Enable startup-time CPA auto-update with bucket-safe auth paths

Keep config.yaml unchanged, align auth persistence to /data/auths, and refresh CLIProxyAPI from the latest GitHub release on each container start with a bundled-binary fallback.

Dockerfile

@@ -23,25 +23,8 @@ COPY supabase-sync.sh /app/supabase-sync.sh
 RUN chmod +x /app/supabase-sync.sh
 
 # Create startup script
-RUN echo '#!/bin/bash\n\
-\n\
-# Replace environment variables in config\n\
-envsubst < /app/config.template.yaml > /app/config.yaml\n\
-\n\
-# Create auths directory\n\
-mkdir -p /data/auths\n\
-\n\
-# Download auth files from Supabase Storage\n\
-echo "=== Downloading auth files from Supabase ==="\n\
-/app/supabase-sync.sh download || echo "Supabase download skipped"\n\
-\n\
-echo "=== Auth files loaded: $(find /data/auths -name "*.json" | wc -l) ==="\n\
-\n\
-# Start file watcher in background (sync changes to Supabase)\n\
-/app/supabase-sync.sh watch &\n\
-\n\
-exec ./cli-proxy-api -config config.yaml\n\
-' > /app/start.sh && chmod +x /app/start.sh
+COPY start.sh /app/start.sh
+RUN chmod +x /app/start.sh
 
 EXPOSE 7860
 

start.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# Replace environment variables in config
+envsubst < /app/config.template.yaml > /app/config.yaml
+
+# Keep auth files on the persistent bucket mount.
+AUTH_DIR="/data/auths"
+mkdir -p "${AUTH_DIR}"
+
+# Try to refresh CLI Proxy API from the latest GitHub release, but keep
+# the bundled binary as a fallback so a transient GitHub failure does not
+# block startup.
+echo "=== Checking latest CLI Proxy API release ==="
+TMP_DIR=$(mktemp -d)
+LATEST_URL=$(curl -fsSL https://api.github.com/repos/router-for-me/CLIProxyAPI/releases/latest | jq -r '.assets[] | select(.name | test("linux.*amd64.*tar.gz")) | .browser_download_url' | head -n 1)
+
+if [ -n "${LATEST_URL}" ] && [ "${LATEST_URL}" != "null" ]; then
+  if curl -fsSL "${LATEST_URL}" -o "${TMP_DIR}/cli-proxy-api.tar.gz" && tar -xzf "${TMP_DIR}/cli-proxy-api.tar.gz" -C "${TMP_DIR}"; then
+    LATEST_BIN=$(find "${TMP_DIR}" -name "cli-proxy-api" -type f | head -n 1)
+    if [ -n "${LATEST_BIN}" ]; then
+      install -m 755 "${LATEST_BIN}" /app/cli-proxy-api
+      echo "=== Updated CLI Proxy API from latest GitHub release ==="
+    else
+      echo "=== Latest release extracted without cli-proxy-api; using bundled binary ==="
+    fi
+  else
+    echo "=== Latest release download failed; using bundled binary ==="
+  fi
+else
+  echo "=== Latest release lookup failed; using bundled binary ==="
+fi
+rm -rf "${TMP_DIR}"
+
+echo "=== Downloading auth files from Supabase ==="
+/app/supabase-sync.sh download || echo "Supabase download skipped"
+
+echo "=== Auth files loaded: $(find "${AUTH_DIR}" -name "*.json" | wc -l) ==="
+
+# Start file watcher in background (sync changes to Supabase)
+/app/supabase-sync.sh watch &
+
+exec /app/cli-proxy-api -config /app/config.yaml