From 6de223133cf4eae8c173fdf9d0dabeea9374c605 Mon Sep 17 00:00:00 2001
From: casjay <git-admin@casjaysdev.pro>
Date: Mon, 27 Jul 2026 15:52:22 -0400
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20Fix=20entrypoint=20hijacking=20a?=
 =?UTF-8?q?ny=20passed=20command=20into=20daemon=20mode=20=F0=9F=90=9B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- rootfs/usr/local/bin/entrypoint.sh: the "start all services" gate
  (`if [ "$START_SERVICES" = "yes" ] || [ -z "$1" ]`) always evaluated true
  on a first-run container regardless of $1, because START_SERVICES is
  force-set to "yes" whenever no PID file exists yet. This meant any
  command passed to `docker run` — `exec ...`, `sh -c ...`, `shell`, or an
  arbitrary program — was swallowed into the service-start+monitor branch
  before ever reaching the `case "$1"` statement that already handles
  those subcommands correctly, causing the container to hang as a
  persistent daemon instead of running the given command. Changed the
  condition to `if [ -z "$1" ]` so the daemon branch only fires when no
  command was given at all, matching the default case's own `$# -eq 0`
  check further down. Verified `bash -n` passes; script-lint confirms the
  edited block is clean (3 unrelated pre-existing findings logged to
  TODO.AI.md).
- TODO.AI.md: logged 3 pre-existing script-lint findings in this same
  file (two bare `exit` statements, one missing VERSION= stamp) found
  incidentally while linting the fix above — out of scope for this
  change since this file is regenerated wholesale from the shared
  upstream template.
---
 TODO.AI.md                         | 17 +++++++++++++++++
 rootfs/usr/local/bin/entrypoint.sh |  7 +++++--
 2 files changed, 22 insertions(+), 2 deletions(-)
 create mode 100644 TODO.AI.md

diff --git a/TODO.AI.md b/TODO.AI.md
new file mode 100644
index 0000000..f67a185
--- /dev/null
+++ b/TODO.AI.md
@@ -0,0 +1,17 @@
+# TODO.AI.md
+
+## script-lint findings in rootfs/usr/local/bin/entrypoint.sh (pre-existing, not fixed yet)
+
+Found while lint-checking the START_SERVICES gate fix (commit that changed
+`if [ "$START_SERVICES" = "yes" ] || [ -z "$1" ]; then` to `if [ -z "$1" ]; then`).
+These predate that change and are out of scope for it — this file is regenerated
+wholesale from the upstream template in AI.md Step 2, so the same issues likely
+exist in the template itself and in every other dockersrc/casjaysdevdocker repo
+built from it.
+
+- [ ] line 553 (`cron` case handler): bare `exit` with no code — use `exit 0`,
+  `exit 1`, or `exit "$?"` to be explicit
+- [ ] line 652 (`start` case handler): bare `exit` with no code — same fix
+- [ ] script header `##@Version 202607082023-git` has no matching `VERSION=`
+  assignment in the script body — add `VERSION="202607082023-git"` after the
+  header block to satisfy the version-stamp rule
diff --git a/rootfs/usr/local/bin/entrypoint.sh b/rootfs/usr/local/bin/entrypoint.sh
index 4bce2d8..27fc22a 100755
--- a/rootfs/usr/local/bin/entrypoint.sh
+++ b/rootfs/usr/local/bin/entrypoint.sh
@@ -481,8 +481,11 @@ SKIP_SERVICE_START="no"
 [ "$1" = "init" ] && SKIP_SERVICE_START="yes" && CONTAINER_INIT="yes"
 [ "$2" = "init" ] && SKIP_SERVICE_START="yes" && CONTAINER_INIT="yes"
 # - - - - - - - - - - - - - - - - - - - - - - - - -
-# Start all services if no pidfile and not skipping
-if [ "$START_SERVICES" = "yes" ] || [ -z "$1" ]; then
+# Start all services only when no command was given at all — an explicit
+# command (exec, shell, tail, or an arbitrary program) must reach the case
+# statement below instead of being swallowed into daemon/monitor mode, even
+# on a first run where START_SERVICES is force-set to "yes"
+if [ -z "$1" ]; then
   if [ "$SKIP_SERVICE_START" = "no" ]; then
     [ "$1" = "start" ] && shift 1
     [ "$1" = "all" ] && shift 1