Make openclaw.json management non-invasive (create if missing, patch only set options)

openclaw_assistant/run.sh

@@ -9,47 +9,37 @@ if [ ! -f "$OPTIONS_FILE" ]; then
   exit 1
 fi
 
+# ------------------------------------------------------------------------------
+# Read add-on options (ALL optional; onboarding can fill the rest)
+# ------------------------------------------------------------------------------
+
 BOT_TOKEN=$(jq -r '.telegram_bot_token // empty' "$OPTIONS_FILE")
 TZNAME=$(jq -r '.timezone // "Europe/Sofia"' "$OPTIONS_FILE")
 ALLOW_FROM_RAW=$(jq -r '.telegram_allow_from // empty' "$OPTIONS_FILE")
-MODEL_PRIMARY=$(jq -r '.model_primary // "openai-codex/gpt-5.2"' "$OPTIONS_FILE")
+MODEL_PRIMARY=$(jq -r '.model_primary // empty' "$OPTIONS_FILE")
-GW_BIND=$(jq -r '.gateway_bind // "loopback"' "$OPTIONS_FILE")
+GW_BIND=$(jq -r '.gateway_bind // empty' "$OPTIONS_FILE")
-GW_PORT=$(jq -r '.gateway_port // 18789' "$OPTIONS_FILE")
+GW_PORT=$(jq -r '.gateway_port // empty' "$OPTIONS_FILE")
 GW_TOKEN=$(jq -r '.gateway_token // empty' "$OPTIONS_FILE")
 GW_PUBLIC_URL=$(jq -r '.gateway_public_url // empty' "$OPTIONS_FILE")
 HA_TOKEN=$(jq -r '.homeassistant_token // empty' "$OPTIONS_FILE")
 BRAVE_KEY=$(jq -r '.brave_api_key // empty' "$OPTIONS_FILE")
 ENABLE_TERMINAL=$(jq -r '.enable_terminal // false' "$OPTIONS_FILE")
-# Generic router SSH settings (preferred)
+
+# Generic router SSH settings
 ROUTER_HOST=$(jq -r '.router_ssh_host // empty' "$OPTIONS_FILE")
 ROUTER_USER=$(jq -r '.router_ssh_user // empty' "$OPTIONS_FILE")
 ROUTER_KEY=$(jq -r '.router_ssh_key_path // "/data/keys/router_ssh"' "$OPTIONS_FILE")
 
-# Backward compatible (deprecated) MikroTik-named settings
-MT_HOST=$(jq -r '.mikrotik_host // empty' "$OPTIONS_FILE")
-MT_USER=$(jq -r '.mikrotik_ssh_user // empty' "$OPTIONS_FILE")
-MT_KEY=$(jq -r '.mikrotik_ssh_key_path // "/data/keys/mikrotik"' "$OPTIONS_FILE")
-
-# Prefer generic router_* values; fall back to mikrotik_* if router_* are empty
-[ -z "$ROUTER_HOST" ] && ROUTER_HOST="$MT_HOST"
-[ -z "$ROUTER_USER" ] && ROUTER_USER="$MT_USER"
-[ "$ROUTER_KEY" = "/data/keys/router_ssh" ] && [ -n "$MT_KEY" ] && ROUTER_KEY="$MT_KEY"
-
 # Optional: allow disabling lock cleanup if you ever need to debug
 CLEAN_LOCKS_ON_START=$(jq -r '.clean_session_locks_on_start // true' "$OPTIONS_FILE")
 CLEAN_LOCKS_ON_EXIT=$(jq -r '.clean_session_locks_on_exit // true' "$OPTIONS_FILE")
 
-if [ -z "$BOT_TOKEN" ]; then
-  echo "You must set telegram_bot_token in the add-on configuration."
-  exit 1
-fi
-
 export TZ="$TZNAME"
+
 # Reduce risk of secrets ending up in logs
 set +x
 
 # HA add-ons mount persistent storage at /config (maps to /addon_configs/<slug> on the host).
-# Use /config as HOME so OpenClaw finds its auth store and config there.
 export HOME=/config
 mkdir -p /config/.openclaw /config/clawd /config/keys /config/secrets
 
@@ -76,7 +66,6 @@ fi
 # Session lock cleanup helpers
 # ------------------------------------------------------------------------------
 
-# Returns 0 if a gateway process appears to be running, else 1
 gateway_running() {
   pgrep -f "openclaw.*gateway.*run" >/dev/null 2>&1
 }
@@ -104,7 +93,6 @@ cleanup_session_locks() {
   rm -f "${sessions_dir}"/*.jsonl.lock || true
 }
 
-# Cleanup on start (stale locks after crashes/restarts)
 if [ "$CLEAN_LOCKS_ON_START" = "true" ]; then
   cleanup_session_locks
 else
@@ -115,109 +103,109 @@ fi
 # Store tokens / export env vars (optional)
 # ------------------------------------------------------------------------------
 
-# Home Assistant long-lived token (for local HA API scripts/tools)
 if [ -n "$HA_TOKEN" ]; then
   umask 077
   printf '%s' "$HA_TOKEN" > /config/secrets/homeassistant.token
 fi
 
-# Brave Search API key (for OpenClaw's web_search tool, which reads BRAVE_API_KEY)
 if [ -n "$BRAVE_KEY" ]; then
   export BRAVE_API_KEY="$BRAVE_KEY"
   umask 077
   printf '%s' "$BRAVE_KEY" > /config/secrets/brave_api_key
 fi
 
-# Decide Telegram DM access policy.
+# ------------------------------------------------------------------------------
-DM_POLICY="pairing"
+# Non-invasive OpenClaw config management
-ALLOW_FROM_JSON=""
+# - If config is missing: create it.
-if [ -n "$ALLOW_FROM_RAW" ]; then
+# - If config exists: ONLY patch the fields whose add-on options are set.
-  DM_POLICY="allowlist"
+# - If config is not parseable as strict JSON (e.g. JSON5): do NOT touch it.
-  # convert "1,2, 3" -> ["1","2","3"] using jq (no python dependency)
+#   (This keeps onboarding-managed config intact.)
-  ALLOW_FROM_JSON=$(printf '%s' "$ALLOW_FROM_RAW" | jq -R 'split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(length>0))')
+# ------------------------------------------------------------------------------
-fi
 
-# Validate gateway exposure settings
+OPENCLAW_CONFIG_PATH="/config/.openclaw/openclaw.json"
-if [ "$GW_BIND" = "lan" ] && [ -z "$GW_TOKEN" ]; then
-  echo "ERROR: gateway_bind=lan requires gateway_token to be set (do not expose an unauthenticated gateway)."
-  exit 1
-fi
 
-GW_AUTH_BLOCK="auth: { mode: \"token\", token: \"${GW_TOKEN}\" }"
+python3 - <<'PY'
-if [ -z "$GW_TOKEN" ]; then
+import json
-  # Let doctor generate one (loopback-only is still protected by local access)
+import os
-  GW_AUTH_BLOCK="auth: { mode: \"token\" }"
+from pathlib import Path
-fi
 
-# Write gateway config (JSON5).
+cfg_path = Path(os.environ['OPENCLAW_CONFIG_PATH'])
-mkdir -p /config/.openclaw
-cat > /config/.openclaw/openclaw.json <<EOF
-{
-  discovery: { wideArea: { enabled: false } },
 
-  gateway: {
+def set_path(d, keys, value):
-    mode: "local",
+    cur = d
-    bind: "${GW_BIND}",
+    for k in keys[:-1]:
-    port: ${GW_PORT},
+        if k not in cur or not isinstance(cur[k], dict):
-    controlUi: { allowInsecureAuth: true },
+            cur[k] = {}
-    ${GW_AUTH_BLOCK}
+        cur = cur[k]
-  },
+    cur[keys[-1]] = value
-  agents: {
-    defaults: {
-      workspace: "/config/clawd",
-      model: { primary: "${MODEL_PRIMARY}" },
-      models: {
-        "${MODEL_PRIMARY}": {}
-      }
-    },
-    list: [
-      { id: "main" }
-    ]
-  },
-  channels: {
-    telegram: {
-      enabled: true,
-      botToken: "${BOT_TOKEN}",
-      dmPolicy: "${DM_POLICY}"${ALLOW_FROM_RAW:+,
-      allowFrom: ${ALLOW_FROM_JSON}}
-    }
-  }
-}
-EOF
 
-# OpenClaw reads its config from /config/.openclaw/openclaw.json
+# Load existing config if possible
+cfg = {}
+if cfg_path.exists():
+    try:
+        cfg = json.loads(cfg_path.read_text(encoding='utf-8'))
+    except Exception as e:
+        print(f"INFO: {cfg_path} exists but is not strict JSON; leaving it untouched ({e}).")
+        raise SystemExit(0)
 
-echo "Model primary=${MODEL_PRIMARY}"
+# Patch only if env var is set (non-empty)
-echo "Gateway bind=${GW_BIND} port=${GW_PORT} token=${GW_TOKEN:+(set)}${GW_TOKEN:-(auto)}"
-echo "Telegram dmPolicy=${DM_POLICY}${ALLOW_FROM_RAW:+ (allowFrom=${ALLOW_FROM_RAW})}"
-echo "Telegram allowFrom JSON: ${ALLOW_FROM_JSON:-<none>}"
 
-# Auth store debug (redacted): never print tokens
+def env(name):
-AUTH_STORE="/config/.openclaw/agents/main/agent/auth-profiles.json"
+    v = os.environ.get(name, '')
-if [ -f "$AUTH_STORE" ]; then
+    return v if v != '' else None
-  echo "Auth store present at $AUTH_STORE"
-  echo "Auth store summary (redacted):"
-  jq -r '"version="+((.version//"?")|tostring),
-         "profiles="+(((.profiles//{})|keys|join(","))),
-         "providers="+(((.profiles//{})|to_entries|map(.value.provider // "?")|unique|join(",")))' "$AUTH_STORE" 2>/dev/null || echo "(could not parse auth store JSON)"
-else
-  echo "Auth store not found at $AUTH_STORE"
-fi
 
-echo "Sanity check: DNS + Telegram API reachability"
+# gateway bind/port/token
-if curl -fsS --max-time 10 https://api.telegram.org/ >/dev/null; then
+bind_ = env('GW_BIND')
-  echo "OK: api.telegram.org reachable"
+if bind_:
-else
+    set_path(cfg, ['gateway', 'bind'], bind_)
-  echo "WARN: api.telegram.org not reachable from add-on container"
-fi
 
-# Validate token (print only bot username)
+port_ = env('GW_PORT')
-BOT_USER=$(curl -fsS --max-time 10 "https://api.telegram.org/bot${BOT_TOKEN}/getMe" | jq -r '.result.username // empty' || true)
+if port_:
-if [ -n "$BOT_USER" ]; then
+    try:
-  echo "OK: Telegram token valid for @${BOT_USER}"
+        set_path(cfg, ['gateway', 'port'], int(port_))
-else
+    except Exception:
-  echo "WARN: Telegram token validation failed (getMe)"
+        pass
-fi
+
+token_ = env('GW_TOKEN')
+if token_:
+    set_path(cfg, ['gateway', 'auth', 'mode'], 'token')
+    set_path(cfg, ['gateway', 'auth', 'token'], token_)
+
+# Agent defaults: workspace + primary model
+# We always ensure workspace points to the add-on workspace (safe and expected).
+set_path(cfg, ['agents', 'defaults', 'workspace'], '/config/clawd')
+
+model_primary = env('MODEL_PRIMARY')
+if model_primary:
+    set_path(cfg, ['agents', 'defaults', 'model', 'primary'], model_primary)
+    # Ensure models entry exists (minimal)
+    models = cfg.get('agents', {}).get('defaults', {}).get('models', {})
+    if not isinstance(models, dict):
+        models = {}
+    models.setdefault(model_primary, {})
+    set_path(cfg, ['agents', 'defaults', 'models'], models)
+
+# Telegram channel only if token provided in options
+bot_token = env('BOT_TOKEN')
+if bot_token:
+    set_path(cfg, ['channels', 'telegram', 'enabled'], True)
+    set_path(cfg, ['channels', 'telegram', 'botToken'], bot_token)
+
+    allow_from_raw = env('ALLOW_FROM_RAW')
+    if allow_from_raw:
+        ids = [x.strip() for x in allow_from_raw.split(',') if x.strip()]
+        if ids:
+            set_path(cfg, ['channels', 'telegram', 'dmPolicy'], 'allowlist')
+            set_path(cfg, ['channels', 'telegram', 'allowFrom'], ids)
+    else:
+        # If not set, do NOT override dmPolicy/allowFrom; let onboarding decide.
+        pass
+
+# Write (pretty JSON; JSON is valid JSON5 too)
+cfg_path.parent.mkdir(parents=True, exist_ok=True)
+cfg_path.write_text(json.dumps(cfg, indent=2, sort_keys=True) + "\n", encoding='utf-8')
+print(f"INFO: OpenClaw config written/patched at {cfg_path}")
+PY
 
 # Convenience info for later (router SSH access path & HA token file)
 cat > /config/CONNECTION_NOTES.txt <<EOF
@@ -230,9 +218,10 @@ EOF
 
 RUN_DOCTOR=$(jq -r '.run_doctor_on_start // false' "$OPTIONS_FILE")
 
+# Run doctor ONLY if explicitly enabled; otherwise don't touch user-managed config/state.
 if [ "$RUN_DOCTOR" = "true" ]; then
   echo "Running assistant doctor (auto-fix) ..."
-  (timeout 60s "${CLI_BIN:-openclaw}" doctor --fix --yes) || true
+  (timeout 60s openclaw doctor --fix --yes) || true
 else
   echo "Skipping doctor on startup (run_doctor_on_start=false)"
 fi
@@ -241,6 +230,8 @@ fi
 # Graceful shutdown handling (PID 1 trap) to reduce stale locks
 # ------------------------------------------------------------------------------
 GW_PID=""
+NGINX_PID=""
+TTYD_PID=""
 
 shutdown() {
   echo "Shutdown requested; stopping services..."
@@ -267,29 +258,18 @@ shutdown() {
 
 trap shutdown INT TERM
 
-NGINX_PID=""
+if ! command -v openclaw >/dev/null 2>&1; then
-TTYD_PID=""
-
-CLI_BIN=""
-if command -v openclaw >/dev/null 2>&1; then
-  CLI_BIN="openclaw"
-else
   echo "ERROR: openclaw is not installed."
   exit 1
 fi
 
-echo "Starting OpenClaw Assistant gateway (${CLI_BIN}-compatible)..."
+echo "Starting OpenClaw Assistant gateway (openclaw)..."
-"${CLI_BIN}" gateway run &
+openclaw gateway run &
 GW_PID=$!
 
 # Start web terminal (optional)
 if [ "$ENABLE_TERMINAL" = "true" ]; then
   echo "Starting web terminal (ttyd) on 127.0.0.1:7681 ..."
-  # -W: allow clients to write (interactive)
-  # -p: port
-  # bind localhost only; exposed to HA via ingress reverse proxy
-  # ttyd is writable by default; use -R for read-only. (Some builds don't support -W)
-  # -b sets the base path so it works behind Ingress (/terminal/)
   ttyd -i 127.0.0.1 -p 7681 -b /terminal bash &
   TTYD_PID=$!
 else
@@ -310,9 +290,6 @@ tpl = Path('/etc/nginx/nginx.conf.tpl').read_text()
 token = os.environ.get('GW_TOKEN','')
 public_url = os.environ.get('GW_PUBLIC_URL','')
 
-# Normalize gateway_public_url for building the link: ensure there is exactly one slash
-# between base URL and path. We keep the displayed base as-is, but compute a safe suffix.
-# If base ends with '/', use empty suffix. Otherwise use '/'.
 conf = tpl.replace('__GATEWAY_TOKEN__', token)
 conf = conf.replace('__GATEWAY_PUBLIC_URL__', public_url)
 conf = conf.replace('__GW_PUBLIC_URL_PATH__', '' if public_url.endswith('/') else '/')