Update entrypoint.sh

entrypoint.sh

@@ -189,12 +189,12 @@ clear_stale_locks
 run_doctor
 if doctor_locked; then
   warn "doctor blocked by state ownership lock - diagnostics follow"
-  log "now (UTC): $(date -u +%Y-%m-%dT%H:%M:%S)"  log "processes in this container:"
+  log "now (UTC): $(date -u +%Y-%m-%dT%H:%M:%S)"
+  log "processes in this container:"
   for p in /proc/[0-9]*; do
     c=$(tr '\0' ' ' < "$p/cmdline" 2>/dev/null)
     [ -n "$c" ] && echo "[proc] ${p#/proc/}: $(echo "$c" | cut -c1-160)"
   done
-
   dump_owner "$STATE_DB" 2>/dev/null
   find "$OPENCLAW_HOME/.openclaw/tmp" -maxdepth 3 2>/dev/null | head -n 30
   warn "retrying doctor in 30s..."
@@ -211,46 +211,111 @@ log "Doctor step done."
 chmod -R go-w "$OPENCLAW_HOME/.openclaw/npm" "$OPENCLAW_HOME/.openclaw/extensions" 2>/dev/null || true
 
 # ----------------------------------------------------------------
-# Auto-approve pending device pairings (background)
+# Make the CLI default to the same gateway we start below
 # ----------------------------------------------------------------
+GW_URL="ws://127.0.0.1:7860"
+GW_TOKEN="${OPENCLAW_GATEWAY_TOKEN:-}"
+for kv in "gateway.mode local" "gateway.port 7860"; do
+  set -- $kv
+  if openclaw config set "$1" "$2" </dev/null >/tmp/cfg.out 2>&1; then
+    log "config set $1 = $2"
+  else
+    warn "config set $1 failed: $(head -c 200 /tmp/cfg.out | tr '\n' ' ')"
+  fi
+done
+
+if [ "${#GW_TOKEN}" -lt 24 ]; then
+  warn "OPENCLAW_GATEWAY_TOKEN is only ${#GW_TOKEN} chars - with password-only access it should be 32+ letters/digits"
+fi
+
+# ----------------------------------------------------------------
+# Password-only access (no manual device approval).
+# A pairing request exists only AFTER the gateway password/token was accepted,
+# so approving pending requests == "correct password gets in".
+# Security therefore depends entirely on OPENCLAW_GATEWAY_TOKEN being long.
+# Set AUTO_APPROVE_PAIRING=0 (Space variable) to switch this off.
+# Request IDs are collected from two places:
+#   1) `openclaw devices list --json`
+#   2) the gateway log ("pairing required ... requestId: <uuid>")
+# ----------------------------------------------------------------
+UUID_RE='[0-9a-f]\{8\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{12\}'
+
+try_approve() {
+  ID="$1"
+  grep -qx "$ID" /tmp/approved.ids 2>/dev/null && return 0
+  N=$(cat "/tmp/fail.$ID" 2>/dev/null || echo 0)
+  [ "$N" -ge 2 ] && return 0
+  if openclaw devices approve "$ID" --url "$GW_URL" --token "$GW_TOKEN" </dev/null >/tmp/approve.out 2>&1 \
+     || openclaw devices approve "$ID" </dev/null >/tmp/approve.out 2>&1; then
+    echo "$ID" >> /tmp/approved.ids
+    log "Approved pairing request $ID"
+  else
+    echo $((N+1)) > "/tmp/fail.$ID"
+    warn "approve failed for $ID: $(head -c 300 /tmp/approve.out | tr '\n' ' ')"
+  fi
+}
+
+if [ "${AUTO_APPROVE_PAIRING:-1}" = "1" ]; then
 (
-  DEVICES_DIR="$OPENCLAW_HOME/.openclaw/devices"
-  mkdir -p "$DEVICES_DIR"
-  log "Device auto-pairing watcher started"
+  log "Pairing auto-approver started (only requests that already passed gateway auth)"
+  FAILS=0
+  SAMPLED=0
   while true; do
-    sleep 8
-    PENDING="$DEVICES_DIR/pending.json"
-    PAIRED="$DEVICES_DIR/paired.json"
-    if [ -f "$PENDING" ]; then
-      node - << 'JSEOF'
+    sleep 4
+
+    # source 1: CLI device list
+    IDS=""
+    if openclaw devices list --json --url "$GW_URL" --token "$GW_TOKEN" </dev/null >/tmp/devices.json 2>/tmp/devices.err \
+       || openclaw devices list --json </dev/null >/tmp/devices.json 2>/tmp/devices.err; then
+      if [ $SAMPLED -eq 0 ]; then
+        log "devices list sample: $(head -c 300 /tmp/devices.json | tr '\n' ' ')"
+        SAMPLED=1
+      fi
+      IDS=$(node - <<'JSEOF'
 const fs = require('fs');
-const dir  = process.env.OPENCLAW_HOME + '/.openclaw/devices';
-const pend = dir + '/pending.json';
-const pair = dir + '/paired.json';
-try {
-  const raw = fs.readFileSync(pend, 'utf-8').trim();
-  if (!raw || raw === '[]' || raw === '{}') process.exit(0);
-  let pending = JSON.parse(raw);
-  if (!Array.isArray(pending)) pending = Object.values(pending);
-  if (pending.length === 0) process.exit(0);
-  let paired = [];
-  try { paired = JSON.parse(fs.readFileSync(pair, 'utf-8')); } catch(e) {}
-  if (!Array.isArray(paired)) paired = [];
-  const ids = new Set(paired.map(function(d){ return d.id||d.deviceId||d.name; }));
-  const todo = pending.filter(function(d){ return !ids.has(d.id||d.deviceId||d.name); });
-  if (todo.length === 0) process.exit(0);
-  const now = new Date().toISOString();
-  paired = paired.concat(todo.map(function(d){
-    return Object.assign({}, d, { approved: true, approvedAt: now });
-  }));
-  fs.writeFileSync(pair, JSON.stringify(paired, null, 2));
-  fs.writeFileSync(pend, '[]');
-  console.log('[auto-pair] Approved ' + todo.length + ' device(s)');
-} catch(e) { /* ignore */ }
+let data;
+try { data = JSON.parse(fs.readFileSync('/tmp/devices.json', 'utf8')); } catch (e) { process.exit(0); }
+const out = [];
+(function walk(v, key) {
+  if (Array.isArray(v)) {
+    const pending = /pending/i.test(key || '');
+    for (const x of v) {
+      if (pending && x && typeof x === 'object') {
+        const id = x.requestId || x.id;
+        if (typeof id === 'string') out.push(id);
+      } else {
+        walk(x, key);
+      }
+    }
+  } else if (v && typeof v === 'object') {
+    for (const k of Object.keys(v)) walk(v[k], k);
+  }
+})(data, '');
+console.log(out.join('\n'));
 JSEOF
+)
+    else
+      FAILS=$((FAILS+1))
+      if [ $FAILS -eq 8 ] || [ $((FAILS % 30)) -eq 0 ]; then
+        warn "devices list keeps failing: $(head -c 300 /tmp/devices.err | tr '\n' ' ') | $(head -c 200 /tmp/devices.json | tr '\n' ' ')"
+      fi
+    fi
+
+    # source 2: request IDs printed by the gateway when a browser is waiting for approval
+    LOGIDS=""
+    LATEST=$(ls -t /tmp/openclaw/openclaw-*.log 2>/dev/null | head -n 1)
+    if [ -n "$LATEST" ]; then
+      LOGIDS=$(tail -n 300 "$LATEST" 2>/dev/null \
+        | grep -o "requestId[^0-9a-f]\{0,4\}$UUID_RE" \
+        | grep -o "$UUID_RE" | sort -u)
     fi
+
+    for ID in $IDS $LOGIDS; do
+      try_approve "$ID"
+    done
   done
 ) &
+fi
 
 # ----------------------------------------------------------------
 # Gateway loop