Upload 17 files

Dockerfile

@@ -2,9 +2,7 @@
 FROM python:3.12-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl ca-certificates \
-    gnome-keyring libsecret-tools dbus dbus-x11 \
-    && rm -rf /var/lib/apt/lists/*
+    curl ca-certificates && rm -rf /var/lib/apt/lists/*
 
 # HF Spaces run as uid 1000.
 RUN useradd -m -u 1000 user

app/agy_bridge.py

@@ -58,7 +58,8 @@ _ready_homes: set[str] = set()
 # redirect HOME per key, each key's home needs its own copy of the credential.
 # No-op on Windows (AGY_CREDS_JSON unset -> uses the shared OS keyring).
 _CREDS_JSON = os.environ.get("AGY_CREDS_JSON", "").strip()
-_CREDS_FILENAME = os.environ.get("AGY_CREDS_FILENAME", "credentials.json")
+# agy reads its OAuth token from this file (relative to HOME), confirmed on Linux.
+_CREDS_FILENAME = os.environ.get("AGY_CREDS_FILENAME", "antigravity-oauth-token")
 
 
 class AgyError(RuntimeError):
@@ -78,7 +79,12 @@ def ensure_home(home: Path) -> None:
     cfg_dir.mkdir(parents=True, exist_ok=True)
     (cfg_dir / "settings.json").write_text(json.dumps(_HARDENED_SETTINGS, indent=2), encoding="utf-8")
     if _CREDS_JSON:  # Linux/HF: each isolated home gets the credential file
-        (cfg_dir / _CREDS_FILENAME).write_text(_CREDS_JSON, encoding="utf-8")
+        cf = cfg_dir / _CREDS_FILENAME
+        cf.write_text(_CREDS_JSON, encoding="utf-8")
+        try:
+            os.chmod(cf, 0o600)
+        except OSError:
+            pass
     _ready_homes.add(key)
 
 

start.sh

@@ -1,31 +1,10 @@
 #!/usr/bin/env bash
-# Antaram startup on HF (Linux). agy authenticates via the OS keyring (Secret
-# Service), so we run a headless gnome-keyring and seed the token into it.
+# Antaram startup on HF (Linux). agy reads its OAuth token from a file
+# (.gemini/antigravity-cli/antigravity-oauth-token); each per-key home gets its
+# own copy via agy_bridge.ensure_home(). We also write it to AGY_CREDS_PATH if set.
 set -e
 
-# 1) D-Bus session + unlocked gnome-keyring secrets service.
-export $(dbus-launch)
-eval "$(printf '\n' | gnome-keyring-daemon --unlock --components=secrets 2>/dev/null)" || true
-printf '\n' | gnome-keyring-daemon --start --components=secrets 2>/dev/null || true
-sleep 2
-
-# 2) Seed the agy OAuth credential into the keyring.
-#    Windows target was "gemini:antigravity" => Secret Service service/username.
-KR_SERVICE="${AGY_KEYRING_SERVICE:-gemini}"
-KR_USER="${AGY_KEYRING_USER:-antigravity}"
-if [ -n "$AGY_CREDS_JSON" ]; then
-  if printf '%s' "$AGY_CREDS_JSON" | secret-tool store --label="${KR_SERVICE}:${KR_USER}" \
-        service "$KR_SERVICE" username "$KR_USER" 2>/dev/null; then
-    echo "[start] seeded keyring credential (${KR_SERVICE}:${KR_USER})"
-  else
-    echo "[start] WARN: secret-tool store failed (keyring may be unavailable)"
-  fi
-fi
-
-# 3) Also drop the credential as a file (per-key homes do their own copy too).
 python -c "from app.bootstrap import ensure_credentials; print('[start] creds file ->', ensure_credentials())" || true
-
 echo "[start] agy version: $(${AGY_BIN:-agy} --version 2>/dev/null || echo '??')"
 
-# 4) Serve (HF routes to $PORT, default 7860).
 exec uvicorn app.agy_server:app --host 0.0.0.0 --port "${PORT:-7860}"