Update entrypoint.sh

entrypoint.sh

@@ -1,245 +1,59 @@
 #!/bin/sh
-# OpenClaw HF Spaces - Production Entrypoint
+# OpenClaw on HF Spaces - 实时状态在本地磁盘, /data 仅只读导入旧配置/工作区
 umask 022
 
-# ── Force IPv4 for Telegram (IPv6 route broken on HF nodes) ──
-sysctl -w net.ipv6.conf.all.disable_ipv6=1 2>/dev/null || true
-sysctl -w net.ipv6.conf.default.disable_ipv6=1 2>/dev/null || true
-export NODE_OPTIONS="--dns-result-order=ipv4first ${NODE_OPTIONS:-}"
-{
-  echo "149.154.167.51  api.telegram.org"
-  echo "149.154.167.220 api.telegram.org"
-  echo "91.108.56.130   api.telegram.org"
-} >> /etc/hosts 2>/dev/null || true
-echo "[entrypoint] IPv6 disabled, IPv4 forced for Telegram"
-
-# ----------------------------------------------------------------
-# Logging
-# ----------------------------------------------------------------
-ts() { date -u +"%H:%M:%S"; }
+ts()   { date -u +"%H:%M:%S"; }
 log()  { echo "[$(ts)] [entrypoint] $*"; }
 warn() { echo "[$(ts)] [entrypoint] WARN: $*"; }
 
-# ----------------------------------------------------------------
-# Storage: resolve OPENCLAW_HOME
-# ----------------------------------------------------------------
 OPENCLAW_HOME=/home/user
-mkdir -p /home/user/.openclaw
-
-RETRIES=5
-i=0
-USE_LOCAL_STATE="${USE_LOCAL_STATE:-1}"
-while [ "$USE_LOCAL_STATE" != "1" ] && [ $i -lt $RETRIES ]; do
-  if [ -d /data ] && touch /data/.write-test 2>/dev/null; then
-    rm -f /data/.write-test
-    OPENCLAW_HOME=/data
-    mkdir -p /data/.openclaw
-    log "Storage bucket /data is writable - using persistent storage"
-    break
-  fi
-  i=$((i+1))
-  if [ $i -lt $RETRIES ]; then
-    log "Waiting for /data mount... ($i/$RETRIES)"
-    sleep 1
-  fi
-done
-
-if [ "$USE_LOCAL_STATE" = "1" ]; then
-  log "USE_LOCAL_STATE=1 - live state on local disk (/home/user); /data is left untouched"
-elif [ "$OPENCLAW_HOME" = "/home/user" ]; then
-  warn "/data not writable after ${RETRIES}s - using ephemeral /home/user"
-fi
-
+mkdir -p "$OPENCLAW_HOME/.openclaw"
 export OPENCLAW_HOME
-log "OPENCLAW_HOME=$OPENCLAW_HOME"
+log "OPENCLAW_HOME=$OPENCLAW_HOME (live state on local disk)"
 
-# ----------------------------------------------------------------
-# Export provider API keys from Secrets
-# ----------------------------------------------------------------
+# ── 从 Secrets 导出各家 Key ──
 for VAR in $(env | cut -d= -f1); do
-  case "$VAR" in
-    OPENCLAW_*|SPACE_*|SYSTEM_*|HF_*|NODE_*|npm_*) continue ;;
-  esac
+  case "$VAR" in OPENCLAW_*|SPACE_*|SYSTEM_*|HF_*|NODE_*|npm_*) continue ;; esac
   case "$VAR" in
     *_API_KEY|*_SECRET_KEY|*_ACCESS_TOKEN|*_BOT_TOKEN|*_AUTH_TOKEN|*_APP_KEY)
-      VAL=$(printenv "$VAR" 2>/dev/null || true)
-      if [ -n "$VAL" ]; then
-        export "$VAR"
-        log "exported: $VAR"
-      fi
-      ;;
+      [ -n "$(printenv "$VAR" 2>/dev/null)" ] && { export "$VAR"; log "exported: $VAR"; } ;;
   esac
 done
 
-export HF_TOKEN="${HF_TOKEN:-}"
-
-# ----------------------------------------------------------------
-# One-time setup
-# ----------------------------------------------------------------
+# ── 生成配置 + 安全检查 ──
 log "Running setup..."
-node /app/spaces/huggingface/setup-hf-config.mjs || true
-log "Setup done."
-
-if [ -f /app/security-check.sh ]; then
-  sh /app/security-check.sh || true
-fi
-
-# ----------------------------------------------------------------
-# Helpers
-# ----------------------------------------------------------------
-STATE_DB="$OPENCLAW_HOME/.openclaw/state/openclaw.sqlite"
-
-check_db() {
-  DBPATH="$1" node - <<'JSEOF'
-const { DatabaseSync } = require('node:sqlite');
-try {
-  const db = new DatabaseSync(process.env.DBPATH, { readOnly: true });
-  const row = db.prepare('PRAGMA integrity_check').get();
-  db.close();
-  process.exit(Object.values(row)[0] === 'ok' ? 0 : 1);
-} catch (e) {
-  console.error('[db-check] ' + e.message);
-  process.exit(1);
-}
-JSEOF
-}
-
-dump_owner() {
-  DBPATH="$1" node - <<'JSEOF'
-const { DatabaseSync } = require('node:sqlite');
-try {
-  const db = new DatabaseSync(process.env.DBPATH, { readOnly: true });
-  const tables = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND (name LIKE '%owner%' OR name LIKE '%lock%' OR name LIKE '%lease%' OR name LIKE '%heartbeat%')").all();
-  for (const t of tables) {
-    console.log('[owner-dump] table ' + t.name);
-    for (const r of db.prepare('SELECT * FROM "' + t.name + '" LIMIT 5').all()) {
-      console.log('[owner-dump] ' + JSON.stringify(r).slice(0, 400));
-    }
-  }
-  db.close();
-} catch (e) { console.log('[owner-dump] ' + e.message); }
-JSEOF
-}
-
-# Stale lock files left on the persistent volume by a crashed gateway
-clear_stale_locks() {
-  for d in "$OPENCLAW_HOME"/.openclaw/tmp/openclaw-*; do
-    [ -d "$d" ] || continue
-    for l in "$d"/*.lock; do
-      [ -e "$l" ] || continue
-      INFO=$(head -c 160 "$l" 2>/dev/null | tr '\n' ' ')
-      rm -rf "$l" && log "Removed stale lock: $l [$INFO]"
-    done
-  done
-}
-
-run_doctor() {
-  timeout 300 openclaw doctor --fix --non-interactive </dev/null >/tmp/doctor.out 2>&1
-  cat /tmp/doctor.out
-}
-doctor_locked() {
-  grep -q "could not enter maintenance" /tmp/doctor.out
-}
-
-# Move retired Telegram JSON state aside (blocks doctor migration; kept as backup)
-LEGACY_BAK="$OPENCLAW_HOME/legacy-telegram-backup"
-mkdir -p "$LEGACY_BAK"
-for f in "$OPENCLAW_HOME"/.openclaw/telegram/update-offset-*.json \
-         "$OPENCLAW_HOME"/.openclaw/agents/*/sessions/sessions.json.telegram-sent-messages.json; do
-  if [ -f "$f" ]; then
-    mv "$f" "$LEGACY_BAK/$(echo "$f" | tr '/' '_')" \
-      && log "Moved legacy telegram state: $f"
-  fi
-done
-
-# ----------------------------------------------------------------
-# Restore a state DB that an earlier boot moved aside
-# ----------------------------------------------------------------
-LOCKED=$(ls -t "$STATE_DB".locked-* 2>/dev/null | head -n1)
-if [ -n "$LOCKED" ]; then
-  warn "Found a state DB moved aside by an earlier boot - restoring: $LOCKED"
-  if [ -e "$STATE_DB" ]; then
-    mv "$STATE_DB" "$STATE_DB.fresh-$(date +%s)"
-  fi
-  rm -f "$STATE_DB-wal" "$STATE_DB-shm"
-  mv "$LOCKED" "$STATE_DB" && log "Restored state DB from $LOCKED"
-fi
-
-# If the state DB is corrupt, restore from doctor's own pre-migration backup
-if [ -f "$STATE_DB" ] && ! check_db "$STATE_DB" 2>/dev/null; then
-  warn "State DB failed integrity check - looking for an intact backup..."
-  GOOD=""
-  for B in $(ls -t "$STATE_DB".pre-startup-migration-*.bak 2>/dev/null); do
-    if check_db "$B" 2>/dev/null; then GOOD="$B"; break; fi
-  done
-  if [ -n "$GOOD" ]; then
-    mv "$STATE_DB" "$STATE_DB.corrupt-$(date +%s)"
-    rm -f "$STATE_DB-wal" "$STATE_DB-shm"
-    cp "$GOOD" "$STATE_DB" && log "Restored state DB from $GOOD"
-  else
-    warn "No intact backup found - leaving DB untouched"
-  fi
-fi
-
-# ----------------------------------------------------------------
-# Doctor (state migration)
-# ----------------------------------------------------------------
-log "Running openclaw doctor --fix (state migration)..."
-clear_stale_locks
-run_doctor
-if doctor_locked; then
-  warn "doctor blocked by state ownership lock - diagnostics follow"
-  log "now (UTC): $(date -u +%Y-%m-%dT%H:%M:%S)"
-  log "processes in this container:"
-  for p in /proc/[0-9]*; do
-    c=$(tr '\0' ' ' < "$p/cmdline" 2>/dev/null)
-    [ -n "$c" ] && echo "[proc] ${p#/proc/}: $(echo "$c" | cut -c1-160)"
-  done
-  dump_owner "$STATE_DB" 2>/dev/null
-  find "$OPENCLAW_HOME/.openclaw/tmp" -maxdepth 3 2>/dev/null | head -n 30
-  warn "retrying doctor in 30s..."
-  sleep 30
-  clear_stale_locks
-  run_doctor
-fi
-if doctor_locked; then
-  warn "doctor still blocked by the state lock - not touching any data"
-fi
-log "Doctor step done."
+node /app/spaces/huggingface/setup-hf-config.mjs || warn "setup failed"
+sh /app/security-check.sh || true
 
-# Plugins must not be world-writable or OpenClaw blocks them
+# ── doctor (本地新状态, 做一次迁移/校验) ──
+log "Running openclaw doctor --fix..."
+timeout 300 openclaw doctor --fix --non-interactive </dev/null >/tmp/doctor.out 2>&1
+tail -n 30 /tmp/doctor.out
 chmod -R go-w "$OPENCLAW_HOME/.openclaw/npm" "$OPENCLAW_HOME/.openclaw/extensions" 2>/dev/null || true
 
-# ----------------------------------------------------------------
-# Make the CLI default to the same gateway we start below
-# ----------------------------------------------------------------
 GW_URL="ws://127.0.0.1:7860"
 GW_TOKEN="${OPENCLAW_GATEWAY_TOKEN:-}"
+if [ -z "$GW_TOKEN" ]; then
+  GW_TOKEN=$(node -e 'try{console.log(JSON.parse(require("fs").readFileSync(process.env.OPENCLAW_HOME+"/.openclaw/openclaw.json","utf8")).gateway.auth.token||"")}catch(e){}' 2>/dev/null)
+fi
 for kv in "gateway.mode local" "gateway.port 7860"; do
   set -- $kv
-  if openclaw config set "$1" "$2" </dev/null >/tmp/cfg.out 2>&1; then
-    log "config set $1 = $2"
-  else
-    warn "config set $1 failed: $(head -c 200 /tmp/cfg.out | tr '\n' ' ')"
-  fi
+  openclaw config set "$1" "$2" </dev/null >/tmp/cfg.out 2>&1 \
+    && log "config set $1 = $2" || warn "config set $1 failed: $(head -c 200 /tmp/cfg.out | tr '\n' ' ')"
 done
 
-if [ "${#GW_TOKEN}" -lt 24 ]; then
-  warn "OPENCLAW_GATEWAY_TOKEN is only ${#GW_TOKEN} chars - with password-only access it should be 32+ letters/digits"
+# ── Telegram 网络: 启动先探测一次, 之后后台持续重试 ──
+export TG_IP_CACHE=/tmp/tg-ips.json
+GW_NODE_OPTIONS="--dns-result-order=ipv4first"
+if [ "${TG_NET_FIX:-1}" = "1" ]; then
+  log "Probing api.telegram.org..."
+  timeout 30 node /app/tg-net-fix.cjs probe || true
+  GW_NODE_OPTIONS="$GW_NODE_OPTIONS --require /app/tg-net-fix.cjs"
+  ( while true; do sleep 45; timeout 40 node /app/tg-net-fix.cjs probe quiet; done ) &
 fi
 
-# ----------------------------------------------------------------
-# Password-only access (no manual device approval).
-# A pairing request exists only AFTER the gateway password/token was accepted,
-# so approving pending requests == "correct password gets in".
-# Security therefore depends entirely on OPENCLAW_GATEWAY_TOKEN being long.
-# Set AUTO_APPROVE_PAIRING=0 (Space variable) to switch this off.
-# Request IDs are collected from two places:
-#   1) `openclaw devices list --json`
-#   2) the gateway log ("pairing required ... requestId: <uuid>")
-# ----------------------------------------------------------------
+# ── 只靠密码登录: 通过网关认证后才会出现配对请求, 自动批准 ──
 UUID_RE='[0-9a-f]\{8\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{12\}'
-
 try_approve() {
   ID="$1"
   grep -qx "$ID" /tmp/approved.ids 2>/dev/null && return 0
@@ -257,20 +71,12 @@ try_approve() {
 
 if [ "${AUTO_APPROVE_PAIRING:-1}" = "1" ]; then
 (
-  log "Pairing auto-approver started (only requests that already passed gateway auth)"
-  FAILS=0
-  SAMPLED=0
+  log "Pairing auto-approver started"
   while true; do
     sleep 4
-
-    # source 1: CLI device list
     IDS=""
-    if openclaw devices list --json --url "$GW_URL" --token "$GW_TOKEN" </dev/null >/tmp/devices.json 2>/tmp/devices.err \
-       || openclaw devices list --json </dev/null >/tmp/devices.json 2>/tmp/devices.err; then
-      if [ $SAMPLED -eq 0 ]; then
-        log "devices list sample: $(head -c 300 /tmp/devices.json | tr '\n' ' ')"
-        SAMPLED=1
-      fi
+    if openclaw devices list --json --url "$GW_URL" --token "$GW_TOKEN" </dev/null >/tmp/devices.json 2>/dev/null \
+       || openclaw devices list --json </dev/null >/tmp/devices.json 2>/dev/null; then
       IDS=$(node - <<'JSEOF'
 const fs = require('fs');
 let data;
@@ -283,9 +89,7 @@ const out = [];
       if (pending && x && typeof x === 'object') {
         const id = x.requestId || x.id;
         if (typeof id === 'string') out.push(id);
-      } else {
-        walk(x, key);
-      }
+      } else walk(x, key);
     }
   } else if (v && typeof v === 'object') {
     for (const k of Object.keys(v)) walk(v[k], k);
@@ -294,63 +98,31 @@ const out = [];
 console.log(out.join('\n'));
 JSEOF
 )
-    else
-      FAILS=$((FAILS+1))
-      if [ $FAILS -eq 8 ] || [ $((FAILS % 30)) -eq 0 ]; then
-        warn "devices list keeps failing: $(head -c 300 /tmp/devices.err | tr '\n' ' ') | $(head -c 200 /tmp/devices.json | tr '\n' ' ')"
-      fi
     fi
-
-    # source 2: request IDs printed by the gateway when a browser is waiting for approval
     LOGIDS=""
     LATEST=$(ls -t /tmp/openclaw/openclaw-*.log 2>/dev/null | head -n 1)
-    if [ -n "$LATEST" ]; then
-      LOGIDS=$(tail -n 300 "$LATEST" 2>/dev/null \
-        | grep -o "requestId[^0-9a-f]\{0,4\}$UUID_RE" \
-        | grep -o "$UUID_RE" | sort -u)
-    fi
-
-    for ID in $IDS $LOGIDS; do
-      try_approve "$ID"
-    done
+    [ -n "$LATEST" ] && LOGIDS=$(tail -n 300 "$LATEST" 2>/dev/null \
+      | grep -o "requestId[^0-9a-f]\{0,4\}$UUID_RE" | grep -o "$UUID_RE" | sort -u)
+    for ID in $IDS $LOGIDS; do try_approve "$ID"; done
   done
 ) &
 fi
 
-# ----------------------------------------------------------------
-# Gateway loop
-# ----------------------------------------------------------------
+# ── 网关循环 ──
 log "Starting gateway loop..."
-
 while true; do
-  clear_stale_locks
+  for d in "$OPENCLAW_HOME"/.openclaw/tmp/openclaw-*; do
+    [ -d "$d" ] && rm -f "$d"/*.lock 2>/dev/null
+  done
   log "Gateway starting..."
-
-  openclaw gateway \
-    --allow-unconfigured \
-    --bind lan \
-    --port 7860
+  NODE_OPTIONS="$GW_NODE_OPTIONS ${NODE_OPTIONS:-}" openclaw gateway --allow-unconfigured --bind lan --port 7860
   CODE=$?
-
   log "Gateway exited (code $CODE)"
-
   WAITED=0
   while nc -z 127.0.0.1 7860 2>/dev/null; do
-    if [ $WAITED -eq 0 ]; then
-      log "Port 7860 still held (spawned child running) - waiting..."
-    fi
-    sleep 2
-    WAITED=$((WAITED + 2))
-    if [ $WAITED -ge 90 ]; then
-      warn "Port 7860 still in use after 90s - forcing restart"
-      break
-    fi
+    [ $WAITED -eq 0 ] && log "Port 7860 still held - waiting..."
+    sleep 2; WAITED=$((WAITED + 2))
+    [ $WAITED -ge 90 ] && { warn "Port still in use after 90s - forcing restart"; break; }
   done
-
-  if [ $WAITED -gt 0 ]; then
-    log "Port free after ${WAITED}s"
-  fi
-
   sleep 1
-  log "Restarting gateway..."
 done