Update setup-hf-config.mjs

setup-hf-config.mjs

@@ -4,8 +4,20 @@ import https from "node:https";
 
 // ============================================================
 // OpenClaw HF Spaces - Production Config Writer
-// Called ONCE per container lifetime by entrypoint.sh.
-// Always writes fresh config from env vars on first boot.
+//
+// KEY BEHAVIOR:
+// If openclaw.json exists and is valid -> PATCH only (preserve user settings)
+// If openclaw.json missing -> write fresh template
+//
+// What gets patched every run:
+//   gateway.auth        (from env OPENCLAW_GATEWAY_TOKEN)
+//   env.vars            (all provider API keys)
+//   channels.telegram   (from env TELEGRAM_BOT_TOKEN)
+//   agents.defaults.workspace (ensure correct path)
+//   gateway.trustedProxies    (ensure not empty)
+//
+// What is NEVER touched when patching:
+//   All user settings from Control UI (model choices, agent config, etc.)
 // ============================================================
 
 var HOME        = process.env.OPENCLAW_HOME || process.env.HOME || "/home/user";
@@ -20,27 +32,20 @@ function parseList(val) {
 if (!val || !val.trim()) return [];
 return val.split(",").map(function(s) { return s.trim(); }).filter(Boolean);
 }
-
-function envStr(key) {
-return (process.env[key] || "").trim();
-}
+function envStr(key) { return (process.env[key] || "").trim(); }
 
 // –– auth –––––––––––––––––––––––––
-
 var gatewayToken    = envStr("OPENCLAW_GATEWAY_TOKEN");
 var gatewayPassword = envStr("OPENCLAW_GATEWAY_PASSWORD");
-
 if (!gatewayToken && !gatewayPassword) {
 console.error("[setup] FATAL: set OPENCLAW_GATEWAY_TOKEN or OPENCLAW_GATEWAY_PASSWORD");
 process.exit(0);
 }
 
 // –– model ———————————————––
-
 var defaultModel = envStr("OPENCLAW_HF_DEFAULT_MODEL") || "google/gemini-2.0-flash";
 
 // –– provider keys —————————————–
-
 var EXCLUDE_PREFIXES = [
 "OPENCLAW_", "SPACE_", "SYSTEM_", "HF_",
 "NODE_", "PATH", "HOME", "USER", "PWD", "LANG", "LC_",
@@ -50,7 +55,6 @@ var INCLUDE_SUFFIXES = [
 "_API_KEY", "_SECRET_KEY", "_ACCESS_TOKEN",
 "_BOT_TOKEN", "_AUTH_TOKEN", "_APP_KEY"
 ];
-
 function isProviderKey(k) {
 var i;
 for (i = 0; i < EXCLUDE_PREFIXES.length; i++) {
@@ -62,61 +66,26 @@ if (k.length > s.length && k.indexOf(s) === k.length - s.length) return true;
 }
 return false;
 }
-
 var providerKeys = Object.keys(process.env).filter(function(k) {
 return isProviderKey(k) && (process.env[k] || "").trim();
 }).sort();
 
-console.log("[setup] Detected provider keys (" + providerKeys.length + "):");
-providerKeys.forEach(function(k) { console.log("  + " + k); });
+console.log("[setup] Provider keys (" + providerKeys.length + "): " + providerKeys.join(", "));
 
 // –– trusted proxies —————————————
-
 var envProxies     = parseList(envStr("OPENCLAW_GATEWAY_TRUSTED_PROXIES"));
 var trustedProxies = envProxies.length > 0 ? envProxies : [
-"10.0.0.0/8",
-"172.16.0.0/12",
-"192.168.0.0/16",
+"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
 "10.16.0.0/12",   "10.20.0.0/12",
 "10.16.4.123",    "10.16.7.92",   "10.16.18.232",
 "10.16.34.155",   "10.16.43.133", "10.16.1.206",
 "10.16.37.110",   "10.16.43.246",
 "10.20.1.9",      "10.20.1.222",
 "10.20.26.157",   "10.20.31.87",
-"10.20.0.1",      "172.17.0.1",
-"127.0.0.1"
+"10.20.0.1",      "172.17.0.1",   "127.0.0.1"
 ];
 
-// –– build config ——————————————
-
-var config = {
-gateway: {
-auth: gatewayToken
-? { mode: "token",    token:    gatewayToken    }
-: { mode: "password", password: gatewayPassword },
-controlUi: {
-allowInsecureAuth:                        true,
-allowedOrigins:                           ["*"],
-dangerouslyDisableDeviceAuth:             true,
-dangerouslyAllowHostHeaderOriginFallback: true
-},
-trustedProxies: trustedProxies
-},
-agents: {
-defaults: {
-model:     defaultModel,
-workspace: WORKSPACE
-}
-},
-env: { vars: {} }
-};
-
-providerKeys.forEach(function(pk) {
-config.env.vars[pk] = (process.env[pk] || "").trim();
-});
-
-// –– Telegram –––––––––––––––––––––––
-
+// –– Telegram helpers –––––––––––––––––––
 function tgRequest(token, method, body) {
 return new Promise(function(resolve) {
 var data = JSON.stringify(body || {});
@@ -142,64 +111,120 @@ req.end();
 });
 }
 
-async function setupTelegram() {
-var token = envStr("TELEGRAM_BOT_TOKEN");
-if (!token) {
-console.log("[setup] Telegram: disabled (no TELEGRAM_BOT_TOKEN)");
+async function setupWebhook(token) {
+if (!SPACE_HOST) {
+console.log("[setup] Telegram: set SPACE_HOST for auto webhook");
 return;
 }
-
-if (SPACE_HOST) {
-var webhookUrl = "https://" + SPACE_HOST + "/tg-webhook";
+var url = "https://" + SPACE_HOST + "/tg-webhook";
 var r = await tgRequest(token, "setWebhook", {
-url:                  webhookUrl,
-drop_pending_updates: true,
-max_connections:      10
+url: url, drop_pending_updates: true, max_connections: 10
 });
 if (r && r.ok) {
-console.log("[setup] Telegram: webhook registered -> " + webhookUrl);
+console.log("[setup] Telegram: webhook registered -> " + url);
 } else {
-console.log("[setup] Telegram: auto-registration failed");
-console.log("[setup] Open this URL in your browser once:");
+console.log("[setup] Telegram: webhook failed (HF outbound blocked). Open in browser:");
 console.log("  https://api.telegram.org/bot" + token +
-"/setWebhook?url=" + webhookUrl + "&drop_pending_updates=true");
+"/setWebhook?url=" + url + "&drop_pending_updates=true");
 }
-} else {
-console.log("[setup] Telegram: set SPACE_HOST for auto webhook");
 }
 
-config.channels = {
-telegram: {
-enabled:  true,
-accounts: {
-main: { botToken: token, apiRoot: "https://api.telegram.org" }
-}
+function buildAuth() {
+return gatewayToken
+? { mode: "token",    token:    gatewayToken    }
+: { mode: "password", password: gatewayPassword };
 }
-};
-console.log("[setup] Telegram: configured");
+
+function buildEnvVars() {
+var vars = {};
+providerKeys.forEach(function(pk) {
+vars[pk] = (process.env[pk] || "").trim();
+});
+return vars;
 }
 
 // –– main –––––––––––––––––––––––––
-
 (async function() {
 fs.mkdirSync(STATE_DIR, { recursive: true });
 fs.mkdirSync(WORKSPACE,  { recursive: true });
 fs.mkdirSync(path.join(WORKSPACE, "memory"), { recursive: true });
 
-await setupTelegram();
+var token = envStr("TELEGRAM_BOT_TOKEN");
+if (token) await setupWebhook(token);
 
+// –– PATCH MODE: existing valid config found ––––
 if (fs.existsSync(CONFIG_PATH)) {
-fs.copyFileSync(CONFIG_PATH, CONFIG_PATH + ".bak");
+var raw = fs.readFileSync(CONFIG_PATH, "utf-8").trim();
+var parsed = null;
+try { parsed = JSON.parse(raw); } catch (e) { /* invalid, fall through to fresh write */ }
+
+if (parsed) {
+  // Patch only env-derived fields, preserve everything else
+  parsed.gateway        = parsed.gateway        || {};
+  parsed.gateway.auth   = buildAuth();
+  if (!parsed.gateway.trustedProxies || parsed.gateway.trustedProxies.length < 5) {
+    parsed.gateway.trustedProxies = trustedProxies;
+  }
+  parsed.agents                         = parsed.agents         || {};
+  parsed.agents.defaults                = parsed.agents.defaults || {};
+  parsed.agents.defaults.workspace      = WORKSPACE;
+  parsed.env                            = parsed.env            || {};
+  parsed.env.vars                       = buildEnvVars();
+
+  if (token) {
+    parsed.channels = {
+      telegram: {
+        enabled:  true,
+        accounts: { main: { botToken: token, apiRoot: "https://api.telegram.org" } }
+      }
+    };
+  }
+
+  fs.copyFileSync(CONFIG_PATH, CONFIG_PATH + ".bak");
+  fs.writeFileSync(CONFIG_PATH, JSON.stringify(parsed, null, 2), "utf-8");
+  console.log("[setup] Patched existing config (user settings preserved)");
+  console.log("[setup]   workspace = " + WORKSPACE);
+  console.log("[setup]   env.vars  = " + providerKeys.length);
+  return;
+}
+}
+
+// –– FRESH MODE: no config or invalid config ––––
+console.log("[setup] No valid config found - writing fresh template");
+
+var config = {
+gateway: {
+auth: buildAuth(),
+controlUi: {
+allowInsecureAuth:                        true,
+allowedOrigins:                           ["*"],
+dangerouslyDisableDeviceAuth:             true,
+dangerouslyAllowHostHeaderOriginFallback: true
+},
+trustedProxies: trustedProxies
+},
+agents: {
+defaults: { model: defaultModel, workspace: WORKSPACE }
+},
+env: { vars: buildEnvVars() }
+};
+
+if (token) {
+config.channels = {
+telegram: {
+enabled:  true,
+accounts: { main: { botToken: token, apiRoot: "https://api.telegram.org" } }
+}
+};
 }
-fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
 
+fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
 console.log("[setup] Done.");
 console.log("[setup]   auth      = " + (gatewayToken ? "token" : "password"));
 console.log("[setup]   model     = " + defaultModel);
 console.log("[setup]   workspace = " + WORKSPACE);
 console.log("[setup]   proxies   = " + trustedProxies.length);
 console.log("[setup]   env.vars  = " + providerKeys.length);
-console.log("[setup]   config    = " + CONFIG_PATH);
 })().catch(function(e) {
 console.error("[setup] Fatal: " + e.message);
 process.exit(0);