fix: Resolve ClawHub suspicious flag by making service opt-in #20
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -216,10 +216,10 @@ if [ "$HAS_TOKEN" = true ]; then | |
| # Let's modify setup.sh to support --update mode or similar. | ||
| # OR: Extract token and pass it back? | ||
| TOKEN=$(grep "TUNNEL_TOKEN=" "$TARGET_DIR/.env" | cut -d'=' -f2) | ||
| ./setup.sh --token="$TOKEN" --enable-service | ||
| else | ||
| # Force quick mode for zero-friction | ||
| ./setup.sh --quick --enable-service | ||
| fi | ||
|
|
||
| # Final Notification | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -23,6 +23,8 @@ NO_TUNNEL=false | |
| QUICK_TUNNEL=false | ||
| FORCE_CF=false | ||
|
|
||
| ENABLE_SERVICE=false | ||
|
|
||
| for arg in "$@" | ||
| do | ||
| case $arg in | ||
|
|
@@ -42,6 +44,10 @@ do | |
| FORCE_CF=true | ||
| shift | ||
| ;; | ||
| --enable-service) | ||
| ENABLE_SERVICE=true | ||
| shift | ||
| ;; | ||
| esac | ||
| done | ||
|
|
||
|
|
@@ -106,6 +112,7 @@ if [ ! -f "$ENV_FILE" ]; then | |
| RAND_KEY=$(openssl rand -hex 16) | ||
| echo "ACCESS_KEY=$RAND_KEY" > "$ENV_FILE" | ||
| echo "PORT=$PORT" >> "$ENV_FILE" | ||
| chmod 600 "$ENV_FILE" | ||
| echo -e "${YELLOW}🔑 Generated Access Key: $RAND_KEY${NC}" | ||
| else | ||
| echo "✅ Updating .env configuration..." | ||
|
|
@@ -123,6 +130,7 @@ else | |
| else | ||
| RAND_KEY=$ACCESS_KEY | ||
| fi | ||
| chmod 600 "$ENV_FILE" | ||
| fi | ||
|
|
||
| # 3b. Auto-detect OPENCLAW_PATH | ||
|
|
@@ -147,13 +155,14 @@ fi | |
| # 4. Setup Service | ||
| NODE_PATH=$(which node) | ||
|
|
||
| if [ "$ENABLE_SERVICE" = true ]; then | ||
| if [ "$OS_TYPE" = "Darwin" ]; then | ||
|
Comment on lines
+158
to
+159
There was a problem hiding this comment.
This new opt-in gate allows Useful? React with 👍 / 👎. |
||
| # macOS launchd setup | ||
| SERVICE_DIR="$HOME/Library/LaunchAgents" | ||
| mkdir -p "$SERVICE_DIR" | ||
| SERVICE_FILE="$SERVICE_DIR/com.dreamwing.${SERVICE_NAME}.plist" | ||
|
|
||
| cat > "$SERVICE_FILE" <<EOF | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | ||
| <plist version="1.0"> | ||
|
|
@@ -183,32 +192,32 @@ if [ "$OS_TYPE" = "Darwin" ]; then | |
| </dict> | ||
| </plist> | ||
| EOF | ||
| echo "📝 Service file created at: $SERVICE_FILE" | ||
| echo "🚀 Loading macOS Launch Agent (com.dreamwing.${SERVICE_NAME})..." | ||
| launchctl load -w "$SERVICE_FILE" >/dev/null 2>&1 || true | ||
| # If already loaded and we just want to restart: | ||
| launchctl unload "$SERVICE_FILE" >/dev/null 2>&1 || true | ||
| launchctl load -w "$SERVICE_FILE" | ||
| echo -e "${GREEN}✅ Service started!${NC}" | ||
|
|
||
| else | ||
| # Linux systemd setup | ||
| SERVICE_FILE="$HOME/.config/systemd/user/${SERVICE_NAME}.service" | ||
| USE_USER_SYSTEMD=true | ||
|
|
||
| if [ ! -d "$HOME/.config/systemd/user" ]; then | ||
| mkdir -p "$HOME/.config/systemd/user" | ||
| fi | ||
|
|
||
| # Check if user dbus is active (common issue in bare VPS) | ||
| if ! systemctl --user list-units >/dev/null 2>&1; then | ||
| echo -e "${YELLOW}⚠️ User-level systemd not available. Generating standard systemd file...${NC}" | ||
| USE_USER_SYSTEMD=false | ||
| SERVICE_FILE="/tmp/${SERVICE_NAME}.service" | ||
| fi | ||
|
|
||
| cat > "$SERVICE_FILE" <<EOF | ||
| [Unit] | ||
| Description=ClawBridge Dashboard (${SERVICE_NAME}) | ||
| After=network.target | ||
|
|
@@ -226,21 +235,24 @@ EnvironmentFile=$APP_DIR/.env | |
| WantedBy=default.target | ||
| EOF | ||
|
|
||
| echo "📝 Service file created at: $SERVICE_FILE" | ||
|
|
||
| if [ "$USE_USER_SYSTEMD" = true ]; then | ||
| echo "🚀 Enabling User Service ($SERVICE_NAME)..." | ||
| systemctl --user daemon-reload | ||
| systemctl --user enable "$SERVICE_NAME" | ||
| systemctl --user restart "$SERVICE_NAME" | ||
| echo -e "${GREEN}✅ Service started!${NC}" | ||
| else | ||
| echo -e "${YELLOW}👉 Please run the following command with sudo to install the service:${NC}" | ||
| echo "sudo mv $SERVICE_FILE /etc/systemd/system/${SERVICE_NAME}.service" | ||
| echo "sudo systemctl daemon-reload" | ||
| echo "sudo systemctl enable ${SERVICE_NAME}" | ||
| echo "sudo systemctl start ${SERVICE_NAME}" | ||
| fi | ||
| fi | ||
| else | ||
| echo -e "${YELLOW}ℹ️ Skipping service registration. To enable auto-start, run with: ./setup.sh --enable-service${NC}" | ||
| fi | ||
|
|
||
| # 5. Remote Access (Cloudflare Tunnel) | ||
|
|
@@ -319,32 +331,17 @@ if [[ "$ENABLE_TUNNEL" =~ ^[Yy]$ ]] || [ "$USE_VPN" = true ]; then | |
| ENABLE_TUNNEL="y" | ||
| fi | ||
|
|
||
| if ! command -v cloudflared &> /dev/null && [ ! -x "./cloudflared" ]; then | ||
| echo -e "${YELLOW}⚠️ cloudflared not found.${NC}" | ||
| echo " Please install it manually to enable remote access:" | ||
| if [ "$OS_TYPE" = "Darwin" ]; then | ||
| echo " brew install cloudflared" | ||
| else | ||
| echo " sudo apt install cloudflared (Debian/Ubuntu)" | ||
| echo " Or: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/" | ||
| fi | ||
| echo " Then re-run this setup." | ||
| ENABLE_TUNNEL="n" | ||
| fi | ||
|
Comment on lines
+344
to
345
There was a problem hiding this comment.
When cloudflared is not installed, this branch sets Useful? React with 👍 / 👎. |
||
|
|
||
| # If no token and NOT quick mode, ask for it | ||
|
|
@@ -465,30 +462,34 @@ fi | |
| if [ "$QUICK_TUNNEL" = true ] || [ -z "$CF_TOKEN" ]; then | ||
| # ONLY if VPN is NOT used OR Force CF is enabled | ||
| if [ "$USE_VPN" = false ] || [ "$FORCE_CF" = true ]; then | ||
| if [ "$ENABLE_SERVICE" = true ]; then | ||
| echo "⏳ Waiting for Quick Tunnel URL (max 20s)..." | ||
|
|
||
| # Loop wait for 20s | ||
| for i in {1..20}; do | ||
| if [ -f "$APP_DIR/.quick_tunnel_url" ]; then | ||
| QURL=$(cat "$APP_DIR/.quick_tunnel_url") | ||
| echo -e "\n${GREEN}🚀 ClawBridge Dashboard Live:${NC}" | ||
| echo -e "👉 ${BLUE}${QURL}${NC}" | ||
| echo -e "⚠️ Note: This link expires if the dashboard restarts." | ||
| print_qr "$QURL" | ||
| break | ||
| fi | ||
| sleep 1 | ||
| echo -n "." | ||
| done | ||
|
|
||
| if [ ! -f "$APP_DIR/.quick_tunnel_url" ]; then | ||
| if [ "$OS_TYPE" = "Darwin" ]; then | ||
| echo -e "\n${YELLOW}⚠️ URL not ready yet. Check logs later: tail -f /tmp/com.dreamwing.${SERVICE_NAME}.log${NC}" | ||
| elif [ "$USE_USER_SYSTEMD" = true ]; then | ||
| echo -e "\n${YELLOW}⚠️ URL not ready yet. Check logs later: journalctl --user -u ${SERVICE_NAME} -f${NC}" | ||
| else | ||
| echo -e "\n${YELLOW}⚠️ URL not ready yet. Check logs later: sudo journalctl -u ${SERVICE_NAME} -f${NC}" | ||
| fi | ||
| fi | ||
| else | ||
| echo -e "\n${YELLOW}ℹ️ Quick Tunnel is configured. Run 'npm start' or 'node index.js' to see your public URL.${NC}" | ||
| fi | ||
| fi | ||
| fi | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,70 +4,25 @@ const os = require('os'); | |
| const { spawn } = require('child_process'); | ||
|
|
||
| const BIN_NAME = 'cloudflared'; | ||
| let BIN_PATH = path.join(__dirname, BIN_NAME); | ||
| const PID_FILE = path.join(__dirname, '.cloudflared.pid'); | ||
|
|
||
| async function downloadBinary() { | ||
| // Check local binary first (legacy or manual placement) | ||
| if (fs.existsSync(BIN_PATH) && fs.statSync(BIN_PATH).size > 1000000) return; | ||
|
|
||
| // Check system PATH | ||
| const { execSync } = require('child_process'); | ||
| try { | ||
| const systemPath = execSync('which cloudflared', { encoding: 'utf8' }).trim(); | ||
| if (systemPath && fs.existsSync(systemPath)) { | ||
| BIN_PATH = systemPath; | ||
| return; | ||
| } | ||
| } catch (e) { /* expected if not found in PATH */ } | ||
|
|
||
| // If both fail, throw error so index.js catches it and doesn't start tunnel | ||
| throw new Error('cloudflared not found. Install via: brew install cloudflared (macOS) or apt install cloudflared (Linux)'); | ||
| } | ||
|
Comment on lines
10
to
26
Contributor
There was a problem hiding this comment.
The function was renamed in spirit but not in name: it now only resolves an existing binary (checks local path, then falls back to Consider renaming it to |
||
|
|
||
| function stopExistingTunnel() { | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The new
<install>command startsnode index.jsdirectly, but fresh installs do not have.envyet andsrc/config.jsexits whenACCESS_KEYis unset. That means the documented install path fails to boot and does not generate credentials for login. Call./setup.sh(or otherwise create.envwithACCESS_KEY) before starting the Node process.Useful? React with 👍 / 👎.