Update Dockerfile

Dockerfile

@@ -1,5 +1,5 @@
 # ============================================================
-#  Hermes Agent — Self-contained HF Spaces deployment (Stable v7.9)
+#  Hermes Agent — Self-contained HF Spaces deployment (Stable v8.0)
 #  Single Dockerfile: Gateway + Dashboard + Chat WebUI + Router
 #
 #  HOW TO DEPLOY:
@@ -41,7 +41,6 @@ ENV PYTHONUNBUFFERED=1 \
     TERM=xterm-256color \
     SHELL=/bin/bash \
     SYNC_INTERVAL=30 \
-    HF_HOME=/tmp/.hf_home \
     # ── BROWSER FIX: Force --no-sandbox + --disable-dev-shm-usage for ALL
     # Chromium launches. HuggingFace Spaces (like most containers/VMs) runs
     # with AppArmor unprivileged user namespace restrictions enabled, which
@@ -67,12 +66,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/* \
     && uv pip install --python /opt/hermes/.venv/bin/python \
        --no-cache-dir "huggingface_hub>=0.22" pyyaml \
-    # FIX: Install Hugging Face CLI binary securely and mirror it to public directories
-    # with global execution privileges to prevent "hf: command not found" inside unprivileged containers
-    && curl -LsSf https://hf.co/cli/install.sh | bash \
-    && if [ -f /root/.local/bin/hf ]; then cp /root/.local/bin/hf /usr/local/bin/hf; fi \
-    && cp /usr/local/bin/hf /usr/bin/hf || true \
-    && chmod a+rx /usr/local/bin/hf /usr/bin/hf || true
+    # FIX: Install Hugging Face CLI binary directly to /usr/local/bin to prevent 
+    # permission access failures for unprivileged users (avoiding "hf: command not found")
+    && curl -LsSf https://hf.co/cli/install.sh | BINDIR=/usr/local/bin sh \
+    && chmod a+rx /usr/local/bin/hf || true
 
 # ── Clone Hermes WebUI ────────────────────────────────────────
 RUN git clone --depth 1 https://github.com/nesquena/hermes-webui.git /opt/hermes-webui \
@@ -539,6 +536,9 @@ RUN find /opt/hermes/.playwright -type f -name "chrome" | while read -r chrome_b
 RUN cat > /opt/start.sh << 'ENDSH'
 #!/usr/bin/env bash
 set -euo pipefail
+
+# FIX: Explicitly prepend /usr/local/bin to PATH to guarantee the globally installed
+# 'hf' binary is natively discoverable by start.sh running under the 'hermes' user scope.
 export PATH="/opt/hermes/.venv/bin:/opt/data/.local/bin:/usr/local/bin:/usr/bin:/bin:$PATH"
 
 HH="${HERMES_HOME:-/data}"