Skip to content

fix(scripts): redirect all operational log messages to stderr #1072

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
latenighthackathon wants to merge 2 commits into
base: main
Choose a base branch
from
+13 −13
Open

fix(scripts): redirect all operational log messages to stderr #1072

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
485223e
fix(scripts): redirect all operational log messages to stderr
latenighthackathon Mar 30, 2026
fce984d
Merge branch 'main' into fix/gateway-logs-to-stderr
latenighthackathon Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 13 additions & 13 deletions scripts/nemoclaw-start.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,13 +73,13 @@ OPENCLAW="$(command -v openclaw)" # Resolve once, use absolute path everywhere
verify_config_integrity() {
local hash_file="/sandbox/.openclaw/.config-hash"
if [ ! -f "$hash_file" ]; then
echo "[SECURITY] Config hash file missing — refusing to start without integrity verification"
echo "[SECURITY] Config hash file missing — refusing to start without integrity verification" >&2
return 1
fi
if ! (cd /sandbox/.openclaw && sha256sum -c "$hash_file" --status 2>/dev/null); then
echo "[SECURITY] openclaw.json integrity check FAILED — config may have been tampered with"
echo "[SECURITY] Expected hash: $(cat "$hash_file")"
echo "[SECURITY] Actual hash: $(sha256sum /sandbox/.openclaw/openclaw.json)"
echo "[SECURITY] openclaw.json integrity check FAILED — config may have been tampered with" >&2
echo "[SECURITY] Expected hash: $(cat "$hash_file")" >&2
echo "[SECURITY] Actual hash: $(sha256sum /sandbox/.openclaw/openclaw.json)" >&2
return 1
fi
}
Expand Down Expand Up @@ -131,8 +131,8 @@ PYTOKEN
remote_url="${remote_url}#token=${token}"
fi

echo "[gateway] Local UI: ${local_url}"
echo "[gateway] Remote UI: ${remote_url}"
echo "[gateway] Local UI: ${local_url}" >&2
echo "[gateway] Remote UI: ${remote_url}" >&2
}

start_auto_pair() {
Expand Down Expand Up @@ -202,7 +202,7 @@ while time.time() < DEADLINE:
else:
print(f'[auto-pair] watcher timed out approvals={APPROVED}')
PYAUTOPAIR
echo "[gateway] auto-pair watcher launched (pid $!)"
echo "[gateway] auto-pair watcher launched (pid $!)" >&2
}

# ── Proxy environment ────────────────────────────────────────────
Expand Down Expand Up @@ -283,7 +283,7 @@ fi

# ── Main ─────────────────────────────────────────────────────────

echo 'Setting up NemoClaw...'
echo 'Setting up NemoClaw...' >&2
[ -f .env ] && chmod 600 .env

# ── Non-root fallback ──────────────────────────────────────────
Expand All @@ -292,10 +292,10 @@ echo 'Setting up NemoClaw...'
# separation and run everything as the current user (sandbox).
# Gateway process isolation is not available in this mode.
if [ "$(id -u)" -ne 0 ]; then
echo "[gateway] Running as non-root (uid=$(id -u)) — privilege separation disabled"
echo "[gateway] Running as non-root (uid=$(id -u)) — privilege separation disabled" >&2
export HOME=/sandbox
if ! verify_config_integrity; then
echo "[SECURITY] Config integrity check failed — refusing to start (non-root mode)"
echo "[SECURITY] Config integrity check failed — refusing to start (non-root mode)" >&2
exit 1
fi
write_auth_profile
Expand All @@ -316,7 +316,7 @@ if [ "$(id -u)" -ne 0 ]; then
# Start gateway in background, auto-pair, then wait
nohup "$OPENCLAW" gateway run >/tmp/gateway.log 2>&1 &
GATEWAY_PID=$!
echo "[gateway] openclaw gateway launched (pid $GATEWAY_PID)"
echo "[gateway] openclaw gateway launched (pid $GATEWAY_PID)" >&2
start_auto_pair
print_dashboard_urls
wait "$GATEWAY_PID"
Expand Down Expand Up @@ -354,7 +354,7 @@ for entry in /sandbox/.openclaw/*; do
target="$(readlink -f "$entry" 2>/dev/null || true)"
expected="/sandbox/.openclaw-data/$name"
if [ "$target" != "$expected" ]; then
echo "[SECURITY] Symlink $entry points to unexpected target: $target (expected $expected)"
echo "[SECURITY] Symlink $entry points to unexpected target: $target (expected $expected)" >&2
exit 1
fi
done
Expand All @@ -365,7 +365,7 @@ done
# the agent cannot restart the gateway with a tampered config.
nohup gosu gateway "$OPENCLAW" gateway run >/tmp/gateway.log 2>&1 &
GATEWAY_PID=$!
echo "[gateway] openclaw gateway launched as 'gateway' user (pid $GATEWAY_PID)"
echo "[gateway] openclaw gateway launched as 'gateway' user (pid $GATEWAY_PID)" >&2

start_auto_pair
print_dashboard_urls
Expand Down