Update entrypoint.sh

entrypoint.sh

@@ -189,7 +189,8 @@ clear_stale_locks
 run_doctor
 if doctor_locked; then
   warn "doctor blocked by state ownership lock - diagnostics follow"
-  log "now (UTC): $(date -u +%Y-%m-%dT%H:%M:%S)"  log "processes in this container:"
+  log "now (UTC): $(date -u +%Y-%m-%dT%H:%M:%S)"
+  log "processes in this container:"
   for p in /proc/[0-9]*; do
     c=$(tr '\0' ' ' < "$p/cmdline" 2>/dev/null)
     [ -n "$c" ] && echo "[proc] ${p#/proc/}: $(echo "$c" | cut -c1-160)"
@@ -210,46 +211,56 @@ log "Doctor step done."
 chmod -R go-w "$OPENCLAW_HOME/.openclaw/npm" "$OPENCLAW_HOME/.openclaw/extensions" 2>/dev/null || true
 
 # ----------------------------------------------------------------
-# Auto-approve pending device pairings (background)
+# Password-only access.
+# A pairing request only exists AFTER the gateway password/token was accepted,
+# so approving pending requests = "correct password gets in".
+# Security therefore depends entirely on OPENCLAW_GATEWAY_TOKEN being long.
+# Set AUTO_APPROVE_PAIRING=0 (Space variable) to switch this off.
 # ----------------------------------------------------------------
+if [ "${AUTO_APPROVE_PAIRING:-1}" = "1" ]; then
 (
-  DEVICES_DIR="$OPENCLAW_HOME/.openclaw/devices"
-  mkdir -p "$DEVICES_DIR"
-  log "Device auto-pairing watcher started"
+  log "Pairing auto-approver started (only requests that already passed gateway auth)"
+  SAMPLED=0
   while true; do
-    sleep 8
-    PENDING="$DEVICES_DIR/pending.json"
-    PAIRED="$DEVICES_DIR/paired.json"
-    if [ -f "$PENDING" ]; then
-      node - << 'JSEOF'
+    sleep 5
+    openclaw devices list --json </dev/null >/tmp/devices.json 2>/tmp/devices.err || continue
+    if [ $SAMPLED -eq 0 ] && [ -s /tmp/devices.json ]; then
+      log "devices list sample: $(head -c 300 /tmp/devices.json | tr '\n' ' ')"
+      SAMPLED=1
+    fi
+    IDS=$(node - <<'JSEOF'
 const fs = require('fs');
-const dir  = process.env.OPENCLAW_HOME + '/.openclaw/devices';
-const pend = dir + '/pending.json';
-const pair = dir + '/paired.json';
-try {
-  const raw = fs.readFileSync(pend, 'utf-8').trim();
-  if (!raw || raw === '[]' || raw === '{}') process.exit(0);
-  let pending = JSON.parse(raw);
-  if (!Array.isArray(pending)) pending = Object.values(pending);
-  if (pending.length === 0) process.exit(0);
-  let paired = [];
-  try { paired = JSON.parse(fs.readFileSync(pair, 'utf-8')); } catch(e) {}
-  if (!Array.isArray(paired)) paired = [];
-  const ids = new Set(paired.map(function(d){ return d.id||d.deviceId||d.name; }));
-  const todo = pending.filter(function(d){ return !ids.has(d.id||d.deviceId||d.name); });
-  if (todo.length === 0) process.exit(0);
-  const now = new Date().toISOString();
-  paired = paired.concat(todo.map(function(d){
-    return Object.assign({}, d, { approved: true, approvedAt: now });
-  }));
-  fs.writeFileSync(pair, JSON.stringify(paired, null, 2));
-  fs.writeFileSync(pend, '[]');
-  console.log('[auto-pair] Approved ' + todo.length + ' device(s)');
-} catch(e) { /* ignore */ }
+let data;
+try { data = JSON.parse(fs.readFileSync('/tmp/devices.json', 'utf8')); } catch (e) { process.exit(0); }
+const out = [];
+(function walk(v, key) {
+  if (Array.isArray(v)) {
+    const pending = /pending/i.test(key || '');
+    for (const x of v) {
+      if (pending && x && typeof x === 'object') {
+        const id = x.requestId || x.id;
+        if (typeof id === 'string') out.push(id);
+      } else {
+        walk(x, key);
+      }
+    }
+  } else if (v && typeof v === 'object') {
+    for (const k of Object.keys(v)) walk(v[k], k);
+  }
+})(data, '');
+console.log(out.join('\n'));
 JSEOF
-    fi
+)
+    for ID in $IDS; do
+      if openclaw devices approve "$ID" </dev/null >/tmp/approve.out 2>&1; then
+        log "Approved pairing request $ID"
+      else
+        warn "approve failed for $ID: $(head -c 200 /tmp/approve.out | tr '\n' ' ')"
+      fi
+    done
   done
 ) &
+fi
 
 # ----------------------------------------------------------------
 # Gateway loop