Daemon: drop RELAY_SECRET; auth via HF token only

daemon/client.py

@@ -6,8 +6,7 @@ executes shell commands in persistent named bash sessions.
 Run it (foreground, or under nohup / tmux / systemd):
 
     export RELAY_SPACE="your-username/nii-relay"   # the Space repo id
-    export RELAY_SECRET="<same secret as the Space>"
-    export HF_TOKEN="hf_..."                       # read token; needed if Space is private
+    export HF_TOKEN="hf_..."                       # token with access to the private Space (this is the auth)
     export CLIENT_ID="$(hostname)"                 # how it shows up in the UI (optional)
     python client.py
 
@@ -70,7 +69,6 @@ def _default_client_id() -> str:
 
 
 SPACE = os.environ.get("RELAY_SPACE", "")
-SECRET = os.environ.get("RELAY_SECRET", "")
 HF_TOKEN = os.environ.get("HF_TOKEN") or os.environ.get("HUGGINGFACE_TOKEN")
 CLIENT_ID = os.environ.get("CLIENT_ID") or _default_client_id()
 POLL_INTERVAL = float(os.environ.get("POLL_INTERVAL", "5"))
@@ -314,7 +312,7 @@ def connect() -> Client:
         try:
             log(f"connecting to Space {SPACE} …")
             c = _make_client()
-            c.predict(CLIENT_ID, SECRET, _meta(), api_name="/register")
+            c.predict(CLIENT_ID, _meta(), api_name="/register")
             CLIENT = c
             log(f"registered as '{CLIENT_ID}'")
             return c
@@ -333,7 +331,7 @@ def _post(*args, **kwargs):
 
 def _safe_result(cid: str, code: int, output: str, session: str):
     try:
-        _post(cid, CLIENT_ID, SECRET, code, output, session, api_name="/result")
+        _post(cid, CLIENT_ID, code, output, session, api_name="/result")
     except Exception as e:
         log(f"result post failed for {session}: {type(e).__name__}: {e}")
 
@@ -360,7 +358,7 @@ def do_put(cmd: dict):
     dest = _expand(cmd.get("dest") or cmd.get("filename") or "downloaded.bin")
     log(f"[file] put → {dest}")
     try:
-        ret = _post(cmd["file_id"], SECRET, api_name="/fetch_file")
+        ret = _post(cmd["file_id"], api_name="/fetch_file")
         src = _result_path(ret)
         if not src or not os.path.isfile(src):
             raise FileNotFoundError("relay returned no file")
@@ -391,13 +389,13 @@ def do_get(cmd: dict):
             raise ValueError(f"{size} bytes exceeds the {MAX_FILE_BYTES}-byte limit")
     except Exception as e:
         try:
-            _post(cid, CLIENT_ID, SECRET, None, f"{e}", api_name="/upload_result")
+            _post(cid, CLIENT_ID, None, f"{e}", api_name="/upload_result")
         except Exception as e2:
             log(f"error report failed: {type(e2).__name__}: {e2}")
         log(f"[file] get → error: {e}")
         return
     try:
-        _post(cid, CLIENT_ID, SECRET, handle_file(remote), "", api_name="/upload_result")
+        _post(cid, CLIENT_ID, handle_file(remote), "", api_name="/upload_result")
         log(f"[file] get → sent {size} bytes")
     except Exception as e:
         log(f"[file] get upload failed: {type(e).__name__}: {e}")
@@ -465,14 +463,12 @@ def _shutdown():
 def main():
     if not SPACE:
         sys.exit("set RELAY_SPACE to the Space repo id, e.g. your-username/nii-relay")
-    if not SECRET:
-        log("WARNING: RELAY_SECRET is empty — the relay will reject this daemon")
     log(f"daemon starting — client_id='{CLIENT_ID}', poll every {POLL_INTERVAL}s")
     threading.Thread(target=_shell_reaper, daemon=True).start()
     connect()
     while True:
         try:
-            res = CLIENT.predict(CLIENT_ID, SECRET, api_name="/poll")
+            res = CLIENT.predict(CLIENT_ID, api_name="/poll")
             for cmd in (res or {}).get("commands", []):
                 get_worker(cmd.get("session") or "main").submit(cmd)
         except KeyboardInterrupt: