Preserve venv pip behavior with Jupyter defaults

Dockerfile

@@ -34,6 +34,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     procps \
     python3 \
     python3-pip \
+    python3-venv \
     p7zip-full \
     chromium \
     libnss3 \
@@ -60,16 +61,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     pip3 install --no-cache-dir --break-system-packages huggingface_hub hf_transfer && \
     rm -rf /var/lib/apt/lists/*
 
-# Install JupyterLab only when DEV_MODE is enabled (build-time)
-# This avoids installing large packages when terminal is not needed
-RUN if [ "${DEV_MODE}" = "true" ] || [ "${DEV_MODE}" = "1" ] || [ "${DEV_MODE}" = "yes" ] || [ "${DEV_MODE}" = "on" ]; then \
-      pip3 install --no-cache-dir --break-system-packages \
-        jupyterlab==4.5.7 \
-        tornado==6.5.5 \
-        ipywidgets==8.1.8 && \
-      # Copy login template into jupyter_server templates dir
-      python3 -c "from pathlib import Path; import shutil, jupyter_server; d=Path(jupyter_server.__file__).parent/'templates'; d.mkdir(parents=True,exist_ok=True); shutil.copyfile('/home/node/app/login.html', d/'login.html')" || true; \
-    fi
+# Install JupyterLab at build time because start.sh can auto-enable the
+# terminal at runtime when GATEWAY_TOKEN is present. If the dependency is only
+# installed when the build arg DEV_MODE=true, the documented default path
+# starts a terminal process that cannot import jupyterlab.
+RUN pip3 install --no-cache-dir --break-system-packages \
+      jupyterlab==4.5.7 \
+      tornado==6.5.5 \
+      ipywidgets==8.1.8
 
 # Reuse existing node user (UID 1000). Allow passwordless package-manager
 # commands only so runtime apt installs can be replayed after HF Space restarts.
@@ -110,7 +109,7 @@ COPY --chown=1000:1000 env-builder.html /home/node/app/env-builder.html
 COPY --chown=1000:1000 env-builder.js /home/node/app/env-builder.js
 COPY --chown=1000:1000 key-rotator-manager.html /home/node/app/key-rotator-manager.html
 COPY --chown=1000:1000 jupyter-devdata-sync.py /home/node/app/jupyter-devdata-sync.py
-# login.html template is now copied inside the DEV_MODE install block above
+RUN python3 -c "from pathlib import Path; import shutil, jupyter_server; d=Path(jupyter_server.__file__).parent/'templates'; d.mkdir(parents=True,exist_ok=True); shutil.copyfile('/home/node/app/login.html', d/'login.html')"
 RUN chmod +x /home/node/app/start.sh \
               /home/node/app/cloudflare-proxy-setup.py \
               /home/node/app/cloudflare-keepalive-setup.py \
@@ -122,6 +121,8 @@ USER node
 
 ENV HOME=/home/node \
     OPENCLAW_VERSION=${OPENCLAW_VERSION} \
+    PIP_BREAK_SYSTEM_PACKAGES=1 \
+    PYTHONUSERBASE=/home/node/.local \
     PATH=/home/node/.local/bin:/usr/local/bin:$PATH \
     NODE_PATH=/home/node/browser-deps/node_modules \
     NODE_OPTIONS="--require /opt/cloudflare-proxy.js"

health-server.js

@@ -263,7 +263,22 @@ function escapeHtml(v) {
 
 function parseCookies(req) {
   const h = req.headers.cookie || "";
-  return Object.fromEntries(h.split(";").map(c => c.trim().split("=")).filter(p => p.length >= 2).map(([k, ...v]) => [k.trim(), decodeURIComponent(v.join("=").trim())]));
+  const cookies = {};
+  for (const rawCookie of h.split(";")) {
+    const parts = rawCookie.trim().split("=");
+    if (parts.length < 2) continue;
+    const key = parts.shift().trim();
+    if (!key) continue;
+    const rawValue = parts.join("=").trim();
+    try {
+      cookies[key] = decodeURIComponent(rawValue);
+    } catch {
+      // Browsers and crawlers can send malformed percent-encoded cookie values.
+      // Treat that single cookie as unusable instead of letting URIError crash
+      // the dashboard/auth reverse proxy.
+    }
+  }
+  return cookies;
 }
 
 // Constant-time comparison using crypto — prevent timing attacks
@@ -1119,6 +1134,7 @@ server.on("upgrade", (req, socket, head) => {
       const header = req.rawHeaders[i];
       const lower = header.toLowerCase();
       if (["host", "x-forwarded-for", "x-forwarded-host", "x-forwarded-proto", "x-forwarded-prefix"].includes(lower)) continue;
+      if (lower === "authorization" && isApp && bridgeGatewayAuth && GATEWAY_TOKEN) continue;
       ps.write(`${header}: ${req.rawHeaders[i + 1]}\r\n`);
     }
     ps.write("\r\n");

jupyter-devdata-sync.py

@@ -9,6 +9,7 @@ HF_USERNAME = os.environ.get("HF_USERNAME", "").strip() or os.environ.get("SPACE
 DATASET_NAME = os.environ.get("DEVDATA_DATASET_NAME", "").strip() or "huggingclaw-devdata"
 BACKUP_DATASET_NAME = os.environ.get("BACKUP_DATASET_NAME", "").strip() or os.environ.get("BACKUP_DATASET", "").strip() or "huggingclaw-backup"
 JUPYTER_ROOT = Path(os.environ.get("JUPYTER_ROOT_DIR", "/home/node")).resolve()
+JUPYTER_PORT = int((os.environ.get("JUPYTER_PORT", "").strip() or "8888"))
 INTERVAL = int((os.environ.get("DEVDATA_SYNC_INTERVAL", "").strip() or "180"))
 # BUG FIX #5: Respect max file size so giant files don't stall uploads.
 # Matches the 50 MB ceiling in openclaw-sync.py; override with DEVDATA_MAX_FILE_BYTES.
@@ -438,7 +439,7 @@ if __name__ == "__main__":
 
     # Normal background sync mode — no restore; go straight to upload loop.
     validate_jupyter_paths()
-    if is_jupyter_running():
+    if is_jupyter_running(JUPYTER_PORT):
         print("DevData: background sync started (JupyterLab is live, restore already done by --restore).")
     else:
         # Fallback: JupyterLab not detected.  Should not normally happen
@@ -446,6 +447,6 @@ if __name__ == "__main__":
         # waits for the gateway before launching this background process.
         # Log a warning and proceed to sync; do NOT restore to avoid racing
         # with a JupyterLab that may be in the middle of starting up.
-        print("DevData: WARNING — JupyterLab not detected on port 8888. Skipping restore to be safe; starting sync loop.")
+        print(f"DevData: WARNING — JupyterLab not detected on port {JUPYTER_PORT}. Skipping restore to be safe; starting sync loop.")
 
     sync_loop(api, rid)

start.sh

@@ -504,6 +504,13 @@ chmod 700 /home/node/.openclaw/credentials
 export NPM_CONFIG_PREFIX="${NPM_CONFIG_PREFIX:-/home/node/.local}"
 export npm_config_prefix="$NPM_CONFIG_PREFIX"
 export PYTHONUSERBASE="${PYTHONUSERBASE:-/home/node/.local}"
+# Debian/Ubuntu images mark system Python as externally managed (PEP 668).
+# JupyterLab's PyPI extension manager runs pip from the server process, so it
+# does not see the interactive shell wrappers below. Allow that non-interactive
+# pip to install into node's user site instead of failing with
+# "externally-managed-environment".
+export PIP_BREAK_SYSTEM_PACKAGES="${PIP_BREAK_SYSTEM_PACKAGES:-1}"
+export PIP_USER="${PIP_USER:-1}"
 export DEBIAN_FRONTEND="${DEBIAN_FRONTEND:-noninteractive}"
 # Show current working directory in terminal prompt (JupyterLab terminals can
 # otherwise display only "$" when PS1 is unset/minimal).
@@ -1665,8 +1672,13 @@ start_jupyter_once() {
   echo "Terminal  : starting (root: $JUPYTER_ROOT_DIR)"
   JUPYTER_LOG_FILE="/tmp/jupyterlab.log"
   
-  # Use explicit Python to avoid PATH issues; set memory-friendly limits
+  # Use explicit Python to avoid PATH issues; set memory-friendly limits.
+  # Keep pip user-site defaults in this process so JupyterLab's PyPI Manager
+  # can install extensions/packages under /home/node/.local on PEP 668 images.
   export PYTHONPATH=""
+  export PYTHONUSERBASE="${PYTHONUSERBASE:-/home/node/.local}"
+  export PIP_BREAK_SYSTEM_PACKAGES="${PIP_BREAK_SYSTEM_PACKAGES:-1}"
+  export PIP_USER="${PIP_USER:-1}"
   hc_env_without_gateway_preloads python3 -m jupyterlab \
       --ip 127.0.0.1 \
       --port "$JUPYTER_PORT" \
@@ -1740,6 +1752,13 @@ export PATH="/home/node/.local/bin:$PATH"
 export NPM_CONFIG_PREFIX="${NPM_CONFIG_PREFIX:-/home/node/.local}"
 export npm_config_prefix="$NPM_CONFIG_PREFIX"
 export PYTHONUSERBASE="${PYTHONUSERBASE:-/home/node/.local}"
+# Debian/Ubuntu images mark system Python as externally managed (PEP 668).
+# JupyterLab's PyPI extension manager runs pip from the server process, so it
+# does not see the interactive shell wrappers below. Allow that non-interactive
+# pip to install into node's user site instead of failing with
+# "externally-managed-environment".
+export PIP_BREAK_SYSTEM_PACKAGES="${PIP_BREAK_SYSTEM_PACKAGES:-1}"
+export PIP_USER="${PIP_USER:-1}"
 export DEBIAN_FRONTEND="${DEBIAN_FRONTEND:-noninteractive}"
 export HISTFILE="${HISTFILE:-/home/node/.bash_history}"
 export HISTSIZE="${HISTSIZE:-50000}"
@@ -1958,6 +1977,8 @@ sudo() {
 pip() {
   if [ "${1:-}" = "install" ] && [ -z "${VIRTUAL_ENV:-}" ] && ! _hc_has_arg --user "$@" && ! _hc_has_arg --prefix "$@"; then
     command pip install --user --break-system-packages "${@:2}"
+  elif [ -n "${VIRTUAL_ENV:-}" ]; then
+    env -u PIP_USER pip "$@"
   else
     command pip "$@"
   fi
@@ -1973,6 +1994,8 @@ pip() {
 pip3() {
   if [ "${1:-}" = "install" ] && [ -z "${VIRTUAL_ENV:-}" ] && ! _hc_has_arg --user "$@" && ! _hc_has_arg --prefix "$@"; then
     command pip3 install --user --break-system-packages "${@:2}"
+  elif [ -n "${VIRTUAL_ENV:-}" ]; then
+    env -u PIP_USER pip3 "$@"
   else
     command pip3 "$@"
   fi
@@ -1987,6 +2010,8 @@ pip3() {
 python() {
   if [ "${1:-}" = "-m" ] && [ "${2:-}" = "pip" ] && [ "${3:-}" = "install" ] && [ -z "${VIRTUAL_ENV:-}" ] && ! _hc_has_arg --user "${@:3}" && ! _hc_has_arg --prefix "${@:3}"; then
     command python -m pip install --user --break-system-packages "${@:4}"
+  elif [ "${1:-}" = "-m" ] && [ "${2:-}" = "pip" ] && [ -n "${VIRTUAL_ENV:-}" ]; then
+    env -u PIP_USER python "$@"
   else
     command python "$@"
   fi
@@ -2001,6 +2026,8 @@ python() {
 python3() {
   if [ "${1:-}" = "-m" ] && [ "${2:-}" = "pip" ] && [ "${3:-}" = "install" ] && [ -z "${VIRTUAL_ENV:-}" ] && ! _hc_has_arg --user "${@:3}" && ! _hc_has_arg --prefix "${@:3}"; then
     command python3 -m pip install --user --break-system-packages "${@:4}"
+  elif [ "${1:-}" = "-m" ] && [ "${2:-}" = "pip" ] && [ -n "${VIRTUAL_ENV:-}" ]; then
+    env -u PIP_USER python3 "$@"
   else
     command python3 "$@"
   fi