Update entrypoint.sh

entrypoint.sh

@@ -189,12 +189,12 @@ clear_stale_locks
 run_doctor
 if doctor_locked; then
   warn "doctor blocked by state ownership lock - diagnostics follow"
-  log "now (UTC): $(date -u +%Y-%m-%dT%H:%M:%S)"
-  log "processes in this container:"
+  log "now (UTC): $(date -u +%Y-%m-%dT%H:%M:%S)"  log "processes in this container:"
   for p in /proc/[0-9]*; do
     c=$(tr '\0' ' ' < "$p/cmdline" 2>/dev/null)
     [ -n "$c" ] && echo "[proc] ${p#/proc/}: $(echo "$c" | cut -c1-160)"
   done
+
   dump_owner "$STATE_DB" 2>/dev/null
   find "$OPENCLAW_HOME/.openclaw/tmp" -maxdepth 3 2>/dev/null | head -n 30
   warn "retrying doctor in 30s..."
@@ -211,101 +211,46 @@ log "Doctor step done."
 chmod -R go-w "$OPENCLAW_HOME/.openclaw/npm" "$OPENCLAW_HOME/.openclaw/extensions" 2>/dev/null || true
 
 # ----------------------------------------------------------------
+# Auto-approve pending device pairings (background)
 # ----------------------------------------------------------------
-# Password-only access.
-# A pairing request only exists AFTER the gateway password/token was accepted,
-# so approving pending requests = "correct password gets in".
-# Security therefore depends entirely on OPENCLAW_GATEWAY_TOKEN being long.
-# Set AUTO_APPROVE_PAIRING=0 (Space variable) to switch this off.
-# ----------------------------------------------------------------
-if [ "${AUTO_APPROVE_PAIRING:-1}" = "1" ]; then
 (
-  GW_URL="ws://127.0.0.1:7860"
-  log "Pairing auto-approver started (only requests that already passed gateway auth)"
-  if [ -z "${OPENCLAW_GATEWAY_TOKEN:-}" ]; then
-    warn "OPENCLAW_GATEWAY_TOKEN is empty - auto-approver cannot authenticate"
-  fi
-  FAILS=0
-  SAMPLED=0
+  DEVICES_DIR="$OPENCLAW_HOME/.openclaw/devices"
+  mkdir -p "$DEVICES_DIR"
+  log "Device auto-pairing watcher started"
   while true; do
-    sleep 5
-    if ! openclaw devices list --json --url "$GW_URL" --token "${OPENCLAW_GATEWAY_TOKEN:-}" </dev/null >/tmp/devices.json 2>/tmp/devices.err; then
-      if [ $((FAILS % 12)) -eq 0 ]; then
-        warn "devices list failed: $(head -c 300 /tmp/devices.err | tr '\n' ' ') | $(head -c 200 /tmp/devices.json | tr '\n' ' ')"
-      fi
-      FAILS=$((FAILS+1))
-      continue
-    fi
-    if [ $SAMPLED -eq 0 ]; then
-      log "devices list sample: $(head -c 300 /tmp/devices.json | tr '\n' ' ')"
-      SAMPLED=1
-    fi
-    IDS=$(node - <<'JSEOF'
-const fs = require('fs');
-let data;
-try { data = JSON.parse(fs.readFileSync('/tmp/devices.json', 'utf8')); } catch (e) { process.exit(0); }
-const out = [];
-(function walk(v, key) {
-  if (Array.isArray(v)) {
-    const pending = /pending/i.test(key || '');
-    for (const x of v) {
-      if (pending && x && typeof x === 'object') {
-        const id = x.requestId || x.id;
-        if (typeof id === 'string') out.push(id);
-      } else {
-        walk(x, key);
-      }
-    }
-  } else if (v && typeof v === 'object') {
-    for (const k of Object.keys(v)) walk(v[k], k);
-  }
-})(data, '');
-console.log(out.join('\n'));
-JSEOF
-)
-    for ID in $IDS; do
-      if openclaw devices approve "$ID" --url "$GW_URL" --token "${OPENCLAW_GATEWAY_TOKEN:-}" </dev/null >/tmp/approve.out 2>&1; then
-        log "Approved pairing request $ID"
-      else
-        warn "approve failed for $ID: $(head -c 200 /tmp/approve.out | tr '\n' ' ')"
-      fi
-    done
-  done
-) &
-fi
-    IDS=$(node - <<'JSEOF'
+    sleep 8
+    PENDING="$DEVICES_DIR/pending.json"
+    PAIRED="$DEVICES_DIR/paired.json"
+    if [ -f "$PENDING" ]; then
+      node - << 'JSEOF'
 const fs = require('fs');
-let data;
-try { data = JSON.parse(fs.readFileSync('/tmp/devices.json', 'utf8')); } catch (e) { process.exit(0); }
-const out = [];
-(function walk(v, key) {
-  if (Array.isArray(v)) {
-    const pending = /pending/i.test(key || '');
-    for (const x of v) {
-      if (pending && x && typeof x === 'object') {
-        const id = x.requestId || x.id;
-        if (typeof id === 'string') out.push(id);
-      } else {
-        walk(x, key);
-      }
-    }
-  } else if (v && typeof v === 'object') {
-    for (const k of Object.keys(v)) walk(v[k], k);
-  }
-})(data, '');
-console.log(out.join('\n'));
+const dir  = process.env.OPENCLAW_HOME + '/.openclaw/devices';
+const pend = dir + '/pending.json';
+const pair = dir + '/paired.json';
+try {
+  const raw = fs.readFileSync(pend, 'utf-8').trim();
+  if (!raw || raw === '[]' || raw === '{}') process.exit(0);
+  let pending = JSON.parse(raw);
+  if (!Array.isArray(pending)) pending = Object.values(pending);
+  if (pending.length === 0) process.exit(0);
+  let paired = [];
+  try { paired = JSON.parse(fs.readFileSync(pair, 'utf-8')); } catch(e) {}
+  if (!Array.isArray(paired)) paired = [];
+  const ids = new Set(paired.map(function(d){ return d.id||d.deviceId||d.name; }));
+  const todo = pending.filter(function(d){ return !ids.has(d.id||d.deviceId||d.name); });
+  if (todo.length === 0) process.exit(0);
+  const now = new Date().toISOString();
+  paired = paired.concat(todo.map(function(d){
+    return Object.assign({}, d, { approved: true, approvedAt: now });
+  }));
+  fs.writeFileSync(pair, JSON.stringify(paired, null, 2));
+  fs.writeFileSync(pend, '[]');
+  console.log('[auto-pair] Approved ' + todo.length + ' device(s)');
+} catch(e) { /* ignore */ }
 JSEOF
-)
-    for ID in $IDS; do
-      if openclaw devices approve "$ID" </dev/null >/tmp/approve.out 2>&1; then
-        log "Approved pairing request $ID"
-      else
-        warn "approve failed for $ID: $(head -c 200 /tmp/approve.out | tr '\n' ' ')"
-      fi
-    done
+    fi
   done
 ) &
-fi
 
 # ----------------------------------------------------------------
 # Gateway loop