refactor: overhaul workspace sync to use robust huggingface_hub operations and local fingerprinting

CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.4.0] - 2026-04-25
+
+### Added
+
+- **Custom OpenAI-compatible provider registration** — HuggingClaw can now register a custom provider at startup with `CUSTOM_PROVIDER_NAME`, `CUSTOM_BASE_URL`, and `CUSTOM_MODEL_ID`, so you can point `LLM_MODEL` at your own OpenAI-compatible endpoint without modifying the OpenClaw CLI
+
+### Changed
+
+- **HF backup flow simplified** — HuggingClaw now uses `huggingface_hub` directly for restore and sync, matching the safer dataset-based pattern used in Hugging8n
+- **HF username no longer required in most cases** — backup namespace resolution now works from `HF_USERNAME`, `SPACE_AUTHOR_NAME`, or the authenticated HF token, so `HF_TOKEN` is usually enough on its own
+- **Startup restore path modernized** — startup now restores workspace and hidden state through `workspace-sync.py restore` instead of configuring a token-bearing git remote
+- **README refreshed for the new backup model** — documentation now describes token-only backup setup, the removed git sync assumptions, and the hardened dashboard helper behavior
+
+### Fixed
+
+- **HF token exposure risk in git remotes** — removed the old authenticated remote URL pattern that could leave `HF_TOKEN` embedded in workspace git configuration
+- **Backup status detection mismatch** — dashboard and startup summary now treat backup as enabled when `HF_TOKEN` is present, which matches the new auto-namespace flow
+- **UptimeRobot setup hardening gap** — dashboard setup now supports explicit enable/disable control, request rate limiting, origin validation, and earlier API-key validation
+
 ## [1.3.0] - 2026-04-04
 
 ### Added

README.md

@@ -50,7 +50,7 @@ secrets:
 - ⚡ **Zero Config:** Duplicate this Space and set **just three** secrets (LLM_API_KEY, LLM_MODEL, GATEWAY_TOKEN) – no other setup needed.
 - 🐳 **Fast Builds:** Uses a pre-built OpenClaw Docker image to deploy in minutes.
 - 🌐 **Built-In Browser:** Headless Chromium is included in the Space, so browser actions work from the start.
-- 💾 **Workspace Backup:** Chats, settings, and WhatsApp session state sync to a private HF Dataset via the `huggingface_hub` (Git fallback), preserving data automatically.
+- 💾 **Workspace Backup:** Chats, settings, and WhatsApp session state sync to a private HF Dataset via the `huggingface_hub`, preserving data automatically without storing your HF token in a git remote.
 - ⏰ **External Keep-Alive:** Set up a one-time UptimeRobot monitor from the dashboard to help keep free HF Spaces awake.
 - 👥 **Multi-User Messaging:** Support for Telegram (multi-user) and WhatsApp (pairing).
 - 📊 **Visual Dashboard:** Beautiful Web UI to monitor uptime, sync status, and active models.
@@ -120,16 +120,16 @@ To use WhatsApp, enable the channel and scan the QR code from the Control UI (**
 
 ## 💾 Workspace Backup *(Optional)*
 
-For persistent chat history and configuration, HuggingClaw can sync your workspace to a private HuggingFace Dataset. On first run, it will automatically create (or use) the Dataset repo `HF_USERNAME/SPACE-backup`, restore your workspace on startup, and sync changes periodically.
+As of **v1.4.0**, HuggingClaw uses the safer API-based backup flow by default: no token-bearing git remote is configured, and `HF_USERNAME` is usually optional.
+
+For persistent chat history and configuration, HuggingClaw can sync your workspace to a private HuggingFace Dataset. On first run, it will automatically create (or use) the Dataset repo `<your-account>/huggingclaw-backup`, restore your workspace on startup, and sync changes periodically. In most cases, `HF_USERNAME` is no longer required because HuggingClaw can derive the namespace from your token automatically.
 
 | Variable | Default | Description |
 | :--- | :--- | :--- |
-| `HF_USERNAME` | — | Your HuggingFace username |
+| `HF_USERNAME` | — | Optional override for the HuggingFace username/namespace |
 | `HF_TOKEN` | — | HF token with write access |
 | `BACKUP_DATASET_NAME` | `huggingclaw-backup` | Dataset name for backup repo |
 | `SYNC_INTERVAL` | `180` | Sync interval in seconds |
-| `WORKSPACE_GIT_USER` | `openclaw@example.com` | Git commit email for syncs |
-| `WORKSPACE_GIT_NAME` | `OpenClaw Bot` | Git commit name for syncs |
 
 > [!TIP]
 > This backup also stores a hidden copy of your WhatsApp session credentials, allowing paired logins to survive Space restarts automatically.
@@ -155,6 +155,7 @@ What happens next:
 - You only need to do this once
 
 You do **not** need to add this key to Hugging Face Space Secrets.
+The dashboard helper also rate-limits setup requests and rejects cross-origin submissions.
 
 Note:
 
@@ -290,7 +291,7 @@ openclaw channels login --gateway https://YOUR_SPACE_NAME.hf.space
 HuggingClaw/
 ├── Dockerfile          # Multi-stage build using pre-built OpenClaw image
 ├── start.sh            # Config generator, validator, and orchestrator
-├── workspace-sync.py   # Syncs workspace to HF Datasets (with Git fallback)
+├── workspace-sync.py   # Syncs workspace/state to HF Datasets via huggingface_hub
 ├── health-server.js    # /health endpoint for uptime checks
 ├── dns-fix.js          # DNS-over-HTTPS fallback (for blocked domains)
 ├── .env.example        # Environment variable reference
@@ -299,8 +300,8 @@ HuggingClaw/
 **Startup sequence:**
 1. Validate required secrets (fail fast with clear error).
 2. Check HF token (warn if expired or missing).
-3. Auto-create backup dataset if missing.
-4. Restore workspace from HF Dataset.
+3. Resolve the backup namespace from `HF_USERNAME`, `SPACE_AUTHOR_NAME`, or the HF token.
+4. Auto-create backup dataset if missing and restore workspace/state from it.
 5. Generate `openclaw.json` from environment variables.
 6. Print startup summary.
 7. Launch background tasks (auto-sync and optional channel helpers).
@@ -312,11 +313,11 @@ HuggingClaw/
 
 - **Missing secrets:** Ensure `LLM_API_KEY`, `LLM_MODEL`, and `GATEWAY_TOKEN` are set in your Space **Settings → Secrets**.
 - **Telegram bot issues:** Verify your `TELEGRAM_BOT_TOKEN`. Check Space logs for lines like `📱 Enabling Telegram`.
-- **Backup restore failing:** Make sure `HF_USERNAME` and `HF_TOKEN` are correct (token needs write access to your Dataset).
+- **Backup restore failing:** Make sure `HF_TOKEN` is valid and has write access to your HF account dataset. Set `HF_USERNAME` only if auto-detection is not available in your environment.
 - **Space keeps sleeping:** Open `/` and use `Keep Space Awake` to create the external monitor.
 - **Auth errors / proxy:** If you see reverse-proxy auth errors, add the logged IPs under `TRUSTED_PROXIES` (from logs `remote=x.x.x.x`).
 - **Control UI says too many failed authentication attempts:** Wait for the retry window to expire, then open the Space in an incognito window or clear site storage for your Space before logging in again with `GATEWAY_TOKEN`.
-- **WhatsApp lost its session after restart:** Make sure `HF_USERNAME` and `HF_TOKEN` are configured so the hidden session backup can be restored on boot.
+- **WhatsApp lost its session after restart:** Make sure `HF_TOKEN` is configured so the hidden session backup can be restored on boot.
 - **UI blocked (CORS):** Set `ALLOWED_ORIGINS=https://your-space-name.hf.space`.
 - **Version mismatches:** Pin a specific OpenClaw build with the `OPENCLAW_VERSION` Variable in HF Spaces, or `--build-arg OPENCLAW_VERSION=...` locally.
 

health-server.js

@@ -12,7 +12,7 @@ const LLM_MODEL = process.env.LLM_MODEL || "Not Set";
 const TELEGRAM_ENABLED = !!process.env.TELEGRAM_BOT_TOKEN;
 const WHATSAPP_ENABLED = /^true$/i.test(process.env.WHATSAPP_ENABLED || "");
 const WHATSAPP_STATUS_FILE = "/tmp/huggingclaw-wa-status.json";
-const HF_BACKUP_ENABLED = !!(process.env.HF_USERNAME && process.env.HF_TOKEN);
+const HF_BACKUP_ENABLED = !!process.env.HF_TOKEN;
 const SYNC_INTERVAL = process.env.SYNC_INTERVAL || "600";
 const DASHBOARD_BASE = "/dashboard";
 const DASHBOARD_STATUS_PATH = `${DASHBOARD_BASE}/status`;
@@ -20,8 +20,16 @@ const DASHBOARD_HEALTH_PATH = `${DASHBOARD_BASE}/health`;
 const DASHBOARD_UPTIMEROBOT_PATH = `${DASHBOARD_BASE}/uptimerobot/setup`;
 const DASHBOARD_APP_BASE = `${DASHBOARD_BASE}/app`;
 const APP_BASE = "/app";
+const UPTIMEROBOT_SETUP_ENABLED =
+  String(process.env.UPTIMEROBOT_SETUP_ENABLED || "true").toLowerCase() ===
+  "true";
+const UPTIMEROBOT_RATE_WINDOW_MS = 60 * 1000;
+const UPTIMEROBOT_RATE_MAX = Number(
+  process.env.UPTIMEROBOT_RATE_LIMIT_PER_MINUTE || 5,
+);
 const SPACE_VISIBILITY_TTL_MS = 10 * 60 * 1000;
 const spaceVisibilityCache = new Map();
+const uptimerobotRateMap = new Map();
 
 function parseRequestUrl(url) {
   try {
@@ -80,19 +88,59 @@ function appendForwarded(existingValue, nextValue) {
   return `${existingValue}, ${cleanNext}`;
 }
 
+function getForwardedClientIp(req) {
+  const forwardedFor = req.headers["x-forwarded-for"];
+  if (Array.isArray(forwardedFor) && forwardedFor.length > 0) {
+    return String(forwardedFor[0]).split(",")[0].trim();
+  }
+  if (typeof forwardedFor === "string" && forwardedFor.trim()) {
+    return forwardedFor.split(",")[0].trim();
+  }
+  return req.socket.remoteAddress || "";
+}
+
 function buildProxyHeaders(headers, remoteAddress) {
   return {
     ...headers,
-    host: headers.host || `${GATEWAY_HOST}:${GATEWAY_PORT}`,
-    "x-forwarded-for": appendForwarded(
-      headers["x-forwarded-for"],
-      remoteAddress,
-    ),
-    "x-forwarded-host": headers["x-forwarded-host"] || headers.host || "",
+    host: `${GATEWAY_HOST}:${GATEWAY_PORT}`,
+    "x-forwarded-for": remoteAddress || "",
+    "x-forwarded-host": headers.host || "",
     "x-forwarded-proto": headers["x-forwarded-proto"] || "https",
   };
 }
 
+function getRequesterIp(req) {
+  return (
+    getForwardedClientIp(req) ||
+    req.socket.remoteAddress ||
+    "unknown"
+  );
+}
+
+function isRateLimited(req) {
+  const now = Date.now();
+  const ip = getRequesterIp(req);
+  const bucket = uptimerobotRateMap.get(ip) || [];
+  const recent = bucket.filter((ts) => now - ts < UPTIMEROBOT_RATE_WINDOW_MS);
+  recent.push(now);
+  uptimerobotRateMap.set(ip, recent);
+  return recent.length > UPTIMEROBOT_RATE_MAX;
+}
+
+function isAllowedUptimeSetupOrigin(req) {
+  const host = String(req.headers.host || "").toLowerCase();
+  const origin = String(req.headers.origin || "").toLowerCase();
+  const referer = String(req.headers.referer || "").toLowerCase();
+  if (!host) return false;
+  if (origin && !origin.includes(host)) return false;
+  if (referer && !referer.includes(host)) return false;
+  return true;
+}
+
+function isValidUptimeApiKey(key) {
+  return /^[A-Za-z0-9_-]{20,128}$/.test(String(key || ""));
+}
+
 function readSyncStatus() {
   try {
     if (fs.existsSync("/tmp/sync-status.json")) {
@@ -231,7 +279,13 @@ function renderSyncBadge(syncData) {
 
 function renderDashboard(initialData) {
   const controlUiHref = `${APP_BASE}/`;
-  const keepAwakeHtml = initialData.spacePrivate
+  const keepAwakeHtml = !UPTIMEROBOT_SETUP_ENABLED
+    ? `
+            <div id="uptimerobot-private-note" class="helper-summary">
+                UptimeRobot setup is disabled for this Space.
+            </div>
+        `
+    : initialData.spacePrivate
     ? `
             <div id="uptimerobot-private-note" class="helper-summary">
                 <strong>This Space is private.</strong> External monitors cannot reliably access private HF health URLs, so keep-awake setup is only available on public Spaces.
@@ -739,6 +793,7 @@ function renderDashboard(initialData) {
 
         const monitorStateKey = 'huggingclaw_uptimerobot_setup_v1';
         const KEEP_AWAKE_PRIVATE = ${initialData.spacePrivate ? "true" : "false"};
+        const KEEP_AWAKE_SETUP_ENABLED = ${UPTIMEROBOT_SETUP_ENABLED ? "true" : "false"};
 
         function setMonitorUiState(isConfigured) {
             const summary = document.getElementById('uptimerobot-summary');
@@ -824,7 +879,7 @@ function renderDashboard(initialData) {
         updateStats();
         setInterval(updateStats, 10000);
         document.getElementById('control-ui-link').setAttribute('href', getDashboardBase() + '/app/' + getCurrentSearch());
-        if (!KEEP_AWAKE_PRIVATE) {
+        if (KEEP_AWAKE_SETUP_ENABLED && !KEEP_AWAKE_PRIVATE) {
             restoreMonitorUiState();
             document.getElementById('uptimerobot-btn').addEventListener('click', setupUptimeRobot);
             document.getElementById('uptimerobot-toggle').addEventListener('click', toggleMonitorSetup);
@@ -942,13 +997,14 @@ async function createUptimeRobotMonitor(apiKey, host) {
 }
 
 function proxyHttp(req, res, proxyPath = req.url, proxyPort = GATEWAY_PORT) {
+  const clientIp = getForwardedClientIp(req);
   const proxyReq = http.request(
     {
       hostname: GATEWAY_HOST,
       port: proxyPort,
       method: req.method,
       path: proxyPath,
-      headers: buildProxyHeaders(req.headers, req.socket.remoteAddress),
+      headers: buildProxyHeaders(req.headers, clientIp),
     },
     (proxyRes) => {
       res.writeHead(proxyRes.statusCode || 502, proxyRes.headers);
@@ -970,7 +1026,7 @@ function proxyHttp(req, res, proxyPath = req.url, proxyPort = GATEWAY_PORT) {
   req.pipe(proxyReq);
 }
 
-function serializeUpgradeHeaders(req, remoteAddress) {
+function serializeUpgradeHeaders(req, clientIp, proxyPort) {
   const forwardedHeaders = [];
 
   for (let i = 0; i < req.rawHeaders.length; i += 2) {
@@ -979,6 +1035,7 @@ function serializeUpgradeHeaders(req, remoteAddress) {
     const lower = name.toLowerCase();
 
     if (
+      lower === "host" ||
       lower === "x-forwarded-for" ||
       lower === "x-forwarded-host" ||
       lower === "x-forwarded-proto"
@@ -990,10 +1047,13 @@ function serializeUpgradeHeaders(req, remoteAddress) {
   }
 
   forwardedHeaders.push(
-    `X-Forwarded-For: ${appendForwarded(req.headers["x-forwarded-for"], remoteAddress)}`,
+    `Host: ${GATEWAY_HOST}:${proxyPort}`,
   );
   forwardedHeaders.push(
-    `X-Forwarded-Host: ${req.headers["x-forwarded-host"] || req.headers.host || ""}`,
+    `X-Forwarded-For: ${clientIp || ""}`,
+  );
+  forwardedHeaders.push(
+    `X-Forwarded-Host: ${req.headers.host || ""}`,
   );
   forwardedHeaders.push(
     `X-Forwarded-Proto: ${req.headers["x-forwarded-proto"] || "https"}`,
@@ -1010,11 +1070,12 @@ function proxyUpgrade(
   proxyPort = GATEWAY_PORT,
 ) {
   const proxySocket = net.connect(proxyPort, GATEWAY_HOST);
+  const clientIp = getForwardedClientIp(req);
 
   proxySocket.on("connect", () => {
     const requestLines = [
       `${req.method} ${proxyPath} HTTP/${req.httpVersion}`,
-      ...serializeUpgradeHeaders(req, req.socket.remoteAddress),
+      ...serializeUpgradeHeaders(req, clientIp, proxyPort),
       "",
       "",
     ];
@@ -1092,15 +1153,33 @@ const server = http.createServer((req, res) => {
 
     void (async () => {
       try {
+        if (!UPTIMEROBOT_SETUP_ENABLED) {
+          res.writeHead(403, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ message: "Uptime setup is disabled." }));
+          return;
+        }
+
+        if (isRateLimited(req)) {
+          res.writeHead(429, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ message: "Too many requests." }));
+          return;
+        }
+
+        if (!isAllowedUptimeSetupOrigin(req)) {
+          res.writeHead(403, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ message: "Invalid request origin." }));
+          return;
+        }
+
         const body = await readRequestBody(req);
         const parsed = JSON.parse(body || "{}");
         const apiKey = String(parsed.apiKey || "").trim();
 
-        if (!apiKey) {
+        if (!isValidUptimeApiKey(apiKey)) {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end(
             JSON.stringify({
-              message: "Paste your UptimeRobot Main API key first.",
+              message: "A valid API key is required.",
             }),
           );
           return;

start.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
-set -e
+set -euo pipefail
+
+umask 0077
 
 # ════════════════════════════════════════════════════════════════
 # HuggingClaw — OpenClaw Gateway for HF Spaces
@@ -127,95 +129,13 @@ if [ -n "$HF_TOKEN" ]; then
   fi
 fi
 
-# ── Auto-create + Restore workspace from HF Dataset ──
-if [ -n "$HF_USERNAME" ] && [ -n "$HF_TOKEN" ]; then
-  BACKUP_DATASET="${BACKUP_DATASET_NAME:-huggingclaw-backup}"
-  BACKUP_URL="https://${HF_USERNAME}:${HF_TOKEN}@huggingface.co/datasets/${HF_USERNAME}/${BACKUP_DATASET}"
-  
-  # Auto-create the dataset if it doesn't exist
-  echo "📦 Checking HF Dataset: ${HF_USERNAME}/${BACKUP_DATASET}..."
-  DATASET_CHECK=$(curl -s -o /dev/null -w "%{http_code}" \
-    -H "Authorization: Bearer $HF_TOKEN" \
-    "https://huggingface.co/api/datasets/${HF_USERNAME}/${BACKUP_DATASET}" \
-    --max-time 10 2>/dev/null || echo "000")
-  
-  if [ "$DATASET_CHECK" = "404" ]; then
-    echo "  📝 Dataset not found, creating ${HF_USERNAME}/${BACKUP_DATASET}..."
-    CREATE_RESULT=$(curl -s -w "\n%{http_code}" \
-      -X POST "https://huggingface.co/api/repos/create" \
-      -H "Authorization: Bearer $HF_TOKEN" \
-      -H "Content-Type: application/json" \
-      -d "{\"type\":\"dataset\",\"name\":\"${BACKUP_DATASET}\",\"private\":true}" \
-      --max-time 15 2>/dev/null || echo "error")
-    CREATE_STATUS=$(echo "$CREATE_RESULT" | tail -1)
-    if [ "$CREATE_STATUS" = "200" ] || [ "$CREATE_STATUS" = "201" ]; then
-      echo "  ✅ Dataset created: ${HF_USERNAME}/${BACKUP_DATASET} (private)"
-    else
-      echo "  ⚠️  Could not create dataset (HTTP $CREATE_STATUS). Create it manually:"
-      echo "     https://huggingface.co/datasets/create"
-    fi
-  elif [ "$DATASET_CHECK" = "200" ]; then
-    echo "  ✅ Dataset exists"
-  else
-    echo "  ⚠️  Could not check dataset (HTTP $DATASET_CHECK)"
-  fi
-  
-  # Restore workspace
-  echo "📦 Restoring workspace..."
-  WORKSPACE="/home/node/.openclaw/workspace"
-  GIT_USER_EMAIL="${WORKSPACE_GIT_USER:-openclaw@example.com}"
-  GIT_USER_NAME="${WORKSPACE_GIT_NAME:-OpenClaw Bot}"
-  
-  cd "$WORKSPACE"
-  if [ ! -d ".git" ]; then
-    git init -q
-    git remote add origin "$BACKUP_URL"
-  else
-    git remote set-url origin "$BACKUP_URL"
-  fi
-  
-  git config user.email "$GIT_USER_EMAIL"
-  git config user.name "$GIT_USER_NAME"
-  
-  if git fetch origin main 2>/dev/null; then
-    git reset --hard origin/main 2>/dev/null && echo "  ✅ Workspace restored!"
-  else
-    echo "  ⚠️ No remote data yet, starting fresh."
-  fi
-  cd /
-fi
-
-# ── Restore persisted OpenClaw state (if present) ──
-STATE_BACKUP_ROOT="/home/node/.openclaw/workspace/.huggingclaw-state/openclaw"
-if [ -d "$STATE_BACKUP_ROOT" ]; then
-  echo "🧠 Restoring OpenClaw state..."
-  for source_path in "$STATE_BACKUP_ROOT"/*; do
-    [ -e "$source_path" ] || continue
-    name="$(basename "$source_path")"
-    target_path="/home/node/.openclaw/${name}"
-
-    rm -rf "$target_path"
-    mkdir -p "$(dirname "$target_path")"
-    cp -R "$source_path" "$target_path"
-  done
-  echo "  ✅ OpenClaw state restored"
-fi
-
-# ── Restore persisted WhatsApp credentials (if present) ──
-WA_BACKUP_DIR="/home/node/.openclaw/workspace/.huggingclaw-state/credentials/whatsapp/default"
-WA_CREDS_DIR="/home/node/.openclaw/credentials/whatsapp/default"
-if [ "$WHATSAPP_ENABLED_NORMALIZED" = "true" ] && [ -d "$WA_BACKUP_DIR" ]; then
-  WA_FILE_COUNT=$(find "$WA_BACKUP_DIR" -type f | wc -l | tr -d ' ')
-  if [ "$WA_FILE_COUNT" -ge 2 ]; then
-    echo "📱 Restoring WhatsApp credentials..."
-    rm -rf "$WA_CREDS_DIR"
-    mkdir -p "$(dirname "$WA_CREDS_DIR")"
-    cp -R "$WA_BACKUP_DIR" "$WA_CREDS_DIR"
-    chmod -R go-rwx /home/node/.openclaw/credentials/whatsapp 2>/dev/null || true
-    echo "  ✅ WhatsApp credentials restored"
-  else
-    echo "  ⚠️  Saved WhatsApp credentials look incomplete (${WA_FILE_COUNT} files), skipping restore."
-  fi
+# ── Restore workspace/state from HF Dataset ──
+BACKUP_DATASET="${BACKUP_DATASET_NAME:-huggingclaw-backup}"
+if [ -n "${HF_TOKEN:-}" ]; then
+  echo "📦 Restoring workspace and state from HF Dataset..."
+  python3 /home/node/app/workspace-sync.py restore || true
+else
+  echo "HF_TOKEN is not set. Running without dataset persistence."
 fi
 
 # ── Build config ──
@@ -419,8 +339,8 @@ printf "  │  %-40s │\n" "Browser: ✅ ${BROWSER_EXECUTABLE_PATH}"
 else
 printf "  │  %-40s │\n" "Browser: ❌ unavailable"
 fi
-if [ -n "$HF_USERNAME" ] && [ -n "$HF_TOKEN" ]; then
-printf "  │  %-40s │\n" "Backup: ✅ ${HF_USERNAME}/${BACKUP_DATASET:-huggingclaw-backup}"
+if [ -n "${HF_TOKEN:-}" ]; then
+printf "  │  %-40s │\n" "Backup: ✅ ${BACKUP_DATASET:-huggingclaw-backup} (auto namespace)"
 else
 printf "  │  %-40s │\n" "Backup: ❌ not configured"
 fi
@@ -434,7 +354,7 @@ printf "  │  %-40s │\n" "Control UI: https://${SPACE_HOST}/app"
 printf "  │  %-40s │\n" "Dashboard: https://${SPACE_HOST}"
 fi
 SYNC_STATUS="❌ disabled"
-if [ -n "$HF_USERNAME" ] && [ -n "$HF_TOKEN" ]; then
+if [ -n "${HF_TOKEN:-}" ]; then
   SYNC_STATUS="✅ every ${SYNC_INTERVAL:-180}s"
 fi
 printf "  │  %-40s │\n" "Auto-sync: $SYNC_STATUS"
@@ -459,7 +379,7 @@ graceful_shutdown() {
 
   if [ -f "/home/node/app/workspace-sync.py" ]; then
     echo "💾 Saving OpenClaw state before exit..."
-    python3 /home/node/app/workspace-sync.py --sync-once || \
+    python3 /home/node/app/workspace-sync.py sync-once || \
       echo "  ⚠️ Could not complete shutdown sync"
   fi
   
@@ -530,7 +450,9 @@ fi
 warmup_browser
 
 # 12. Start Workspace Sync after startup settles
-python3 -u /home/node/app/workspace-sync.py &
+if [ -n "${HF_TOKEN:-}" ]; then
+  python3 -u /home/node/app/workspace-sync.py loop &
+fi
 
 # Wait for gateway (allows trap to fire)
 wait $GATEWAY_PID

workspace-sync.py

@@ -1,24 +1,39 @@
 #!/usr/bin/env python3
 """
-HuggingClaw Workspace Sync — HuggingFace Hub based backup
-Uses huggingface_hub Python library instead of git for more reliable
-HF Dataset operations (handles auth, LFS, retries automatically).
+HuggingClaw workspace/state backup via huggingface_hub.
 
-Falls back to git-based sync if HF_USERNAME or HF_TOKEN are not set.
+This keeps OpenClaw workspace data, app state, and optional WhatsApp
+credentials inside a private HF dataset without embedding HF tokens in git
+remotes or requiring a manual HF_USERNAME secret.
 """
 
+import hashlib
+import json
 import os
+import shutil
+import signal
 import sys
+import tempfile
+import threading
 import time
-import signal
-import shutil
-import subprocess
 from pathlib import Path
 
 os.environ.setdefault("HF_HUB_DISABLE_PROGRESS_BARS", "1")
 
+from huggingface_hub import HfApi, snapshot_download, upload_folder
+from huggingface_hub.errors import HfHubHTTPError, RepositoryNotFoundError
+
 OPENCLAW_HOME = Path("/home/node/.openclaw")
 WORKSPACE = OPENCLAW_HOME / "workspace"
+STATUS_FILE = Path("/tmp/sync-status.json")
+INTERVAL = int(os.environ.get("SYNC_INTERVAL", "180"))
+INITIAL_DELAY = int(os.environ.get("SYNC_START_DELAY", "10"))
+HF_TOKEN = os.environ.get("HF_TOKEN", "").strip()
+HF_USERNAME = os.environ.get("HF_USERNAME", "").strip()
+SPACE_AUTHOR_NAME = os.environ.get("SPACE_AUTHOR_NAME", "").strip()
+BACKUP_DATASET_NAME = os.environ.get("BACKUP_DATASET_NAME", "huggingclaw-backup").strip()
+WHATSAPP_ENABLED = os.environ.get("WHATSAPP_ENABLED", "").strip().lower() == "true"
+
 STATE_DIR = WORKSPACE / ".huggingclaw-state"
 OPENCLAW_STATE_BACKUP_DIR = STATE_DIR / "openclaw"
 EXCLUDED_STATE_NAMES = {
@@ -27,41 +42,32 @@ EXCLUDED_STATE_NAMES = {
     "gateway.log",
     "browser",
 }
-WHATSAPP_CREDS_DIR = Path("/home/node/.openclaw/credentials/whatsapp/default")
+WHATSAPP_CREDS_DIR = OPENCLAW_HOME / "credentials" / "whatsapp" / "default"
 WHATSAPP_BACKUP_DIR = STATE_DIR / "credentials" / "whatsapp" / "default"
 RESET_MARKER = WORKSPACE / ".reset_credentials"
-INTERVAL = int(os.environ.get("SYNC_INTERVAL", "180"))
-INITIAL_DELAY = int(os.environ.get("SYNC_START_DELAY", "10"))
-HF_TOKEN = os.environ.get("HF_TOKEN", "")
-HF_USERNAME = os.environ.get("HF_USERNAME", "")
-BACKUP_DATASET = os.environ.get("BACKUP_DATASET_NAME", "huggingclaw-backup")
-WEBHOOK_URL = os.environ.get("WEBHOOK_URL", "")
-WHATSAPP_ENABLED = os.environ.get("WHATSAPP_ENABLED", "").strip().lower() == "true"
-
-running = True
+HF_API = HfApi(token=HF_TOKEN) if HF_TOKEN else None
+STOP_EVENT = threading.Event()
+_REPO_ID_CACHE: str | None = None
 
-def signal_handler(sig, frame):
-    global running
-    running = False
 
-signal.signal(signal.SIGTERM, signal_handler)
-signal.signal(signal.SIGINT, signal_handler)
+def write_status(status: str, message: str) -> None:
+    payload = {
+        "status": status,
+        "message": message,
+        "timestamp": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+    }
+    tmp_path = STATUS_FILE.with_suffix(".tmp")
+    tmp_path.write_text(json.dumps(payload), encoding="utf-8")
+    tmp_path.replace(STATUS_FILE)
 
 
 def count_files(path: Path) -> int:
-    """Count regular files recursively under a path."""
     if not path.exists():
         return 0
     return sum(1 for child in path.rglob("*") if child.is_file())
 
 
 def snapshot_state_into_workspace() -> None:
-    """
-    Mirror persistent state into the workspace-backed dataset repo.
-
-    This keeps WhatsApp credentials in a hidden folder that is synced together
-    with the workspace, without changing the live credentials location.
-    """
     try:
         STATE_DIR.mkdir(parents=True, exist_ok=True)
         if OPENCLAW_STATE_BACKUP_DIR.exists():
@@ -77,8 +83,8 @@ def snapshot_state_into_workspace() -> None:
                 shutil.copytree(source_path, backup_path)
             elif source_path.is_file():
                 shutil.copy2(source_path, backup_path)
-    except Exception as e:
-        print(f"  ⚠️ Could not snapshot OpenClaw state: {e}")
+    except Exception as exc:
+        print(f"  ⚠️ Could not snapshot OpenClaw state: {exc}")
 
     try:
         if not WHATSAPP_ENABLED:
@@ -106,233 +112,281 @@ def snapshot_state_into_workspace() -> None:
         if WHATSAPP_BACKUP_DIR.exists():
             shutil.rmtree(WHATSAPP_BACKUP_DIR, ignore_errors=True)
         shutil.copytree(WHATSAPP_CREDS_DIR, WHATSAPP_BACKUP_DIR)
-    except Exception as e:
-        print(f"  ⚠️ Could not snapshot WhatsApp state: {e}")
-
-
-def has_changes():
-    """Check if workspace has uncommitted changes (git-based check)."""
-    try:
-        subprocess.run(["git", "add", "-A"], cwd=WORKSPACE, capture_output=True)
-        result = subprocess.run(
-            ["git", "diff", "--cached", "--quiet"],
-            cwd=WORKSPACE, capture_output=True
+    except Exception as exc:
+        print(f"  ⚠️ Could not snapshot WhatsApp state: {exc}")
+
+
+def restore_embedded_state() -> None:
+    state_backup_root = STATE_DIR / "openclaw"
+    if state_backup_root.is_dir():
+        print("🧠 Restoring OpenClaw state...")
+        for source_path in state_backup_root.iterdir():
+            name = source_path.name
+            target_path = OPENCLAW_HOME / name
+            shutil.rmtree(target_path, ignore_errors=True)
+            if target_path.is_file():
+                target_path.unlink(missing_ok=True)
+            target_path.parent.mkdir(parents=True, exist_ok=True)
+            if source_path.is_dir():
+                shutil.copytree(source_path, target_path)
+            else:
+                shutil.copy2(source_path, target_path)
+        print("  ✅ OpenClaw state restored")
+
+    if WHATSAPP_ENABLED and WHATSAPP_BACKUP_DIR.is_dir():
+        file_count = count_files(WHATSAPP_BACKUP_DIR)
+        if file_count >= 2:
+            print("📱 Restoring WhatsApp credentials...")
+            shutil.rmtree(WHATSAPP_CREDS_DIR, ignore_errors=True)
+            WHATSAPP_CREDS_DIR.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copytree(WHATSAPP_BACKUP_DIR, WHATSAPP_CREDS_DIR)
+            os.chmod(OPENCLAW_HOME / "credentials", 0o700)
+            print("  ✅ WhatsApp credentials restored")
+        else:
+            print(f"  ⚠️ Saved WhatsApp credentials look incomplete ({file_count} files), skipping restore.")
+
+
+def resolve_backup_namespace() -> str:
+    global _REPO_ID_CACHE
+    if _REPO_ID_CACHE:
+        return _REPO_ID_CACHE
+
+    namespace = HF_USERNAME or SPACE_AUTHOR_NAME
+    if not namespace and HF_API is not None:
+        whoami = HF_API.whoami()
+        namespace = whoami.get("name") or whoami.get("user") or ""
+
+    namespace = str(namespace).strip()
+    if not namespace:
+        raise RuntimeError(
+            "Could not determine the Hugging Face username for backups. "
+            "Set HF_USERNAME or use a token tied to your account."
         )
-        return result.returncode != 0
-    except Exception:
-        return False
 
-def write_sync_status(status, message=""):
-    """Write sync status to file for the health server dashboard."""
-    try:
-        import json
-        data = {
-            "status": status,
-            "timestamp": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
-            "message": message
-        }
-        with open("/tmp/sync-status.json", "w") as f:
-            json.dump(data, f)
-    except Exception as e:
-        print(f"  ⚠️ Could not write sync status: {e}")
-
-def trigger_webhook(event, status, message):
-    """Trigger webhook notification."""
-    if not WEBHOOK_URL:
-        return
-    try:
-        import urllib.request
-        import json
-        data = json.dumps({
-            "event": event,
-            "status": status,
-            "message": message,
-            "timestamp": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-        }).encode('utf-8')
-        req = urllib.request.Request(WEBHOOK_URL, data=data, headers={'Content-Type': 'application/json'})
-        urllib.request.urlopen(req, timeout=10)
-    except Exception as e:
-        print(f"  ⚠️ Webhook delivery failed: {e}")
-
-def sync_with_hf_hub():
-    """Sync workspace using huggingface_hub library."""
-    try:
-        from huggingface_hub import HfApi, upload_folder
+    _REPO_ID_CACHE = f"{namespace}/{BACKUP_DATASET_NAME}"
+    return _REPO_ID_CACHE
 
-        api = HfApi(token=HF_TOKEN)
-        repo_id = f"{HF_USERNAME}/{BACKUP_DATASET}"
 
-        # Ensure dataset exists
+def ensure_repo_exists() -> str:
+    repo_id = resolve_backup_namespace()
+    try:
+        HF_API.repo_info(repo_id=repo_id, repo_type="dataset")
+    except RepositoryNotFoundError:
+        HF_API.create_repo(repo_id=repo_id, repo_type="dataset", private=True)
+    return repo_id
+
+
+def metadata_marker(root: Path) -> tuple[int, int, int]:
+    if not root.exists():
+        return (0, 0, 0)
+
+    file_count = 0
+    total_size = 0
+    newest_mtime = 0
+    for path in root.rglob("*"):
+        if not path.is_file():
+            continue
+        rel = path.relative_to(root).as_posix()
+        if rel.startswith(".git/"):
+            continue
         try:
-            api.repo_info(repo_id=repo_id, repo_type="dataset")
-        except Exception:
-            print(f"  📝 Creating dataset {repo_id}...")
-            try:
-                api.create_repo(repo_id=repo_id, repo_type="dataset", private=True)
-                print(f"  ✅ Dataset created: {repo_id}")
-            except Exception as e:
-                print(f"  ⚠️  Could not create dataset: {e}")
-                return False
-
-        # Upload workspace
-        upload_folder(
-            folder_path=str(WORKSPACE),
-            repo_id=repo_id,
-            repo_type="dataset",
-            token=HF_TOKEN,
-            commit_message=f"Auto-sync {time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())}",
-            ignore_patterns=[".git/*", ".git"],
-        )
-        return True
-
-    except ImportError:
-        print("  ⚠️  huggingface_hub not installed, falling back to git")
-        return False
-    except Exception as e:
-        print(f"  ⚠️  HF Hub sync failed: {e}")
+            stat = path.stat()
+        except OSError:
+            continue
+        file_count += 1
+        total_size += int(stat.st_size)
+        newest_mtime = max(newest_mtime, int(stat.st_mtime_ns))
+    return (file_count, total_size, newest_mtime)
+
+
+def fingerprint_dir(root: Path) -> str:
+    hasher = hashlib.sha256()
+    if not root.exists():
+        return hasher.hexdigest()
+
+    for path in sorted(p for p in root.rglob("*") if p.is_file()):
+        rel = path.relative_to(root).as_posix()
+        if rel.startswith(".git/"):
+            continue
+        hasher.update(rel.encode("utf-8"))
+        with path.open("rb") as handle:
+            for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+                hasher.update(chunk)
+    return hasher.hexdigest()
+
+
+def create_snapshot_dir(source_root: Path) -> Path:
+    staging_root = Path(tempfile.mkdtemp(prefix="huggingclaw-sync-"))
+    for path in sorted(source_root.rglob("*")):
+        rel = path.relative_to(source_root)
+        rel_posix = rel.as_posix()
+        if rel_posix.startswith(".git/") or rel_posix == ".git":
+            continue
+        target = staging_root / rel
+        if path.is_dir():
+            target.mkdir(parents=True, exist_ok=True)
+            continue
+        target.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copy2(path, target)
+    return staging_root
+
+
+def restore_workspace() -> bool:
+    if not HF_TOKEN:
+        write_status("disabled", "HF_TOKEN is not configured.")
         return False
 
+    repo_id = resolve_backup_namespace()
+    write_status("restoring", f"Restoring workspace from {repo_id}")
 
-def sync_with_git():
-    """Fallback: sync workspace using git."""
     try:
-        ts = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-        subprocess.run(["git", "add", "-A"], cwd=WORKSPACE, capture_output=True)
-        subprocess.run(
-            ["git", "commit", "-m", f"Auto-sync {ts}"],
-            cwd=WORKSPACE, capture_output=True
-        )
-        result = subprocess.run(
-            ["git", "push", "origin", "main"],
-            cwd=WORKSPACE, capture_output=True
-        )
-        return result.returncode == 0
-    except Exception:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            snapshot_download(
+                repo_id=repo_id,
+                repo_type="dataset",
+                token=HF_TOKEN,
+                local_dir=tmpdir,
+            )
+
+            tmp_path = Path(tmpdir)
+            if not any(tmp_path.iterdir()):
+                write_status("fresh", "Backup dataset is empty. Starting fresh.")
+                return True
+
+            WORKSPACE.mkdir(parents=True, exist_ok=True)
+            for child in list(WORKSPACE.iterdir()):
+                if child.name == ".git":
+                    continue
+                if child.is_dir():
+                    shutil.rmtree(child, ignore_errors=True)
+                else:
+                    child.unlink(missing_ok=True)
+
+            for child in tmp_path.iterdir():
+                if child.name == ".git":
+                    continue
+                destination = WORKSPACE / child.name
+                if child.is_dir():
+                    shutil.copytree(child, destination)
+                else:
+                    shutil.copy2(child, destination)
+
+        restore_embedded_state()
+        write_status("restored", f"Restored workspace from {repo_id}")
+        return True
+    except RepositoryNotFoundError:
+        write_status("fresh", f"Backup dataset {repo_id} does not exist yet.")
+        return True
+    except HfHubHTTPError as exc:
+        if exc.response is not None and exc.response.status_code == 404:
+            write_status("fresh", f"Backup dataset {repo_id} does not exist yet.")
+            return True
+        write_status("error", f"Restore failed: {exc}")
+        print(f"Restore failed: {exc}", file=sys.stderr)
+        return False
+    except Exception as exc:
+        write_status("error", f"Restore failed: {exc}")
+        print(f"Restore failed: {exc}", file=sys.stderr)
         return False
 
 
-def run_sync_pass(use_hf_hub: bool) -> None:
-    """Snapshot state and push it if anything changed."""
-    snapshot_state_into_workspace()
-
-    if not has_changes():
-        return
-
-    ts = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-    write_sync_status("syncing", f"Starting sync at {ts}")
-
-    if use_hf_hub:
-        if sync_with_hf_hub():
-            print(f"🔄 Workspace sync (hf_hub): pushed changes ({ts})")
-            write_sync_status("success", "Successfully pushed to HF Hub")
-            return
-
-        if sync_with_git():
-            print(f"🔄 Workspace sync (git fallback): pushed changes ({ts})")
-            write_sync_status("success", "Successfully pushed via git fallback")
-            return
-
-        msg = f"Workspace sync: failed ({ts}), will retry"
-        print(f"🔄 {msg}")
-        write_sync_status("error", msg)
-        trigger_webhook("sync", "error", msg)
-        return
-
-    if sync_with_git():
-        print(f"🔄 Workspace sync (git): pushed changes ({ts})")
-        write_sync_status("success", "Successfully pushed via git")
-        return
+def sync_once(
+    last_fingerprint: str | None = None,
+    last_marker: tuple[int, int, int] | None = None,
+) -> tuple[str, tuple[int, int, int]]:
+    if not HF_TOKEN:
+        write_status("disabled", "HF_TOKEN is not configured.")
+        return (last_fingerprint or "", last_marker or (0, 0, 0))
 
-    msg = f"Workspace sync: push failed ({ts}), will retry"
-    print(f"🔄 {msg}")
-    write_sync_status("error", msg)
-    trigger_webhook("sync", "error", msg)
+    snapshot_state_into_workspace()
+    repo_id = ensure_repo_exists()
+    current_marker = metadata_marker(WORKSPACE)
 
+    if last_marker is not None and current_marker == last_marker:
+        write_status("synced", "No workspace changes detected.")
+        return (last_fingerprint or "", current_marker)
 
-def main():
-    if "--snapshot-once" in sys.argv:
-        snapshot_state_into_workspace()
-        write_sync_status("configured", "State snapshot refreshed during shutdown.")
-        return
+    current_fingerprint = fingerprint_dir(WORKSPACE)
+    if last_fingerprint is not None and current_fingerprint == last_fingerprint:
+        write_status("synced", "No workspace changes detected.")
+        return (last_fingerprint, current_marker)
 
-    if "--sync-once" in sys.argv:
-        if not WORKSPACE.exists():
-            print("📁 Workspace sync: workspace not found, exiting.")
-            return
+    write_status("syncing", f"Uploading workspace to {repo_id}")
+    snapshot_dir = create_snapshot_dir(WORKSPACE)
+    try:
+        upload_folder(
+            folder_path=str(snapshot_dir),
+            repo_id=repo_id,
+            repo_type="dataset",
+            token=HF_TOKEN,
+            commit_message=f"HuggingClaw sync {time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())}",
+            ignore_patterns=[".git/*", ".git"],
+        )
+    finally:
+        shutil.rmtree(snapshot_dir, ignore_errors=True)
 
-        use_hf_hub = bool(HF_TOKEN and HF_USERNAME)
-        git_dir = WORKSPACE / ".git"
+    write_status("success", f"Uploaded workspace to {repo_id}")
+    return (current_fingerprint, current_marker)
 
-        if not use_hf_hub and not git_dir.exists():
-            print("📁 Workspace sync: no git repo and no HF credentials, skipping.")
-            return
 
-        snapshot_state_into_workspace()
+def handle_signal(_sig, _frame) -> None:
+    STOP_EVENT.set()
 
-        if not has_changes():
-            print("📁 Workspace sync: no changes to persist.")
-            write_sync_status("configured", "No new state changes to sync.")
-            return
 
-        ts = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-        write_sync_status("syncing", f"Shutdown sync started at {ts}")
-
-        if use_hf_hub:
-            if sync_with_hf_hub():
-                print(f"🔄 Workspace sync (hf_hub): pushed changes ({ts})")
-                write_sync_status("success", "Shutdown sync pushed to HF Hub")
-                return
-            if sync_with_git():
-                print(f"🔄 Workspace sync (git fallback): pushed changes ({ts})")
-                write_sync_status("success", "Shutdown sync pushed via git fallback")
-                return
-            write_sync_status("error", "Shutdown sync failed")
-            print("📁 Workspace sync: shutdown sync failed.")
-            return
+def loop() -> int:
+    signal.signal(signal.SIGTERM, handle_signal)
+    signal.signal(signal.SIGINT, handle_signal)
 
-        if sync_with_git():
-            print(f"🔄 Workspace sync (git): pushed changes ({ts})")
-            write_sync_status("success", "Shutdown sync pushed via git")
-            return
+    try:
+        repo_id = resolve_backup_namespace()
+        write_status("configured", f"Backup loop active for {repo_id} with {INTERVAL}s interval.")
+    except Exception as exc:
+        write_status("error", str(exc))
+        print(f"📁 Workspace sync: {exc}")
+        return 1
 
-        write_sync_status("error", "Shutdown sync failed")
-        print("📁 Workspace sync: shutdown sync failed.")
-        return
+    last_fingerprint = fingerprint_dir(WORKSPACE)
+    last_marker = metadata_marker(WORKSPACE)
 
-    if not WORKSPACE.exists():
-        print("📁 Workspace sync: workspace not found, exiting.")
-        return
+    time.sleep(INITIAL_DELAY)
+    print(f"🔄 Workspace sync started: every {INTERVAL}s → {repo_id}")
 
-    use_hf_hub = bool(HF_TOKEN and HF_USERNAME)
-    git_dir = WORKSPACE / ".git"
+    while not STOP_EVENT.is_set():
+        try:
+            last_fingerprint, last_marker = sync_once(last_fingerprint, last_marker)
+        except Exception as exc:
+            write_status("error", f"Sync failed: {exc}")
+            print(f"📁 Workspace sync failed: {exc}")
 
-    if not use_hf_hub and not git_dir.exists():
-        print("📁 Workspace sync: no git repo and no HF credentials, skipping.")
-        return
+        if STOP_EVENT.wait(INTERVAL):
+            break
 
-    # Give the gateway a short head start before the first sync probe.
-    if use_hf_hub:
-        write_sync_status("configured", f"Backup enabled. Waiting for next sync in {INTERVAL}s.")
-    else:
-        write_sync_status("configured", f"Git sync enabled. Waiting for next sync in {INTERVAL}s.")
+    return 0
 
-    # Give the gateway a short head start before the first sync probe.
-    time.sleep(INITIAL_DELAY)
 
-    if use_hf_hub:
-        print(f"🔄 Workspace sync started (huggingface_hub): every {INTERVAL}s → {HF_USERNAME}/{BACKUP_DATASET}")
-    else:
-        print(f"🔄 Workspace sync started (git): every {INTERVAL}s")
+def main() -> int:
+    WORKSPACE.mkdir(parents=True, exist_ok=True)
 
-    run_sync_pass(use_hf_hub)
+    if len(sys.argv) < 2:
+        return loop()
 
-    while running:
-        time.sleep(INTERVAL)
-        if not running:
-            break
+    command = sys.argv[1]
+    if command == "restore":
+        return 0 if restore_workspace() else 1
+    if command == "sync-once":
+        try:
+            sync_once()
+            return 0
+        except Exception as exc:
+            write_status("error", f"Shutdown sync failed: {exc}")
+            print(f"📁 Workspace sync: shutdown sync failed: {exc}")
+            return 1
+    if command == "loop":
+        return loop()
 
-        run_sync_pass(use_hf_hub)
+    print(f"Unknown command: {command}", file=sys.stderr)
+    return 1
 
 
 if __name__ == "__main__":
-    main()
+    raise SystemExit(main())