Update entrypoint.sh

entrypoint.sh

@@ -1,18 +1,77 @@
 #!/bin/sh
 
+# OpenClaw HF Spaces - Production Entrypoint
+
+# 
+
+# SETUP_MARKER lives in /tmp.
+
+# /tmp is wiped on container restart but survives gateway restart.
+
+# So setup only runs once per container lifetime.
+
+SETUP_MARKER="/tmp/.openclaw-setup-done"
+
+# -- resolve writable home --------------------------------
+
+if mkdir -p /data/.openclaw 2>/dev/null; then
+    export OPENCLAW_HOME=/data
+else
+    export OPENCLAW_HOME=/home/user
+    mkdir -p /home/user/.openclaw
+fi
 echo "[entrypoint] OPENCLAW_HOME=$OPENCLAW_HOME"
 
-# 只导出 keys
+# -- dynamic provider key export --------------------------
+
 for VAR in $(env | cut -d= -f1); do
-  case "$VAR" in
-    *_API_KEY|*_SECRET_KEY|*_ACCESS_TOKEN|*_BOT_TOKEN) 
-      VAL=$(printenv "$VAR" 2>/dev/null || true)
-      if [ -n "$VAL" ]; then export "$VAR"; echo "[entrypoint] exported: $VAR"; fi
-      ;;
-  esac
+    case "$VAR" in
+        OPENCLAW_*|SPACE_*|SYSTEM_*|HF_*|NODE_*|npm_*) continue ;;
+    esac
+    case "$VAR" in
+        *_API_KEY|*_SECRET_KEY|*_ACCESS_TOKEN|*_BOT_TOKEN|*_AUTH_TOKEN|*_APP_KEY)
+            VAL=$(printenv "$VAR" 2>/dev/null || true)
+            if [ -n "$VAL" ]; then
+                export "$VAR"
+                echo "[entrypoint] exported: $VAR"
+            fi
+        ;;
+    esac
 done
 
-echo "[entrypoint] Setup skipped for clean test"
-echo "[entrypoint] Starting gateway directly..."
+export HF_TOKEN="${HF_TOKEN:-}"
+
+# -- run setup only on first boot -------------------------
+
+# Gateway restart reuses /tmp, so marker survives -> setup skipped.
+
+# Container restart wipes /tmp, marker gone -> setup runs once.
+
+if [ ! -f "$SETUP_MARKER" ]; then
+    echo "[entrypoint] First boot - running setup…"
+    node /app/spaces/huggingface/setup-hf-config.mjs || true
+    touch "$SETUP_MARKER"
+    echo "[entrypoint] Setup done (marker created)"
+else
+    echo "[entrypoint] Gateway restart - setup skipped (settings preserved)"
+fi
+
+# -- security audit (non-fatal) --------------------------
+
+if [ -f /app/security-check.sh ]; then
+    sh /app/security-check.sh || true
+fi
+
+# -- start sync manager in background ---------------------
+
+if [ -f /app/hf-sync-manager.mjs ]; then
+    (node /app/hf-sync-manager.mjs &)
+    echo "[entrypoint] Sync manager started"
+fi
+
+echo "[entrypoint] Starting gateway…"
 
-exec node /app/openclaw.mjs gateway --allow-unconfigured --bind lan --port 7860
+exec node /app/openclaw.mjs gateway \
+    --allow-unconfigured \
+    --bind lan \
+    --port 7860