From 018328b59d68c3614cc75df921c76e6c4f8e2269 Mon Sep 17 00:00:00 2001
From: HashWarlock <hashwarlock@protonmail.com>
Date: Mon, 26 Jan 2026 19:36:41 -0600
Subject: [PATCH] fix(docker): clean orphaned session locks on gateway restart

Gateway SIGUSR1 restart keeps PID=1 alive but clears in-memory lock state,
leaving .lock files that appear valid but are orphaned. This causes session
file lock timeouts when new agent sessions try to acquire the same locks.

Solution: On container start, clean all session lock files since they're
guaranteed orphaned (new process state). Lock files are safe to remove on
startup because the gateway hasn't started any agent sessions yet.

Fixes session lock timeout errors after gateway restarts in Docker.
---
 scripts/docker-entrypoint-phala.sh | 38 ++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/scripts/docker-entrypoint-phala.sh b/scripts/docker-entrypoint-phala.sh
index 5ae64f7bf..37c1b8830 100755
--- a/scripts/docker-entrypoint-phala.sh
+++ b/scripts/docker-entrypoint-phala.sh
@@ -42,12 +42,46 @@ if [ ! -f "$CONFIG_FILE" ] && [ -n "$REDPILL_API_KEY" ]; then
     --gateway-bind loopback \
     $GATEWAY_AUTH_ARGS \
     --skip-daemon \
-    --skip-channels \
     --skip-skills \
     --skip-health \
     --skip-ui
 
-  echo "Auto-configuration complete. Starting gateway..."
+  echo "Auto-configuration complete."
+
+  # Configure channel allowlists if user IDs are provided
+  if [ -n "$TELEGRAM_ALLOWED_USERS" ] || [ -n "$DISCORD_ALLOWED_USERS" ]; then
+    echo "Configuring channel allowlists..."
+
+    if [ -n "$TELEGRAM_ALLOWED_USERS" ]; then
+      # Convert comma-separated list to JSON array
+      TELEGRAM_IDS=$(echo "$TELEGRAM_ALLOWED_USERS" | sed 's/,/", "/g' | sed 's/^/"/' | sed 's/$/"/')
+      node dist/index.js config set channels.telegram.dmPolicy allowlist || true
+      node dist/index.js config set "channels.telegram.allowFrom" "[$TELEGRAM_IDS]" --json || true
+      echo "✓ Telegram allowlist configured: $TELEGRAM_ALLOWED_USERS"
+    fi
+
+    if [ -n "$DISCORD_ALLOWED_USERS" ]; then
+      # Convert comma-separated list to JSON array
+      DISCORD_IDS=$(echo "$DISCORD_ALLOWED_USERS" | sed 's/,/", "/g' | sed 's/^/"/' | sed 's/$/"/')
+      node dist/index.js config set channels.discord.dm.policy allowlist || true
+      node dist/index.js config set "channels.discord.dm.allowFrom" "[$DISCORD_IDS]" --json || true
+      echo "✓ Discord allowlist configured: $DISCORD_ALLOWED_USERS"
+    fi
+  fi
+
+  echo "Starting gateway..."
+fi
+
+# Clean orphaned session locks from previous gateway restarts
+# Gateway SIGUSR1 restart keeps PID=1 but clears in-memory lock state,
+# leaving lock files that appear valid but are actually orphaned.
+SESSIONS_DIR="$CONFIG_DIR/agents/main/sessions"
+if [ -d "$SESSIONS_DIR" ]; then
+  LOCK_COUNT=$(find "$SESSIONS_DIR" -name "*.lock" -type f 2>/dev/null | wc -l)
+  if [ "$LOCK_COUNT" -gt 0 ]; then
+    echo "Cleaning $LOCK_COUNT orphaned session lock(s)..."
+    find "$SESSIONS_DIR" -name "*.lock" -type f -delete 2>/dev/null || true
+  fi
 fi
 
 # Start the gateway