Update setup-hf-config.mjs

setup-hf-config.mjs

@@ -2,73 +2,96 @@
 import fs from "fs";
 import path from "path";
 
-const HOME = process.env.OPENCLAW_HOME || "/home/user";
-const DIR = path.join(HOME, ".openclaw");
-const FILE = path.join(DIR, "openclaw.json");
+const home = process.env.OPENCLAW_HOME || process.env.HOME || "/home/user";
+const stateDir = path.join(home, ".openclaw");
+const configPath = path.join(stateDir, "openclaw.json");
 
-fs.mkdirSync(DIR, { recursive: true });
-
-const clean = v => (v || "").toString().trim().replace(/^["']|["']$/g, "");
-
-const env = (...keys) => {
-  for (const k of keys) {
-    const v = clean(process.env[k]);
-    if (v) return v;
+// 读取 token/password
+function readGatewayToken() {
+  const fromEnv = process.env.OPENCLAW_GATEWAY_TOKEN?.trim();
+  if (fromEnv) return fromEnv;
+  const filePath = process.env.OPENCLAW_GATEWAY_TOKEN_FILE?.trim();
+  if (filePath && fs.existsSync(filePath)) {
+    try { return fs.readFileSync(filePath, "utf-8").trim(); } catch { return ""; }
   }
   return "";
-};
+}
+
+const defaultModel =
+  process.env.OPENCLAW_HF_DEFAULT_MODEL?.trim() || "huggingface/deepseek-ai/DeepSeek-R1";
+const gatewayToken = readGatewayToken();
+const gatewayPassword = process.env.OPENCLAW_GATEWAY_PASSWORD?.trim();
+
+// Trusted proxies for HF
+const DEFAULT_HF_TRUSTED_PROXY_IPS = [
+  "10.16.4.123","10.16.34.155","10.20.1.9","10.20.1.222","10.20.26.157","10.20.31.87"
+];
+const trustedProxiesRaw = process.env.OPENCLAW_GATEWAY_TRUSTED_PROXIES?.trim();
+const trustedProxies = trustedProxiesRaw
+  ? trustedProxiesRaw.split(",").map(s=>s.trim()).filter(Boolean)
+  : DEFAULT_HF_TRUSTED_PROXY_IPS;
+
+// Control UI origins
+const allowedOriginsRaw = process.env.OPENCLAW_CONTROL_UI_ALLOWED_ORIGINS?.trim();
+const allowedOrigins = allowedOriginsRaw
+  ? allowedOriginsRaw.split(",").map(s=>s.trim()).filter(Boolean)
+  : [];
 
 let config = {};
+if (fs.existsSync(configPath)) {
+  try { config = JSON.parse(fs.readFileSync(configPath,"utf-8")); } catch {}
+}
 
-// 🔹 模型选择优先级
-let model =
-  env("OPENCLAW_MODEL") ||
-  env("OPENCLAW_DEFAULT_MODEL") ||
-  (env("GEMINI_API_KEY") && "google/gemini-3.1-pro-preview") ||
-  (env("GROQ_API_KEY") && "groq/llama-3.3-70b-versatile") ||
-  "huggingface/deepseek-ai/DeepSeek-R1";
+// Agents / model
+config.agents ??= {};
+config.agents.defaults ??= {};
+config.agents.defaults.model ??= {};
+config.agents.defaults.model.primary = defaultModel;
 
-config.agents = {
-  defaults: {
-    model: { primary: model }
-  }
-};
+// Auth
+const useTokenAuth = Boolean(gatewayToken);
+const usePasswordAuth = Boolean(gatewayPassword) && !useTokenAuth;
+config.gateway ??= {};
+config.gateway.auth ??= {};
+if (useTokenAuth) {
+  config.gateway.auth.mode = "token";
+  config.gateway.auth.token = gatewayToken;
+} else if (usePasswordAuth) {
+  config.gateway.auth.mode = "password";
+  config.gateway.auth.password = gatewayPassword;
+}
 
-// 🔹 网关配置（修复 1005/1008）
-const token = env("OPENCLAW_GATEWAY_TOKEN");
+// Disable device pairing (HF Spaces)
+config.gateway.controlUi ??= {};
+config.gateway.controlUi.dangerouslyDisableDeviceAuth = true;
 
-config.gateway = {
-  auth: {
-    mode: "token",
-    token: token || "123456"
-  },
-  trustedProxies: ["*"],
-  controlUi: {
-    dangerouslyDisableDeviceAuth: true
-  }
-};
+// Trusted proxies
+config.gateway.trustedProxies = trustedProxies;
 
-// 🔹 Telegram 配置
-const tg = env("TELEGRAM_BOT_TOKEN");
-if (tg) {
-  config.channels = {
-    telegram: {
-      enabled: true,
-      botToken: tg
-    }
-  };
+// Allowed origins
+if (allowedOrigins.length>0){
+  config.gateway.controlUi.allowedOrigins = allowedOrigins;
 }
 
-// 🔹 Env 注入（模型厂商）
-config.env = {
-  vars: {
-    GEMINI_API_KEY: env("GEMINI_API_KEY"),
-    GROQ_API_KEY: env("GROQ_API_KEY"),
-    HF_TOKEN: env("HF_TOKEN"),
-    TELEGRAM_BOT_TOKEN: tg
-  }
+// Telegram
+const tg = process.env.TELEGRAM_BOT_TOKEN?.trim();
+if(tg){
+  config.channels ??= {};
+  config.channels.telegram ??= {};
+  config.channels.telegram.enabled = true;
+  config.channels.telegram.botToken = tg;
+}
+
+// Inject env for providers
+config.env ??= {};
+config.env.vars = {
+  GEMINI_API_KEY: process.env.GEMINI_API_KEY,
+  GROQ_API_KEY: process.env.GROQ_API_KEY,
+  HF_TOKEN: process.env.HF_TOKEN,
+  TELEGRAM_BOT_TOKEN: tg,
 };
 
-fs.writeFileSync(FILE, JSON.stringify(config, null, 2));
+fs.mkdirSync(stateDir,{recursive:true});
+fs.writeFileSync(configPath, JSON.stringify(config,null,2),"utf-8");
 
 console.log("🔥 OpenClaw HF 生产级配置完成");