Update scripts/openclaw-entrypoint.sh

scripts/openclaw-entrypoint.sh

@@ -1,10 +1,11 @@
+
 #!/usr/bin/env bash
 set -euo pipefail
 
 OPENCLAW_USER="${OPENCLAW_USER:-root}"
 OPENCLAW_GROUP="${OPENCLAW_GROUP:-root}"
 OPENCLAW_HOME="${OPENCLAW_HOME:-/root}"
-OPENCLAW_STATE_DIR="${OPENCLAW_STATE_DIR:-/root}"
+OPENCLAW_STATE_DIR="${OPENCLAW_STATE_DIR:-/root/.openclaw}"
 OPENCLAW_CONFIG_PATH="${OPENCLAW_CONFIG_PATH:-${OPENCLAW_STATE_DIR}/openclaw.json}"
 OPENCLAW_WORKSPACE_DIR="${OPENCLAW_WORKSPACE_DIR:-${OPENCLAW_STATE_DIR}/workspace}"
 OPENCLAW_GATEWAY_BIND="${OPENCLAW_GATEWAY_BIND:-lan}"
@@ -44,12 +45,21 @@ export OPENCLAW_BACKUP_ENV_FILE_PATH
 OPENCLAW_STEP_INDEX=0
 OPENCLAW_ENTRYPOINT_TAG="openclaw-entrypoint"
 
-timestamp_utc() { date -u +"%Y-%m-%dT%H:%M:%SZ"; }
-log_info() { printf '[%s] %s: %s\n' "$(timestamp_utc)" "$OPENCLAW_ENTRYPOINT_TAG" "$*"; }
-log_warn() { printf '[%s] %s: %s\n' "$(timestamp_utc)" "$OPENCLAW_ENTRYPOINT_TAG" "$*" >&2; }
+timestamp_utc() {
+  date -u +"%Y-%m-%dT%H:%M:%SZ"
+}
+
+log_info() {
+  printf '[%s] %s: %s\n' "$(timestamp_utc)" "$OPENCLAW_ENTRYPOINT_TAG" "$*"
+}
+
+log_warn() {
+  printf '[%s] %s: %s\n' "$(timestamp_utc)" "$OPENCLAW_ENTRYPOINT_TAG" "$*" >&2
+}
 
 run_step() {
-  local description="$1"; shift
+  local description="$1"
+  shift
   OPENCLAW_STEP_INDEX=$((OPENCLAW_STEP_INDEX + 1))
   log_info "step ${OPENCLAW_STEP_INDEX} start: ${description}"
   "$@"
@@ -57,7 +67,8 @@ run_step() {
 }
 
 is_true() {
-  local value; value="$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')"
+  local value
+  value="$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')"
   [[ "$value" == "1" || "$value" == "true" || "$value" == "yes" || "$value" == "on" ]]
 }
 
@@ -66,7 +77,8 @@ generate_gateway_token() {
     openssl rand -hex 32
   else
     python3 - <<'PY'
-import secrets; print(secrets.token_hex(32))
+import secrets
+print(secrets.token_hex(32))
 PY
   fi
 }
@@ -83,22 +95,41 @@ mkdir_state_dirs() {
 
 fix_permissions() {
   local path
-  [[ "$(id -u)" -ne 0 ]] && return 0
-  [[ -e "$OPENCLAW_HOME" ]] && chown "$OPENCLAW_USER:$OPENCLAW_GROUP" "$OPENCLAW_HOME"
-  for path in "$OPENCLAW_STATE_DIR" "$OPENCLAW_WORKSPACE_DIR" "$OPENCLAW_STDOUT_LOG_PATH" "$OPENCLAW_STDERR_LOG_PATH" "$(dirname "$OPENCLAW_STDOUT_LOG_PATH")" "$(dirname "$OPENCLAW_STDERR_LOG_PATH")"; do
-    [[ -e "$path" ]] && chown -R "$OPENCLAW_USER:$OPENCLAW_GROUP" "$path"
+
+  if [[ "$(id -u)" -ne 0 ]]; then
+    return 0
+  fi
+
+  if [[ -e "$OPENCLAW_HOME" ]]; then
+    chown "$OPENCLAW_USER:$OPENCLAW_GROUP" "$OPENCLAW_HOME"
+  fi
+
+  for path in \
+    "$OPENCLAW_STATE_DIR" \
+    "$OPENCLAW_WORKSPACE_DIR" \
+    "$OPENCLAW_STDOUT_LOG_PATH" \
+    "$OPENCLAW_STDERR_LOG_PATH" \
+    "$(dirname "$OPENCLAW_STDOUT_LOG_PATH")" \
+    "$(dirname "$OPENCLAW_STDERR_LOG_PATH")"; do
+    if [[ -e "$path" ]]; then
+      chown -R "$OPENCLAW_USER:$OPENCLAW_GROUP" "$path"
+    fi
   done
 }
 
 write_or_update_config() {
-  local existing_token=""
+  local existing_token
+  existing_token=""
+
   if [[ -f "$OPENCLAW_CONFIG_PATH" ]]; then
     existing_token="$(python3 - <<'PY'
-import json, os
+import json
+import os
+
 config_path = os.environ["OPENCLAW_CONFIG_PATH"]
 try:
-    with open(config_path) as f:
-        cfg = json.load(f)
+    with open(config_path, "r", encoding="utf-8") as fh:
+        cfg = json.load(fh)
     token = cfg.get("gateway", {}).get("auth", {}).get("token", "")
     if isinstance(token, str):
         print(token.strip())
@@ -107,8 +138,13 @@ except Exception:
 PY
 )"
   fi
+
   if [[ -z "${OPENCLAW_GATEWAY_TOKEN:-}" ]]; then
-    [[ -n "$existing_token" ]] && OPENCLAW_GATEWAY_TOKEN="$existing_token" || OPENCLAW_GATEWAY_TOKEN="$(generate_gateway_token)"
+    if [[ -n "$existing_token" ]]; then
+      OPENCLAW_GATEWAY_TOKEN="$existing_token"
+    else
+      OPENCLAW_GATEWAY_TOKEN="$(generate_gateway_token)"
+    fi
   fi
   export OPENCLAW_GATEWAY_TOKEN
 
@@ -129,13 +165,19 @@ PY
   OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_DISABLE_DEVICE_AUTH="$OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_DISABLE_DEVICE_AUTH" \
   OPENCLAW_INIT_CONTROL_UI_ALLOWED_ORIGINS="${OPENCLAW_INIT_CONTROL_UI_ALLOWED_ORIGINS:-}" \
   python3 - <<'PY'
-import json, os, sys
+import json
+import os
+import sys
 from pathlib import Path
+
 config_path = Path(os.environ["OPENCLAW_CONFIG_PATH"])
 config = {}
 if config_path.exists():
-    try: config = json.loads(config_path.read_text(encoding="utf-8"))
-    except Exception: config = {}
+    try:
+        config = json.loads(config_path.read_text(encoding="utf-8"))
+    except Exception:
+        config = {}
+
 provider = os.environ.get("OPENCLAW_LLM_PROVIDER", "thirdparty").strip() or "thirdparty"
 model = (os.environ.get("OPENCLAW_LLM_MODEL") or "").strip()
 api = os.environ.get("OPENCLAW_LLM_API", "openai-completions").strip() or "openai-completions"
@@ -143,39 +185,104 @@ base_env_name = os.environ.get("OPENCLAW_LLM_BASE_URL_ENV", "OPENCLAW_LLM_BASE_U
 key_env_name = os.environ.get("OPENCLAW_LLM_API_KEY_ENV", "OPENCLAW_LLM_API_KEY").strip() or "OPENCLAW_LLM_API_KEY"
 base_url_value = (os.environ.get(base_env_name) or "").strip()
 api_key_value = (os.environ.get(key_env_name) or "").strip()
+
 missing_llm_env = []
-if not model: missing_llm_env.append("OPENCLAW_LLM_MODEL")
-if not base_url_value: missing_llm_env.append(base_env_name)
-if not api_key_value: missing_llm_env.append(key_env_name)
+if not model:
+    missing_llm_env.append("OPENCLAW_LLM_MODEL")
+if not base_url_value:
+    missing_llm_env.append(base_env_name)
+if not api_key_value:
+    missing_llm_env.append(key_env_name)
 custom_llm_ready = not missing_llm_env
 model_ref = f"{provider}/{model}" if custom_llm_ready else ""
+
 if missing_llm_env:
-    print("openclaw: skip custom LLM model configuration because missing: " + ", ".join(missing_llm_env), file=sys.stderr)
+    print(
+        "openclaw: skip custom LLM model configuration because missing: "
+        + ", ".join(missing_llm_env),
+        file=sys.stderr,
+    )
+    sshx_auto_start = (os.environ.get("OPENCLAW_SSHX_AUTO_START") or "false").strip().lower() in {
+        "1",
+        "true",
+        "yes",
+        "on",
+    }
+    if not sshx_auto_start:
+        print(
+            "openclaw: if you want to configure LLM via sshx, consider setting OPENCLAW_SSHX_AUTO_START=true",
+            file=sys.stderr,
+        )
+
 fallback_allowed_origins = [f"http://127.0.0.1:{os.environ.get('OPENCLAW_GATEWAY_PORT', '7860')}"]
 allowed_origins = fallback_allowed_origins
 raw_allowed_origins = (os.environ.get("OPENCLAW_INIT_CONTROL_UI_ALLOWED_ORIGINS") or "").strip()
 if raw_allowed_origins:
     try:
         parsed = json.loads(raw_allowed_origins)
-        if isinstance(parsed, list) and parsed:
-            allowed_origins = [v.strip() for v in parsed if isinstance(v, str) and v.strip()]
-    except Exception: pass
-fallback_origin = (os.environ.get("OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_ALLOW_HOST_HEADER_ORIGIN_FALLBACK") or "true").lower() in {"1", "true", "yes", "on"}
-allow_insecure_auth = (os.environ.get("OPENCLAW_GATEWAY_CONTROLUI_ALLOW_INSECURE_AUTH") or "false").lower() in {"1", "true", "yes", "on"}
-disable_device_auth = (os.environ.get("OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_DISABLE_DEVICE_AUTH") or "false").lower() in {"1", "true", "yes", "on"}
-gateway = config.get("gateway", {})
+        if isinstance(parsed, list):
+            normalized = []
+            for value in parsed:
+                if isinstance(value, str):
+                    item = value.strip()
+                    if item:
+                        normalized.append(item)
+            if normalized:
+                allowed_origins = normalized
+    except Exception:
+        pass
+
+fallback_origin = (os.environ.get("OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_ALLOW_HOST_HEADER_ORIGIN_FALLBACK") or "true").lower() in {
+    "1",
+    "true",
+    "yes",
+    "on",
+}
+allow_insecure_auth = (os.environ.get("OPENCLAW_GATEWAY_CONTROLUI_ALLOW_INSECURE_AUTH") or "false").lower() in {
+    "1",
+    "true",
+    "yes",
+    "on",
+}
+disable_device_auth = (os.environ.get("OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_DISABLE_DEVICE_AUTH") or "false").lower() in {
+    "1",
+    "true",
+    "yes",
+    "on",
+}
+
+gateway = config.get("gateway")
+if not isinstance(gateway, dict):
+    gateway = {}
 gateway["mode"] = os.environ.get("OPENCLAW_INIT_GATEWAY_MODE", "local")
 gateway["bind"] = os.environ.get("OPENCLAW_GATEWAY_BIND", "lan")
-auth = gateway.get("auth", {})
+auth = gateway.get("auth")
+if not isinstance(auth, dict):
+    auth = {}
+
 token_value = (os.environ.get("OPENCLAW_GATEWAY_TOKEN") or "").strip()
 password_value = (os.environ.get("OPENCLAW_GATEWAY_PASSWORD") or "").strip()
-if token_value: auth["token"] = token_value
-if password_value: auth["password"] = password_value
+if token_value:
+    auth["token"] = token_value
+if password_value:
+    auth["password"] = password_value
+
 valid_auth_modes = {"none", "token", "password", "trusted-proxy"}
 mode_env = (os.environ.get("OPENCLAW_GATEWAY_AUTH_MODE") or "").strip().lower()
-if mode_env in valid_auth_modes: auth["mode"] = mode_env
-elif password_value and not token_value: auth["mode"] = "password"
-elif token_value: auth["mode"] = "token"
+existing_mode = auth.get("mode")
+if mode_env in valid_auth_modes:
+    auth["mode"] = mode_env
+elif password_value and not token_value:
+    auth["mode"] = "password"
+elif token_value and not password_value:
+    auth["mode"] = "token"
+elif token_value and password_value:
+    auth["mode"] = "token"
+elif isinstance(existing_mode, str) and existing_mode.strip().lower() in valid_auth_modes:
+    auth["mode"] = existing_mode.strip().lower()
+else:
+    auth["mode"] = "token"
+
 gateway["auth"] = auth
 gateway.setdefault("controlUi", {})
 gateway["controlUi"]["allowedOrigins"] = allowed_origins
@@ -183,20 +290,34 @@ gateway["controlUi"]["dangerouslyAllowHostHeaderOriginFallback"] = fallback_orig
 gateway["controlUi"]["allowInsecureAuth"] = allow_insecure_auth
 gateway["controlUi"]["dangerouslyDisableDeviceAuth"] = disable_device_auth
 config["gateway"] = gateway
-agents = config.get("agents", {})
-defaults = agents.get("defaults", {})
+
+agents = config.get("agents")
+if not isinstance(agents, dict):
+    agents = {}
+defaults = agents.get("defaults")
+if not isinstance(defaults, dict):
+    defaults = {}
 if custom_llm_ready:
     defaults["model"] = {"primary": model_ref}
-    allow_models = defaults.get("models", {})
+    allow_models = defaults.get("models")
+    if not isinstance(allow_models, dict):
+        allow_models = {}
     allow_models.setdefault(model_ref, {"alias": "Default"})
     defaults["models"] = allow_models
 agents["defaults"] = defaults
 config["agents"] = agents
+
 if custom_llm_ready:
-    models_cfg = config.get("models", {})
+    models_cfg = config.get("models")
+    if not isinstance(models_cfg, dict):
+        models_cfg = {}
     models_cfg["mode"] = "merge"
-    providers = models_cfg.get("providers", {})
-    provider_cfg = providers.get(provider, {})
+    providers = models_cfg.get("providers")
+    if not isinstance(providers, dict):
+        providers = {}
+    provider_cfg = providers.get(provider)
+    if not isinstance(provider_cfg, dict):
+        provider_cfg = {}
     provider_cfg["baseUrl"] = f"${{{base_env_name}}}"
     provider_cfg["apiKey"] = f"${{{key_env_name}}}"
     provider_cfg["api"] = api
@@ -204,18 +325,46 @@ if custom_llm_ready:
     providers[provider] = provider_cfg
     models_cfg["providers"] = providers
     config["models"] = models_cfg
+
+# ====== FEISHU CHANNEL CONFIGURATION ======
 feishu_app_id = (os.environ.get("FEISHU_APP_ID") or "").strip()
 feishu_app_secret = (os.environ.get("FEISHU_APP_SECRET") or "").strip()
+feishu_domain = (os.environ.get("FEISHU_DOMAIN") or "feishu").strip()
+
 if feishu_app_id and feishu_app_secret:
-    channels_cfg = config.get("channels", {})
-    feishu_cfg = channels_cfg.get("feishu", {})
-    feishu_cfg.update({"enabled": True, "domain": (os.environ.get("FEISHU_DOMAIN") or "feishu").strip(), "connectionMode": "websocket", "defaultAccount": "default", "dmPolicy": "open", "groupPolicy": "open"})
-    accounts = feishu_cfg.get("accounts", {})
-    accounts["default"] = {"appId": feishu_app_id, "appSecret": feishu_app_secret}
+    channels_cfg = config.get("channels")
+    if not isinstance(channels_cfg, dict):
+        channels_cfg = {}
+    
+    feishu_cfg = channels_cfg.get("feishu")
+    if not isinstance(feishu_cfg, dict):
+        feishu_cfg = {}
+    
+    feishu_cfg["enabled"] = True
+    feishu_cfg["domain"] = feishu_domain
+    feishu_cfg["connectionMode"] = "websocket"
+    feishu_cfg["defaultAccount"] = "default"
+    feishu_cfg["dmPolicy"] = "open"
+    feishu_cfg["groupPolicy"] = "open"
+    
+    accounts = feishu_cfg.get("accounts")
+    if not isinstance(accounts, dict):
+        accounts = {}
+    
+    default_account = accounts.get("default")
+    if not isinstance(default_account, dict):
+        default_account = {}
+    
+    default_account["appId"] = feishu_app_id
+    default_account["appSecret"] = feishu_app_secret
+    
+    accounts["default"] = default_account
     feishu_cfg["accounts"] = accounts
     channels_cfg["feishu"] = feishu_cfg
     config["channels"] = channels_cfg
+    
     print(f"openclaw: configured feishu channel with app_id={feishu_app_id[:10]}...")
+
 config_path.parent.mkdir(parents=True, exist_ok=True)
 config_path.write_text(json.dumps(config, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
 os.chmod(config_path, 0o600)
@@ -223,111 +372,227 @@ PY
 }
 
 write_backup_env_file() {
-  local backup_env_file="/etc/openclaw-backup.env"
-  [[ "$(id -u)" -ne 0 ]] && backup_env_file="${OPENCLAW_STATE_DIR}/openclaw-backup.env"
+  local backup_env_file
+  local keys=(
+    HF_TOKEN
+    HUGGINGFACE_HUB_TOKEN
+    OPENCLAW_BACKUP_DATASET_REPO
+    OPENCLAW_BACKUP_REPO_TYPE
+    OPENCLAW_BACKUP_PATH_PREFIX
+    OPENCLAW_BACKUP_LATEST_NAME
+    OPENCLAW_BACKUP_KEEP_COUNT
+    OPENCLAW_BACKUP_PRIVATE
+    OPENCLAW_BACKUP_WORK_DIR
+    OPENCLAW_BACKUP_SOURCE_DIR
+    OPENCLAW_BACKUP_ROOT_CONFIG_DIR
+    OPENCLAW_BACKUP_ROOT_CODEX_DIR
+    OPENCLAW_BACKUP_ROOT_CLAUDE_DIR
+    OPENCLAW_BACKUP_ROOT_AGENTS_DIR
+    OPENCLAW_BACKUP_ROOT_SSH_DIR
+    OPENCLAW_BACKUP_ROOT_NPM_DIR
+    OPENCLAW_BACKUP_ROOT_LARK_CLI_DIR
+    OPENCLAW_STATE_DIR
+  )
+
+  backup_env_file="${OPENCLAW_BACKUP_ENV_FILE_PATH:-/etc/openclaw-backup.env}"
+  if [[ "$(id -u)" -ne 0 && "$backup_env_file" == "/etc/openclaw-backup.env" ]]; then
+    backup_env_file="${OPENCLAW_STATE_DIR}/openclaw-backup.env"
+  fi
+
   mkdir -p "$(dirname "$backup_env_file")"
-  : > "$backup_env_file"
-  for key in HF_TOKEN HUGGINGFACE_HUB_TOKEN OPENCLAW_BACKUP_DATASET_REPO OPENCLAW_BACKUP_REPO_TYPE OPENCLAW_BACKUP_PATH_PREFIX OPENCLAW_BACKUP_LATEST_NAME OPENCLAW_BACKUP_KEEP_COUNT OPENCLAW_BACKUP_PRIVATE OPENCLAW_BACKUP_WORK_DIR OPENCLAW_BACKUP_SOURCE_DIR OPENCLAW_BACKUP_ROOT_CONFIG_DIR OPENCLAW_BACKUP_ROOT_CODEX_DIR OPENCLAW_BACKUP_ROOT_CLAUDE_DIR OPENCLAW_BACKUP_ROOT_AGENTS_DIR OPENCLAW_BACKUP_ROOT_SSH_DIR OPENCLAW_BACKUP_ROOT_NPM_DIR OPENCLAW_BACKUP_ROOT_LARK_CLI_DIR OPENCLAW_STATE_DIR; do
+  if ! : > "$backup_env_file"; then
+    echo "openclaw: cannot write backup env file at $backup_env_file" >&2
+    return 1
+  fi
+
+  for key in "${keys[@]}"; do
     printf '%s=%q\n' "$key" "${!key:-}" >> "$backup_env_file"
   done
   OPENCLAW_BACKUP_ENV_FILE_PATH="$backup_env_file"
   export OPENCLAW_BACKUP_ENV_FILE_PATH
-  [[ "$(id -u)" -eq 0 ]] && chown "$OPENCLAW_USER:$OPENCLAW_GROUP" "$backup_env_file" && chmod 640 "$backup_env_file" || chmod 600 "$backup_env_file"
+
+  if [[ "$(id -u)" -eq 0 ]]; then
+    chown "$OPENCLAW_USER:$OPENCLAW_GROUP" "$backup_env_file"
+    chmod 640 "$backup_env_file"
+  else
+    chmod 600 "$backup_env_file"
+  fi
 }
 
 setup_backup_cron() {
-  [[ "$(id -u)" -ne 0 ]] && echo "openclaw: backup cron requires root; skip" >&2 && return 0
-  is_true "$OPENCLAW_BACKUP_ENABLED" || return 0
-  [[ -z "${OPENCLAW_BACKUP_DATASET_REPO:-}" ]] && echo "openclaw: backup enabled but OPENCLAW_BACKUP_DATASET_REPO is empty; skip cron" >&2 && return 0
-  write_backup_env_file || { echo "openclaw: backup env file unavailable; skip cron" >&2; return 0; }
-  cat > /etc/cron.d/openclaw-backup <<CRON
+  if [[ "$(id -u)" -ne 0 ]]; then
+    echo "openclaw: backup cron requires root; skip cron setup" >&2
+    return 0
+  fi
+
+  if ! is_true "$OPENCLAW_BACKUP_ENABLED"; then
+    return 0
+  fi
+
+  if [[ -z "${OPENCLAW_BACKUP_DATASET_REPO:-}" ]]; then
+    echo "openclaw: backup enabled but OPENCLAW_BACKUP_DATASET_REPO is empty; skip cron" >&2
+    return 0
+  fi
+
+  if ! write_backup_env_file; then
+    echo "openclaw: backup env file unavailable; skip cron setup" >&2
+    return 0
+  fi
+
+  cat > /etc/cron.d/openclaw-backup <<EOFCRON
 SHELL=/bin/bash
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 OPENCLAW_BACKUP_ENV_FILE_PATH=${OPENCLAW_BACKUP_ENV_FILE_PATH}
-${OPENCLAW_BACKUP_CRON} ${OPENCLAW_USER} /usr/local/bin/openclaw-backup-cron.sh >> /var/log/openclaw/backup.log 2>&1
-CRON
+${OPENCLAW_BACKUP_CRON} ${OPENCLAW_USER} python3 /usr/local/bin/backup_restore.py backup >> /var/log/openclaw/backup.log 2>&1
+EOFCRON
   chmod 0644 /etc/cron.d/openclaw-backup
   touch /var/log/openclaw/backup.log
   chown "$OPENCLAW_USER:$OPENCLAW_GROUP" /var/log/openclaw/backup.log
-  pgrep -x cron >/dev/null 2>&1 || cron
+
+  if pgrep -x cron >/dev/null 2>&1; then
+    return 0
+  fi
+
+  cron
 }
 
 restore_from_backup_on_startup() {
-  [[ -z "${OPENCLAW_BACKUP_DATASET_REPO:-}" ]] && echo "openclaw: startup restore skipped (OPENCLAW_BACKUP_DATASET_REPO is empty)" >&2 && return 0
-  write_backup_env_file || { echo "openclaw: backup env unavailable; skip restore" >&2; return 0; }
-  /usr/local/bin/openclaw-restore.sh && echo "openclaw: restore finished" || echo "openclaw: restore skipped or failed, continue startup" >&2
+  if [[ -z "${OPENCLAW_BACKUP_DATASET_REPO:-}" ]]; then
+    echo "openclaw: startup restore skipped (OPENCLAW_BACKUP_DATASET_REPO is empty)" >&2
+    return 0
+  fi
+
+  if ! write_backup_env_file; then
+    echo "openclaw: backup env file unavailable; skip startup restore" >&2
+    return 0
+  fi
+  if python3 /usr/local/bin/backup_restore.py restore; then
+    echo "openclaw: restore finished"
+  else
+    echo "openclaw: restore skipped or failed, continue startup" >&2
+  fi
 }
 
 run_as_node() {
   local cmd=("$@")
   if [[ "$(id -u)" -eq 0 ]]; then
-    exec gosu "$OPENCLAW_USER:$OPENCLAW_GROUP" "${cmd[@]}"
-  else
-    exec "${cmd[@]}"
+    exec gosu "$OPENCLAW_USER:$OPENCLAW_GROUP" "${cmd[@]}" >>"$OPENCLAW_STDOUT_LOG_PATH" 2>>"$OPENCLAW_STDERR_LOG_PATH"
   fi
+  exec "${cmd[@]}" >>"$OPENCLAW_STDOUT_LOG_PATH" 2>>"$OPENCLAW_STDERR_LOG_PATH"
 }
 
 run_as_node_background() {
   local cmd=("$@")
   if [[ "$(id -u)" -eq 0 ]]; then
-    gosu "$OPENCLAW_USER:$OPENCLAW_GROUP" "${cmd[@]}" &
+    gosu "$OPENCLAW_USER:$OPENCLAW_GROUP" "${cmd[@]}" >>"$OPENCLAW_STDOUT_LOG_PATH" 2>>"$OPENCLAW_STDERR_LOG_PATH" &
   else
-    "${cmd[@]}" &
+    "${cmd[@]}" >>"$OPENCLAW_STDOUT_LOG_PATH" 2>>"$OPENCLAW_STDERR_LOG_PATH" &
   fi
   OPENCLAW_CHILD_PID="$!"
 }
 
 start_sshx_background() {
-  is_true "$OPENCLAW_SSHX_AUTO_START" || return 0
-  command -v sshx >/dev/null 2>&1 || { echo "openclaw: sshx not found; skip" >&2; return 0; }
+  if ! is_true "$OPENCLAW_SSHX_AUTO_START"; then
+    return 0
+  fi
+
+  if ! command -v sshx >/dev/null 2>&1; then
+    echo "openclaw: OPENCLAW_SSHX_AUTO_START=true but sshx not found; skip auto start" >&2
+    return 0
+  fi
+
   if [[ "$(id -u)" -eq 0 ]]; then
     gosu "$OPENCLAW_USER:$OPENCLAW_GROUP" sshx >/proc/1/fd/1 2>/proc/1/fd/2 &
   else
     sshx >/proc/1/fd/1 2>/proc/1/fd/2 &
   fi
   OPENCLAW_SSHX_PID="$!"
-  echo "openclaw: sshx started (pid=$OPENCLAW_SSHX_PID)"
+  echo "openclaw: sshx started in background (pid=$OPENCLAW_SSHX_PID)"
 }
 
 stop_sshx_background() {
-  [[ -n "$OPENCLAW_SSHX_PID" ]] && kill -0 "$OPENCLAW_SSHX_PID" 2>/dev/null && kill "$OPENCLAW_SSHX_PID" 2>/dev/null || true
+  if [[ -n "$OPENCLAW_SSHX_PID" ]] && kill -0 "$OPENCLAW_SSHX_PID" >/dev/null 2>&1; then
+    echo "openclaw: stopping sshx background process (pid=$OPENCLAW_SSHX_PID)"
+    kill "$OPENCLAW_SSHX_PID" >/dev/null 2>&1 || true
+    wait "$OPENCLAW_SSHX_PID" >/dev/null 2>&1 || true
+  fi
 }
 
 backup_on_shutdown() {
-  [[ "$OPENCLAW_SHUTDOWN_BACKUP_DONE" -eq 1 ]] && return 0
+  if [[ "$OPENCLAW_SHUTDOWN_BACKUP_DONE" -eq 1 ]]; then
+    return 0
+  fi
   OPENCLAW_SHUTDOWN_BACKUP_DONE=1
-  [[ -z "${OPENCLAW_BACKUP_DATASET_REPO:-}" ]] && echo "openclaw: shutdown backup skipped (no repo)" >&2 && return 0
-  write_backup_env_file || { echo "openclaw: env unavailable; skip shutdown backup" >&2; return 0; }
+
+  if [[ -z "${OPENCLAW_BACKUP_DATASET_REPO:-}" ]]; then
+    echo "openclaw: shutdown backup skipped (OPENCLAW_BACKUP_DATASET_REPO is empty)" >&2
+    return 0
+  fi
+
+  if ! write_backup_env_file; then
+    echo "openclaw: backup env file unavailable; skip shutdown backup" >&2
+    return 0
+  fi
   echo "openclaw: running shutdown backup"
-  /usr/local/bin/openclaw-backup-cron.sh && echo "openclaw: shutdown backup completed" || echo "openclaw: shutdown backup failed" >&2
+  if python3 /usr/local/bin/backup_restore.py backup; then
+    echo "openclaw: shutdown backup completed"
+  else
+    echo "openclaw: shutdown backup failed, container will still exit" >&2
+  fi
 }
 
 run_gateway_with_shutdown_backup() {
   local gateway_exit_code=0
   local shutting_down=0
-  on_signal() {
-    [[ "$shutting_down" -eq 1 ]] && return 0
+
+  on_gateway_signal() {
+    local signal="$1"
+    if [[ "$shutting_down" -eq 1 ]]; then
+      return 0
+    fi
     shutting_down=1
-    log_warn "received signal, preparing graceful shutdown"
-    [[ -n "$OPENCLAW_CHILD_PID" ]] && kill -0 "$OPENCLAW_CHILD_PID" 2>/dev/null && kill "$OPENCLAW_CHILD_PID" 2>/dev/null || true
-    wait "$OPENCLAW_CHILD_PID" 2>/dev/null; gateway_exit_code=$?
-    log_info "gateway stopped with code ${gateway_exit_code}"
-    stop_sshx_background; backup_on_shutdown; trap - TERM INT QUIT; exit "$gateway_exit_code"
+    log_warn "received ${signal}, preparing graceful shutdown"
+
+    if [[ -n "$OPENCLAW_CHILD_PID" ]] && kill -0 "$OPENCLAW_CHILD_PID" >/dev/null 2>&1; then
+      kill -s "$signal" "$OPENCLAW_CHILD_PID" >/dev/null 2>&1 || kill "$OPENCLAW_CHILD_PID" >/dev/null 2>&1 || true
+      if ! wait "$OPENCLAW_CHILD_PID"; then
+        gateway_exit_code=$?
+      fi
+    fi
+
+    log_info "gateway process stopped with code ${gateway_exit_code}"
+    stop_sshx_background
+    backup_on_shutdown
+    trap - TERM INT QUIT
+    exit "$gateway_exit_code"
   }
-  trap 'on_signal TERM' TERM
-  trap 'on_signal INT' INT
-  trap 'on_signal QUIT' QUIT
+
+  trap 'on_gateway_signal TERM' TERM
+  trap 'on_gateway_signal INT' INT
+  trap 'on_gateway_signal QUIT' QUIT
+
   log_info "starting gateway process (bind=${OPENCLAW_GATEWAY_BIND}, port=${OPENCLAW_GATEWAY_PORT})"
-  run_as_node_background openclaw gateway --allow-unconfigured --bind "$OPENCLAW_GATEWAY_BIND" --port "$OPENCLAW_GATEWAY_PORT" "$@"
+  run_as_node_background openclaw gateway --skip-doctor --allow-unconfigured --bind "$OPENCLAW_GATEWAY_BIND" --port "$OPENCLAW_GATEWAY_PORT" "$@"
   log_info "gateway process started (pid=${OPENCLAW_CHILD_PID})"
-  wait "$OPENCLAW_CHILD_PID" 2>/dev/null; gateway_exit_code=$?
+  if ! wait "$OPENCLAW_CHILD_PID"; then
+    gateway_exit_code=$?
+  fi
   log_info "gateway process exited (pid=${OPENCLAW_CHILD_PID}, code=${gateway_exit_code})"
-  stop_sshx_background; backup_on_shutdown; trap - TERM INT QUIT; return "$gateway_exit_code"
+
+  stop_sshx_background
+  backup_on_shutdown
+  trap - TERM INT QUIT
+  return "$gateway_exit_code"
 }
 
 main() {
-  [[ "$#" -eq 0 ]] && set -- gateway
-  local subcommand="$1"; shift || true
+  if [[ "$#" -eq 0 ]]; then
+    set -- gateway
+  fi
+
+  local subcommand="$1"
+  shift || true
+
   if [[ "$subcommand" == "gateway" ]]; then
     log_info "starting gateway bootstrap sequence"
     run_step "prepare runtime directories" mkdir_state_dirs
@@ -340,9 +605,11 @@ main() {
     log_info "step ${OPENCLAW_STEP_INDEX} start: launch gateway"
     run_gateway_with_shutdown_backup "$@"
     local gateway_exit_code=$?
-    [[ "$gateway_exit_code" -ne 0 ]] && log_warn "gateway exited with non-zero code ${gateway_exit_code}"
+    if [[ "$gateway_exit_code" -ne 0 ]]; then
+      log_warn "gateway exited with non-zero code ${gateway_exit_code}"
+      return "$gateway_exit_code"
+    fi
     log_info "step ${OPENCLAW_STEP_INDEX} done: launch gateway"
-    return "$gateway_exit_code"
   else
     log_info "starting subcommand: openclaw ${subcommand}"
     run_as_node openclaw "$subcommand" "$@"
@@ -350,6 +617,3 @@ main() {
 }
 
 main "$@"
-
-
-