Update Dockerfile

Dockerfile

@@ -1,42 +1,41 @@
-FROM ghcr.io/openclaw/openclaw:latest
+# ════════════════════════════════════════════════════════════════
+# OpenClaw for HuggingFace Spaces — Multi-stage build
+# Stage 1: extract OpenClaw binary from official image
+# Stage 2: fresh node:22-slim base (no Baileys, no WhatsApp libs)
+# ════════════════════════════════════════════════════════════════
 
-USER root
+# ── Stage 1: Pull pre-built OpenClaw ──
+FROM ghcr.io/openclaw/openclaw:latest AS openclaw
+
+# ── Stage 2: Clean runtime — Baileys never enters this layer ──
+FROM node:22-slim
+
+# Install system dependencies (nginx for reverse proxy)
+RUN apt-get update && apt-get install -y \
+    nginx \
+    git \
+    ca-certificates \
+    curl \
+    netcat-openbsd \
+    --no-install-recommends && \
+    rm -rf /var/lib/apt/lists/*
 
-# ----------------------------------------------------------------
-# Remove Baileys (WhatsApp automation lib) from the base image.
-# OpenClaw bundles it for WhatsApp channel support, but HF policy
-# prohibits third-party messaging automation. Purge it completely.
-# ----------------------------------------------------------------
-RUN find /app /usr/local/lib /root -type d \( \
-      -name "baileys" \
-      -o -name "@whiskeysockets" \
-      -o -name "whatsapp-web*" \
-    \) -exec rm -rf {} + 2>/dev/null || true && \
-    find /app /usr/local/lib /root -name "package.json" ! -path "*/\.*" \
-      -exec sh -c ' \
-        node -e " \
-          var fs=require(\"fs\"); \
-          var p=process.argv[1]; \
-          try { \
-            var j=JSON.parse(fs.readFileSync(p,\"utf-8\")); \
-            var changed=false; \
-            [\"dependencies\",\"devDependencies\",\"optionalDependencies\"].forEach(function(k){ \
-              if(!j[k]) return; \
-              [\"baileys\",\"@whiskeysockets/baileys\",\"@adiwajshing/baileys\"].forEach(function(b){ \
-                if(j[k][b]){ delete j[k][b]; changed=true; \
-                  console.log(\"[baileys-purge] Removed \"+b+\" from \"+p); } \
-              }); \
-            }); \
-            if(changed) fs.writeFileSync(p,JSON.stringify(j,null,2)); \
-          } catch(e){} \
-        " "$1" \
-      ' _ {} \; 2>/dev/null || true
+# Copy OpenClaw app from Stage 1 (binary/app only, no npm install needed)
+COPY --from=openclaw /app /app
 
-# Copy Space repo files into container
-COPY openclaw.json         /app/openclaw-template.json
+# Symlink openclaw CLI
+RUN ln -sf /app/openclaw.mjs /usr/local/bin/openclaw 2>/dev/null || true
+
+# Copy Space repo files
+COPY openclaw.json        /app/openclaw-template.json
 COPY setup-hf-config.mjs  /app/spaces/huggingface/setup-hf-config.mjs
-COPY entrypoint.sh         /app/entrypoint.sh
-COPY security-check.sh     /app/security-check.sh
+COPY entrypoint.sh        /app/entrypoint.sh
+COPY security-check.sh    /app/security-check.sh
+COPY nginx.conf           /etc/nginx/conf.d/default.conf
+COPY start.sh             /app/start.sh
+
+# Remove default nginx site
+RUN rm -f /etc/nginx/sites-enabled/default /etc/nginx/sites-available/default
 
 # PATCH: suppress meta.lastTouchedAt from triggering gateway restarts
 RUN node -e " \
@@ -79,7 +78,7 @@ RUN node -e " \
   console.log('[patch] Done. ' + patched + '/' + bundles.length + ' file(s) patched'); \
 " || echo "[patch] Non-fatal: patch step failed"
 
-RUN chmod +x /app/entrypoint.sh /app/security-check.sh && \
+RUN chmod +x /app/entrypoint.sh /app/security-check.sh /app/start.sh && \
     mkdir -p /data && chmod 777 /data && \
     mkdir -p /home/user && chmod 777 /home/user