Upload folder using huggingface_hub

Dockerfile

@@ -1,25 +1,30 @@
 # ============================================================================
 # Eurus ERA5 Agent — Docker Image
 # ============================================================================
-# Multi-target build:
-#   docker build --target agent -t eurus-agent .
-#   docker build --target web   -t eurus-web   .
+# Single-stage build for HuggingFace Spaces + local docker-compose.
 #
-# Or use docker-compose (preferred):
-#   docker compose run --rm agent     # interactive CLI
-#   docker compose up web             # FastAPI on :8000
+# Local usage:
+#   docker build -t eurus-web .
+#   docker run -p 7860:7860 --env-file .env eurus-web
+#
+# Or use docker-compose:
+#   docker compose up web
 # ============================================================================
 
-# ---------- base ----------
-FROM python:3.12-slim AS base
+FROM python:3.12-slim
 
 # System deps for scientific stack (numpy/scipy wheels, geopandas/shapely, matplotlib)
 RUN apt-get update && apt-get install -y --no-install-recommends \
-        gcc g++ \
-        libgeos-dev \
-        libproj-dev \
-        libffi-dev \
-        curl \
+    gcc g++ \
+    libgeos-dev \
+    libproj-dev \
+    libffi-dev \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Node.js 20 for React frontend build
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
@@ -28,6 +33,12 @@ WORKDIR /app
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
+# Build React frontend (separate layer for caching)
+COPY frontend/package.json frontend/package-lock.json* frontend/
+RUN cd frontend && npm ci
+COPY frontend/ frontend/
+RUN cd frontend && npm run build
+
 # Copy project source
 COPY pyproject.toml .
 COPY src/ src/
@@ -50,18 +61,23 @@ RUN python -c "import cartopy; cartopy.io.shapereader.natural_earth(resolution='
     && python -c "import cartopy; cartopy.io.shapereader.natural_earth(resolution='110m', category='physical', name='land')" \
     && python -c "import cartopy; cartopy.io.shapereader.natural_earth(resolution='50m', category='physical', name='land')"
 
-# Signal to the REPL that we're inside Docker → security checks disabled
-ENV EURUS_DOCKER=1
+# Pre-import heavy modules at BUILD time to force compilation / bytecode caching.
+# This avoids a 30+ minute first-import delay on HF Spaces' constrained free tier.
+RUN python -c "\
+import langchain; \
+import langchain_openai; \
+import arraylake; \
+import icechunk; \
+import xarray; \
+import scipy; \
+import matplotlib; \
+import scgraph; \
+print('All heavy modules pre-imported successfully')"
+
 # Matplotlib: no GUI backend
 ENV MPLBACKEND=Agg
 # Ensure Python output is unbuffered (for docker logs)
 ENV PYTHONUNBUFFERED=1
 
-# ---------- agent (CLI mode) ----------
-FROM base AS agent
-ENTRYPOINT ["python", "main.py"]
-
-# ---------- web (FastAPI mode) ----------
-FROM base AS web
 EXPOSE 7860
 CMD ["uvicorn", "web.app:app", "--host", "0.0.0.0", "--port", "7860"]

docker-compose.yml

@@ -12,8 +12,8 @@ services:
   agent:
     build:
       context: .
-      target: agent
     image: eurus-agent
+    entrypoint: ["python", "main.py"]
     env_file: .env
     environment:
       - EURUS_DOCKER=1
@@ -28,7 +28,6 @@ services:
   web:
     build:
       context: .
-      target: web
     image: eurus-web
     env_file: .env
     environment:

frontend/src/components/ApiKeysPanel.tsx

@@ -5,13 +5,19 @@ import './ApiKeysPanel.css';
 interface ApiKeysPanelProps {
     visible: boolean;
     onSave: (keys: { openai_api_key: string; arraylake_api_key: string }) => void;
+    configured?: boolean;
 }
 
-export default function ApiKeysPanel({ visible, onSave }: ApiKeysPanelProps) {
+export default function ApiKeysPanel({ visible, onSave, configured }: ApiKeysPanelProps) {
     const [openaiKey, setOpenaiKey] = useState('');
     const [arraylakeKey, setArraylakeKey] = useState('');
     const [saving, setSaving] = useState(false);
 
+    // Reset saving state when keys are confirmed configured
+    useEffect(() => {
+        if (configured) setSaving(false);
+    }, [configured]);
+
     // Restore from sessionStorage
     useEffect(() => {
         const saved = sessionStorage.getItem('eurus-keys');

frontend/src/components/ChatPanel.tsx

@@ -20,6 +20,7 @@ export default function ChatPanel({ cacheToggle }: ChatPanelProps) {
     const [isThinking, setIsThinking] = useState(false);
     const [statusMsg, setStatusMsg] = useState('');
     const [needKeys, setNeedKeys] = useState<boolean | null>(null); // null = don't know yet
+    const [keysConfigured, setKeysConfigured] = useState(false);
     const bottomRef = useRef<HTMLDivElement>(null);
     const streamBuf = useRef('');
     const streamMedia = useRef<MediaItem[]>([]);
@@ -178,6 +179,7 @@ export default function ChatPanel({ cacheToggle }: ChatPanelProps) {
             case 'keys_configured':
                 if (ev.ready) {
                     setNeedKeys(false);
+                    setKeysConfigured(true);
                 }
                 break;
 
@@ -209,7 +211,7 @@ export default function ChatPanel({ cacheToggle }: ChatPanelProps) {
             .then(data => {
                 setNeedKeys(!data.openai);
             })
-            .catch(() => setNeedKeys(false)); // fallback: assume keys in .env
+            .catch(() => setNeedKeys(true)); // no server keys — show panel
     }, [status]);
 
     /* ── auto-scroll ── */
@@ -280,7 +282,7 @@ export default function ChatPanel({ cacheToggle }: ChatPanelProps) {
             </header>
 
             {/* API keys panel */}
-            <ApiKeysPanel visible={needKeys === true} onSave={handleSaveKeys} />
+            <ApiKeysPanel visible={needKeys === true} onSave={handleSaveKeys} configured={keysConfigured} />
 
             {/* messages */}
             <div className="messages-container">

src/eurus/tools/__init__.py

@@ -14,7 +14,7 @@ from typing import List
 from langchain_core.tools import BaseTool
 
 # Import core tools
-from .era5 import era5_tool
+from .era5 import era5_tool, create_era5_tool
 from .repl import PythonREPLTool
 from .routing import routing_tool
 from .analysis_guide import analysis_guide_tool, visualization_guide_tool
@@ -29,7 +29,8 @@ except ImportError:
 
 def get_all_tools(
     enable_routing: bool = True,
-    enable_guide: bool = True
+    enable_guide: bool = True,
+    arraylake_api_key: str | None = None,
 ) -> List[BaseTool]:
     """
     Return a list of all available tools for the agent.
@@ -37,13 +38,15 @@ def get_all_tools(
     Args:
         enable_routing: If True, includes the maritime routing tool (default: True).
         enable_guide: If True, includes the guide tools (default: True).
+        arraylake_api_key: If provided, binds this key to the ERA5 tool (session isolation).
 
     Returns:
         List of LangChain tools for the agent.
     """
     # Core tools: data retrieval + Python analysis
+    # Use session-specific ERA5 tool if key is provided, else default (env-based)
     tools = [
-        era5_tool,
+        create_era5_tool(api_key=arraylake_api_key) if arraylake_api_key else era5_tool,
         PythonREPLTool(working_dir=".")
     ]
 

src/eurus/tools/era5.py

@@ -13,6 +13,7 @@ QUERY_TYPE IS AUTO-DETECTED based on time/area rules:
 import logging
 from typing import Optional
 from datetime import datetime
+from functools import partial
 
 from pydantic import BaseModel, Field, field_validator
 from langchain_core.tools import StructuredTool
@@ -156,10 +157,12 @@ def retrieve_era5_data(
     max_latitude: float,
     min_longitude: float,
     max_longitude: float,
-    region: Optional[str] = None
+    region: Optional[str] = None,
+    _api_key: Optional[str] = None,
 ) -> str:
     """
     Wrapper that auto-detects query_type and calls the real retrieval function.
+    _api_key is injected by the session — not exposed to the LLM.
     """
     # Auto-detect query type
     query_type = _auto_detect_query_type(
@@ -178,7 +181,8 @@ def retrieve_era5_data(
         max_latitude=max_latitude,
         min_longitude=min_longitude,
         max_longitude=max_longitude,
-        region=region
+        region=region,
+        api_key=_api_key,
     )
 
 
@@ -186,19 +190,29 @@ def retrieve_era5_data(
 # LANGCHAIN TOOL CREATION
 # ============================================================================
 
-era5_tool = StructuredTool.from_function(
-    func=retrieve_era5_data,
-    name="retrieve_era5_data",
-    description=(
-        "Retrieves ERA5 climate reanalysis data from Earthmover's cloud archive.\n\n"
-        "⚠️ query_type is AUTO-DETECTED - you don't need to specify it!\n\n"
-        "Just provide:\n"
-        "- variable_id: one of 22 ERA5 variables (sst, t2, d2, skt, u10, v10, u100, v100, "
-        "sp, mslp, blh, cape, tcc, cp, lsp, tp, ssr, ssrd, tcw, tcwv, sd, stl1, swvl1)\n"
-        "- start_date, end_date: YYYY-MM-DD format\n"
-        "- lat/lon bounds: Use values from maritime route bounding box!\n\n"
-        "DATA: 1975-2024.\n"
-        "Returns file path. Load with: xr.open_zarr('PATH')"
-    ),
-    args_schema=ERA5RetrievalArgs
-)
+def create_era5_tool(api_key: Optional[str] = None) -> StructuredTool:
+    """Create an ERA5 tool, optionally binding a session-specific API key."""
+    func = partial(retrieve_era5_data, _api_key=api_key) if api_key else retrieve_era5_data
+    # partial objects lose __name__, so set it explicitly
+    if hasattr(func, 'func'):
+        func.__name__ = 'retrieve_era5_data'
+    return StructuredTool.from_function(
+        func=func,
+        name="retrieve_era5_data",
+        description=(
+            "Retrieves ERA5 climate reanalysis data from Earthmover's cloud archive.\n\n"
+            "⚠️ query_type is AUTO-DETECTED - you don't need to specify it!\n\n"
+            "Just provide:\n"
+            "- variable_id: one of 22 ERA5 variables (sst, t2, d2, skt, u10, v10, u100, v100, "
+            "sp, mslp, blh, cape, tcc, cp, lsp, tp, ssr, ssrd, tcw, tcwv, sd, stl1, swvl1)\n"
+            "- start_date, end_date: YYYY-MM-DD format\n"
+            "- lat/lon bounds: Use values from maritime route bounding box!\n\n"
+            "DATA: 1975-2024.\n"
+            "Returns file path. Load with: xr.open_zarr('PATH')"
+        ),
+        args_schema=ERA5RetrievalArgs,
+    )
+
+
+# Default tool instance (reads key from os.environ — for CLI/server .env usage)
+era5_tool = create_era5_tool()

src/eurus/tools/repl.py

@@ -308,6 +308,27 @@ class PersistentREPL:
             self._cleanup_process()
             self._start_subprocess()
 
+    def set_extra_env(self, env_vars: dict):
+        """Inject extra environment variables into the running subprocess."""
+        if not env_vars:
+            return
+        with self._lock:
+            self._ensure_alive()
+            # Build a Python command that sets the env vars inside the subprocess
+            set_cmds = []
+            for key, value in env_vars.items():
+                if value:  # Only set non-empty values
+                    set_cmds.append(f"os.environ[{key!r}] = {value!r}")
+            if set_cmds:
+                code = "import os; " + "; ".join(set_cmds)
+                cmd = json.dumps({"type": "exec", "code": code}) + "\n"
+                try:
+                    self._process.stdin.write(cmd)
+                    self._process.stdin.flush()
+                    self._read_with_timeout(5)  # consume the response
+                except Exception as e:
+                    logger.warning("Failed to inject env vars into subprocess: %s", e)
+
     def run(self, code: str, timeout: int = 300) -> str:
         """Execute code in the subprocess. Returns output string."""
         with self._lock:
@@ -464,6 +485,11 @@ class PythonREPLTool(BaseTool):
         if plots_dir:
             self._repl._update_plots_dir(plots_dir)
 
+    def inject_env(self, env_vars: dict):
+        """Inject environment variables into the REPL subprocess (session-scoped)."""
+        if self._repl:
+            self._repl.set_extra_env(env_vars)
+
     def set_plot_callback(self, callback: Callable):
         """Set callback for plot capture (used by web interface)."""
         self._plot_callback = callback

web/agent_wrapper.py

@@ -76,13 +76,14 @@ class AgentSession:
 
         if not arraylake_key:
             logger.warning("ARRAYLAKE_API_KEY not found")
-        elif not os.environ.get("ARRAYLAKE_API_KEY"):
-            # Only set env var if not already configured (avoid overwriting
-            # server-configured keys with user-provided ones in multi-user scenarios)
-            os.environ["ARRAYLAKE_API_KEY"] = arraylake_key
 
-        if hf_token and not os.environ.get("HF_TOKEN"):
-            os.environ["HF_TOKEN"] = hf_token
+        # SECURITY: Do NOT write user-provided keys to os.environ!
+        # os.environ is process-global — leaks keys to other sessions on shared hosts (e.g. HF Spaces).
+        # Instead, store in self and pass directly to tools that need them.
+        self._resolved_keys = {
+            "ARRAYLAKE_API_KEY": arraylake_key or "",
+            "HF_TOKEN": hf_token or "",
+        }
 
         if not openai_key:
             logger.error("OPENAI_API_KEY not found")
@@ -93,6 +94,10 @@ class AgentSession:
             logger.info("Starting Python kernel...")
             self._repl_tool = PythonREPLTool(working_dir=os.getcwd())
 
+            # Inject session-specific keys into the REPL subprocess
+            # (keeps them isolated from other sessions — no os.environ pollution)
+            self._repl_tool.inject_env(self._resolved_keys)
+
             # Set up plot callback using the proper method
             def on_plot_captured(base64_data: str, filepath: str, code: str = ""):
                 logger.info(f"Plot captured, adding to queue: {filepath}")
@@ -102,7 +107,13 @@ class AgentSession:
             logger.info("Plot callback registered")
 
             # Get ALL tools from centralized registry (no SCIENCE_TOOLS!)
-            tools = get_all_tools(enable_routing=True, enable_guide=True)
+            # Pass session-specific Arraylake key for isolation
+            arraylake_key = self._resolved_keys.get("ARRAYLAKE_API_KEY")
+            tools = get_all_tools(
+                enable_routing=True,
+                enable_guide=True,
+                arraylake_api_key=arraylake_key or None,
+            )
             # Replace the default REPL with our configured one
             tools = [t for t in tools if t.name != "python_repl"] + [self._repl_tool]
 

web/routes/api.py

@@ -66,19 +66,13 @@ async def keys_status():
 
 @router.get("/health", response_model=HealthResponse)
 async def health_check():
-    """Check if the server and agent are healthy."""
-    from web.agent_wrapper import get_agent_session
-
-    try:
-        session = get_agent_session()
-        agent_ready = session is not None and session.is_ready()
-    except Exception:
-        agent_ready = False
-
+    """Check if the server is healthy."""
+    # NOTE: We no longer check a shared singleton session.
+    # Each WebSocket connection has its own AgentSession.
     return HealthResponse(
         status="ok",
         version="1.0.0",
-        agent_ready=agent_ready
+        agent_ready=True  # Server is up → ready to accept WS connections
     )
 
 
@@ -181,17 +175,14 @@ async def get_config():
 
 @router.delete("/conversation")
 async def clear_conversation():
-    """Clear the conversation history."""
+    """Clear the conversation history (shared memory only)."""
     from eurus.memory import get_memory
-    from web.agent_wrapper import get_agent_session
 
     memory = get_memory()
     memory.clear_conversation()
 
-    # Also clear the agent session messages
-    session = get_agent_session()
-    if session:
-        session.clear_messages()
+    # NOTE: Agent session messages are managed per-WebSocket connection.
+    # Each session clears its own messages when the connection closes.
 
     return {"status": "ok", "message": "Conversation cleared"}
 

web/routes/pages.py

@@ -4,23 +4,48 @@ Page Routes
 Serves React frontend build in production, redirects to Vite dev server in development.
 """
 
+import os
 from pathlib import Path
 
-from fastapi import APIRouter
-from fastapi.responses import FileResponse, RedirectResponse
+from fastapi import APIRouter, Request
+from fastapi.responses import FileResponse, HTMLResponse, RedirectResponse
 
 router = APIRouter()
 
 # React production build directory
 BUILD_DIR = Path(__file__).parent.parent.parent / "frontend" / "dist"
 
+# Detect dev mode: EURUS_DEV=1 or no dist folder AND localhost access
+_DEV_MODE = os.environ.get("EURUS_DEV") == "1"
 
-@router.get("/")
-async def index():
-    """Serve React build in production, redirect to Vite in dev."""
+# Minimal HTML fallback — returns 200 so HF Spaces health check passes
+_FALLBACK_HTML = """<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"><title>Eurus</title>
+<style>body{font-family:system-ui;display:flex;align-items:center;
+justify-content:center;height:100vh;margin:0;background:#0f172a;color:#e2e8f0}
+.c{text-align:center}h1{font-size:2rem;margin-bottom:.5rem}
+p{opacity:.7}</style></head>
+<body><div class="c"><h1>🌊 Eurus</h1><p>Climate Agent is running.
+Connect via WebSocket to start a session.</p></div></body></html>"""
+
+
+@router.get("/{full_path:path}")
+async def catch_all(request: Request, full_path: str = ""):
+    """Serve React SPA — all non-API routes go to index.html."""
     index_file = BUILD_DIR / "index.html"
+
+    # Production: serve from built React app
     if index_file.exists():
+        # Try to serve the exact static file first (e.g. /assets/index-abc.js)
+        requested = BUILD_DIR / full_path
+        if full_path and requested.is_file() and requested.resolve().is_relative_to(BUILD_DIR.resolve()):
+            return FileResponse(requested)
+        # Otherwise serve index.html for SPA routing
         return FileResponse(index_file)
-    # Dev mode fallback: redirect to Vite dev server
-    return RedirectResponse(url="http://localhost:5182/")
 
+    # Dev mode on localhost only — redirect to Vite dev server
+    if _DEV_MODE:
+        return RedirectResponse(url=f"http://localhost:5182/{full_path}")
+
+    # No React build available — return 200 OK fallback so HF health check passes
+    return HTMLResponse(content=_FALLBACK_HTML, status_code=200)