Upload 2 files

Dockerfile

@@ -2,7 +2,9 @@
 FROM python:3.12-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl ca-certificates && rm -rf /var/lib/apt/lists/*
+    curl ca-certificates \
+    gnome-keyring libsecret-tools dbus dbus-x11 \
+    && rm -rf /var/lib/apt/lists/*
 
 # HF Spaces run as uid 1000.
 RUN useradd -m -u 1000 user

start.sh

@@ -1,14 +1,31 @@
 #!/usr/bin/env bash
+# Antaram startup on HF (Linux). agy authenticates via the OS keyring (Secret
+# Service), so we run a headless gnome-keyring and seed the token into it.
 set -e
 
-# 1) Materialize agy credentials from the AGY_CREDS_JSON secret to AGY_CREDS_PATH
-#    (so the headless Linux agy can authenticate without a browser/keyring).
-python -c "from app.bootstrap import ensure_credentials; print('agy creds ->', ensure_credentials())" || true
+# 1) D-Bus session + unlocked gnome-keyring secrets service.
+export $(dbus-launch)
+eval "$(printf '\n' | gnome-keyring-daemon --unlock --components=secrets 2>/dev/null)" || true
+printf '\n' | gnome-keyring-daemon --start --components=secrets 2>/dev/null || true
+sleep 2
 
-# 2) Quick agy auth self-check (logs whether the CLI can reach the model headless).
-if [ -x "${AGY_BIN:-agy}" ]; then
-  echo "[start] agy version: $(${AGY_BIN:-agy} --version 2>/dev/null || echo '??')"
+# 2) Seed the agy OAuth credential into the keyring.
+#    Windows target was "gemini:antigravity" => Secret Service service/username.
+KR_SERVICE="${AGY_KEYRING_SERVICE:-gemini}"
+KR_USER="${AGY_KEYRING_USER:-antigravity}"
+if [ -n "$AGY_CREDS_JSON" ]; then
+  if printf '%s' "$AGY_CREDS_JSON" | secret-tool store --label="${KR_SERVICE}:${KR_USER}" \
+        service "$KR_SERVICE" username "$KR_USER" 2>/dev/null; then
+    echo "[start] seeded keyring credential (${KR_SERVICE}:${KR_USER})"
+  else
+    echo "[start] WARN: secret-tool store failed (keyring may be unavailable)"
+  fi
 fi
 
-# 3) Serve (HF routes traffic to $PORT, default 7860).
+# 3) Also drop the credential as a file (per-key homes do their own copy too).
+python -c "from app.bootstrap import ensure_credentials; print('[start] creds file ->', ensure_credentials())" || true
+
+echo "[start] agy version: $(${AGY_BIN:-agy} --version 2>/dev/null || echo '??')"
+
+# 4) Serve (HF routes to $PORT, default 7860).
 exec uvicorn app.agy_server:app --host 0.0.0.0 --port "${PORT:-7860}"