|4*)
             WEB_READY=1
             echo "✅ Web ready HTTP ${HTTP_CODE}"
             break
             ;;
+
     esac
+
     sleep 1
+
 done
 
 if [ "${WEB_READY}" != "1" ]; then
@@ -576,7 +819,7 @@ if [ "${WEB_READY}" != "1" ]; then
 fi
 
 # ============================================================
-# Nginx
+# 17. Nginx
 # ============================================================
 echo ""
 echo "============================================================"
@@ -589,10 +832,14 @@ if ! nginx -t; then
 fi
 
 nginx
+
 sleep 2
 
 # ============================================================
-# Low-transfer State Keeper
+# 18. Low-Transfer State Keeper
+#
+# No --force here. This prevents a ~large plugin snapshot upload
+# on every ordinary startup/shutdown.
 # ============================================================
 echo ""
 echo "============================================================"
@@ -600,6 +847,7 @@ echo "💾 Starting Low-Transfer State Keeper"
 echo "============================================================"
 
 python /app/hf_state_keeper.py sync-once || true
+
 python /app/hf_state_keeper.py watch &
 STATE_KEEPER_PID=$!
 
@@ -612,24 +860,40 @@ else
     exit 1
 fi
 
+# ============================================================
+# 19. Summary
+# ============================================================
 echo ""
 echo "============================================================"
 echo "✅ DIFY 1.17.0 STARTUP COMPLETE"
 echo "============================================================"
+
 echo "Public:        ${PUBLIC_ORIGIN}"
 echo "Redis:         ${REDIS_MODE}"
 echo "API:           READY"
 echo "Web:           READY"
-echo "Plugin Daemon: $([ "${PLUGIN_READY}" = "1" ] && echo READY || echo NOT_READY)"
+
+if [ "${PLUGIN_READY}" = "1" ]; then
+    echo "Plugin Daemon: READY"
+else
+    echo "Plugin Daemon: NOT READY"
+fi
+
 echo "State Keeper:  RUNNING"
+
 echo "============================================================"
 
 python /app/hf_state_keeper.py status || true
 
+# ============================================================
+# 20. Cleanup
+# ============================================================
 cleanup() {
+
     echo ""
     echo "🛑 Stopping Dify..."
 
+    # Best effort; intentionally no --force.
     python /app/hf_state_keeper.py sync-once || true
 
     nginx -s quit 2>/dev/null || true
@@ -641,16 +905,29 @@ cleanup() {
     kill "${API_PID}" 2>/dev/null || true
 
     if [ "${LOCAL_REDIS_ACTIVE}" = "1" ]; then
-        redis-cli -h 127.0.0.1 -p 6379 shutdown nosave >/dev/null 2>&1 || true
+
+        redis-cli \
+            -h 127.0.0.1 \
+            -p 6379 \
+            shutdown \
+            nosave \
+            >/dev/null 2>&1 || true
+
     fi
+
 }
 
 trap cleanup EXIT TERM INT
 
+# ============================================================
+# 21. Keep Space alive
+# ============================================================
 PLUGIN_WARNING_SHOWN=0
 WORKER_WARNING_SHOWN=0
 
-while true; do
+while true
+do
+
     if ! kill -0 "${API_PID}" 2>/dev/null; then
         echo "❌ API stopped"
         exit 1
@@ -667,18 +944,23 @@ while true; do
     fi
 
     if ! kill -0 "${PLUGIN_PID}" 2>/dev/null; then
+
         if [ "${PLUGIN_WARNING_SHOWN}" = "0" ]; then
             echo "⚠️ Plugin Daemon stopped"
             PLUGIN_WARNING_SHOWN=1
         fi
+
     fi
 
     if ! kill -0 "${WORKER_PID}" 2>/dev/null; then
+
         if [ "${WORKER_WARNING_SHOWN}" = "0" ]; then
             echo "⚠️ Worker stopped"
             WORKER_WARNING_SHOWN=1
         fi
+
     fi
 
     sleep 10
+
 done