Update entrypoint.sh

entrypoint.sh

@@ -7,19 +7,17 @@ ts() { date -u +"%Y-%m-%dT%H:%M:%SZ"; }
 log() { echo "[$(ts)] [entrypoint] $*"; }
 die() { log "FATAL: $*"; exit 1; }
 
-# Telegram long-polling uses the outbound Bot API connection.
-# Prefer IPv4 on HF runtimes where IPv6 egress is unavailable.
+# Telegram Long Polling prefers IPv4 on HF runtimes with limited IPv6 egress.
 export NODE_OPTIONS="--dns-result-order=ipv4first ${NODE_OPTIONS:-}"
 
-# Hugging Face Storage Bucket must be mounted at /data.
-# Do not silently fall back to ephemeral local storage.
+# Persistent Storage Bucket is mandatory; never silently fall back to ephemeral disk.
 [ -d /data ] || die "/data does not exist. Attach a persistent Storage Bucket to this Space."
 touch /data/.openclaw-write-test 2>/dev/null || die "/data is not writable."
 rm -f /data/.openclaw-write-test
 
 mkdir -p /data/.openclaw /home/user/.openclaw
 
-# One-time migration: copy old local state only when the bucket state is empty.
+# One-time migration only when the Bucket state directory is completely empty.
 if [ -z "$(find /data/.openclaw -mindepth 1 -maxdepth 1 -print -quit 2>/dev/null)" ] \
    && [ -n "$(find /home/user/.openclaw -mindepth 1 -maxdepth 1 -print -quit 2>/dev/null)" ]; then
   log "Bucket state is empty; migrating existing /home/user/.openclaw data."
@@ -32,7 +30,7 @@ export OPENCLAW_GATEWAY_PORT=7860
 log "OPENCLAW_HOME=$OPENCLAW_HOME"
 log "Gateway public port=$OPENCLAW_GATEWAY_PORT"
 
-# Run configuration writer. Any missing Secret or invalid config is fatal.
+# Fail closed if the config writer fails.
 log "Writing OpenClaw configuration..."
 node /app/spaces/huggingface/setup-hf-config.mjs \
   || die "setup-hf-config.mjs failed; Gateway will not be started."
@@ -40,18 +38,13 @@ node /app/spaces/huggingface/setup-hf-config.mjs \
 CONFIG=/data/.openclaw/openclaw.json
 [ -s "$CONFIG" ] || die "Configuration file was not created: $CONFIG"
 
-# Let OpenClaw perform its supported state/config migrations.
-# Do not edit SQLite or device pairing JSON files directly.
-log "Running OpenClaw doctor migration..."
-if command -v timeout >/dev/null 2>&1; then
-  timeout 300 openclaw doctor --fix --non-interactive \
-    || die "openclaw doctor failed; inspect the doctor output above."
-else
-  openclaw doctor --fix --non-interactive \
-    || die "openclaw doctor failed; inspect the doctor output above."
-fi
+# IMPORTANT: Do NOT run 'openclaw doctor --fix' on every container boot.
+# Doctor requires exclusive maintenance ownership. A live Gateway/other process
+# using this same state directory keeps that ownership and correctly blocks Doctor.
+# Run Doctor manually only after stopping every Gateway using this Bucket.
+log "Skipping automatic doctor --fix (maintenance requires exclusive state ownership)."
 
-# Plugin directories must not be group/world writable.
+# Plugins must not be group/world writable.
 chmod -R go-w /data/.openclaw/npm /data/.openclaw/extensions 2>/dev/null || true
 
 if [ -f /app/security-check.sh ]; then
@@ -59,16 +52,38 @@ if [ -f /app/security-check.sh ]; then
   sh /app/security-check.sh || log "WARNING: security-check.sh reported findings."
 fi
 
+# Read-only process inventory. This does not modify lock, database, or pairing files.
+log "Checking for other OpenClaw processes before Gateway startup..."
+node --input-type=module - <<'NODE'
+import fs from 'node:fs';
+for (const pid of fs.readdirSync('/proc').filter((x) => /^\d+$/.test(x))) {
+  try {
+    const cmd = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ').trim();
+    if (/openclaw|gateway\.(mjs|js)|dist\/entry\.js/.test(cmd)) {
+      console.log(`[process-check] pid=${pid} cmd=${cmd.slice(0, 260)}`);
+    }
+  } catch {}
+}
+NODE
+
 log "Starting OpenClaw Gateway directly on 0.0.0.0:7860."
-log "Nginx is intentionally not started: Hugging Face routes app_port 7860 directly to Gateway."
+log "Nginx is intentionally not started; Hugging Face app_port must be 7860."
 
-# Restart Gateway if the process exits, but never mutate state/pairing files.
 while :; do
-  if openclaw gateway --bind lan --port 7860; then
-    rc=0
+  GATEWAY_LOG=/tmp/openclaw-gateway.log
+  : > "$GATEWAY_LOG"
+  if openclaw gateway --bind lan --port 7860 >"$GATEWAY_LOG" 2>&1; then
+    GATEWAY_RC=0
   else
-    rc=$?
+    GATEWAY_RC=$?
   fi
-  log "Gateway exited with code $rc; retrying in 5 seconds."
+  cat "$GATEWAY_LOG"
+  log "Gateway exited with code $GATEWAY_RC."
+
+  if grep -Eqi 'GatewayLockError|failed to acquire gateway state ownership|another OpenClaw process owns|EADDRINUSE' "$GATEWAY_LOG"; then
+    die "Gateway state/port is already owned. Stop the other Gateway or detach this Bucket from other running Spaces; do not delete lock files."
+  fi
+
+  log "Unexpected Gateway exit; retrying in 5 seconds."
   sleep 5
 done