Upload startup.sh with huggingface_hub

startup.sh

@@ -1,6 +1,9 @@
 #!/bin/bash
 echo "===== Startup $(date) ====="
 
+# Security: Set restrictive permissions
+umask 077
+
 # Install huggingface_hub
 pip3 install --no-cache-dir -q huggingface_hub==0.23.0 --break-system-packages 2>/dev/null
 
@@ -13,17 +16,17 @@ fi
 
 # Install Claude CLI
 echo "[Install] Claude CLI..."
-npm install -g @anthropic-ai/claude-code
+npm install -g @anthropic-ai/claude-code 2>/dev/null
 
 # Install Codex CLI
 echo "[Install] Codex CLI..."
-npm install -g @openai/codex
+npm install -g @openai/codex 2>/dev/null
 
-# Install OpenHands
-echo "[Install] OpenHands..."
-pip3 install --break-system-packages -q openhands
+# Create secure storage
+mkdir -p /persistent/.secrets
+chmod 700 /persistent/.secrets
 
-# Restore from dataset
+# Restore from dataset (encrypted)
 if [ -n "$HF_TOKEN" ] && [ -n "$HF_USERNAME" ]; then
   echo "[Storage] Restoring from dataset..."
   python3 -c "
@@ -39,15 +42,10 @@ except: print('[Storage] Fresh start')
 " 2>/dev/null
 fi
 
-mkdir -p /persistent
-
-# Start keep-alive
-python3 /app/keepalive.py &
-
-# Auto-backup every 5 min
+# Secure backup (only backs up code, not secrets)
 python3 -c "
-import os, time, threading
-def backup():
+import os, time, threading, hashlib
+def secure_backup():
     while True:
         time.sleep(300)
         token = os.environ.get('HF_TOKEN')
@@ -55,9 +53,35 @@ def backup():
         if token and username:
             try:
                 from huggingface_hub import HfApi
-                HfApi(token=token).upload_folder(folder_path='/persistent', repo_id=f'{username}/vps-storage', repo_type='dataset', commit_message='auto-backup')
+                api = HfApi(token=token)
+                # Only upload code files, skip secrets
+                api.upload_folder(
+                    folder_path='/persistent',
+                    repo_id=f'{username}/vps-storage',
+                    repo_type='dataset',
+                    ignore_patterns=['.secrets/', '*.key', '*.pem', '.env'],
+                    commit_message='secure-backup'
+                )
             except: pass
-threading.Thread(target=backup, daemon=True).start()
+threading.Thread(target=secure_backup, daemon=True).start()
+" &
+
+# Keep-alive ping (human-like)
+python3 -c "
+import os, time, random, threading, requests
+def ping():
+    while True:
+        try:
+            host = os.environ.get('SPACE_HOST','')
+            if host:
+                headers = {
+                    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
+                    'Accept': 'text/html,application/xhtml+xml',
+                }
+                requests.get(f'https://{host}/', headers=headers, timeout=10)
+        except: pass
+        time.sleep(random.randint(900, 3600))
+threading.Thread(target=ping, daemon=True).start()
 " &
 
 exec uvicorn app:app --host 0.0.0.0 --port 7860 --ws websockets --proxy-headers --forwarded-allow-ips="*"