Update Dockerfile

Dockerfile

@@ -45,7 +45,7 @@ RUN uv pip install --python /opt/hermes/.venv/bin/python --no-cache-dir \
     && chmod 0440 /etc/sudoers.d/hermes \
     && /usr/sbin/visudo -cf /etc/sudoers.d/hermes
 
-# 3. 复制魔改项目的全部核心组件
+# 3. 复制魔改项目的全部核心组件并【强制洗刷换行符】
 COPY --chown=hermes:hermes start.sh /opt/huggingmes/start.sh
 COPY --chown=hermes:hermes health-server.js /opt/huggingmes/health-server.js
 COPY --chown=hermes:hermes cloudflare-proxy-setup.py /opt/huggingmes/cloudflare-proxy-setup.py
@@ -53,7 +53,9 @@ COPY --chown=hermes:hermes cloudflare-keepalive-setup.py /opt/huggingmes/cloudfl
 COPY --chown=hermes:hermes env-builder.html /opt/huggingmes/env-builder.html
 COPY --chown=hermes:hermes env-builder.js /opt/huggingmes/env-builder.js
 
-RUN chmod +x \
+# CRITICAL FIX: 强刷去除可能由于 Windows 编辑带来的 \r 换行符污染
+RUN sed -i 's/\r$//' /opt/huggingmes/start.sh && \
+    chmod +x \
     /opt/huggingmes/start.sh \
     /opt/huggingmes/cloudflare-proxy-setup.py \
     /opt/huggingmes/cloudflare-keepalive-setup.py
@@ -63,27 +65,42 @@ RUN python3 - <<'PY'
 import sys
 try:
     from pathlib import Path
+
     p = Path("/opt/hermes/hermes_cli/kanban_db.py")
-    if p.exists():
-        src = p.read_text(encoding="utf-8", errors="replace")
-        sentinel = "# huggingmes: idempotent-alter"
-        if sentinel not in src:
-            old = ('    conn.execute(\n'
-                   '        "ALTER TABLE tasks ADD COLUMN consecutive_failures "\n'
-                   '        "INTEGER NOT NULL DEFAULT 0"\n'
-                   '    )')
-            new = (f'    try:  {sentinel}\n'
-                   '        conn.execute(\n'
-                   '            "ALTER TABLE tasks ADD COLUMN consecutive_failures "\n'
-                   '            "INTEGER NOT NULL DEFAULT 0"\n'
-                   '        )\n'
-                   '    except Exception:\n'
-                   '        pass')
-            if old in src:
-                p.write_text(src.replace(old, new), encoding="utf-8")
-                print("kanban patch: applied")
+    if not p.exists():
+        print("kanban patch: file not found, skipping")
+        sys.exit(0)
+
+    src = p.read_text(encoding="utf-8", errors="replace")
+    sentinel = "# huggingmes: idempotent-alter"
+    if sentinel in src:
+        print("kanban patch: already applied, skipping")
+        sys.exit(0)
+
+    old = (
+        '    conn.execute(\n'
+        '        "ALTER TABLE tasks ADD COLUMN consecutive_failures "\n'
+        '        "INTEGER NOT NULL DEFAULT 0"\n'
+        '    )'
+    )
+    new = (
+        f'    try:  {sentinel}\n'
+        '        conn.execute(\n'
+        '            "ALTER TABLE tasks ADD COLUMN consecutive_failures "\n'
+        '            "INTEGER NOT NULL DEFAULT 0"\n'
+        '        )\n'
+        '    except Exception:\n'
+        '        pass'
+    )
+
+    if old not in src:
+        print("kanban patch: pattern not found, may be fixed upstream, skipping")
+        sys.exit(0)
+
+    p.write_text(src.replace(old, new), encoding="utf-8")
+    print("kanban patch: applied")
 except Exception as e:
-    print(f"kanban patch error: {e}", file=sys.stderr)
+    print(f"kanban patch: error ({e}), skipping", file=sys.stderr)
 PY
 
 # 5. 坚决维持原项目持久化存储桶挂载路径 /opt/data
@@ -99,6 +116,9 @@ ENV HERMES_HOME=/opt/data \
 
 EXPOSE 7861
 
-# 以 root 入口进行底层隔离、挂载刷新与锁清洗，随后平滑切回降权用户空间
-USER root
-CMD ["/opt/huggingmes/start.sh"]
+# 维持 HF Spaces 健康检查探针
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s \
+  CMD curl -fsS http://localhost:7861/health || exit 1
+
+# 以 root 入口显式通过 bash 驱动，防止底层 s6 管理器因不可见标识符再次 exec 失败
+CMD ["/bin/bash", "/opt/huggingmes/start.sh"]