Upload Dockerfile

Dockerfile

@@ -68,14 +68,21 @@ RUN curl -fL "${DDB_URL}" -o /app/depth_mexico.duckdb \
 
 # Bake the private RAG index via the hf_token secret (best-effort; never fails
 # the build). The secret is mounted only for this RUN, at /run/secrets/hf_token.
+# Reports the HTTP status on failure (401 = bad/expired token, 403 = token has no
+# read access to the dataset, 404 = wrong URL/path) and removes a partial file so
+# the app correctly shows "offline" rather than loading a broken index.
 RUN --mount=type=secret,id=hf_token \
     if [ -s /run/secrets/hf_token ]; then \
-      ( curl -fL -H "Authorization: Bearer $(cat /run/secrets/hf_token)" "${RAG_URL}" -o /app/rag_chunks.parquet \
-        && test -s /app/rag_chunks.parquet \
-        && echo "[build] RAG index baked: $(ls -lh /app/rag_chunks.parquet | awk '{print $5}')" ) \
-      || echo "[build] RAG fetch failed (token lacks access or URL wrong) -> assistant offline" ; \
+      code=$(curl -sL -o /app/rag_chunks.parquet -w '%{http_code}' \
+             -H "Authorization: Bearer $(cat /run/secrets/hf_token)" "${RAG_URL}"); \
+      if [ "$code" = "200" ] && [ -s /app/rag_chunks.parquet ]; then \
+        echo "[build] RAG index baked: $(ls -lh /app/rag_chunks.parquet | awk '{print $5}')"; \
+      else \
+        echo "[build] RAG fetch failed (HTTP $code) -> assistant offline"; \
+        rm -f /app/rag_chunks.parquet; \
+      fi; \
     else \
-      echo "[build] no hf_token secret -> assistant offline until rag_chunks.parquet is provided" ; \
+      echo "[build] no hf_token secret found at /run/secrets/hf_token -> assistant offline"; \
     fi
 
 # HF Spaces runs the container as a non-root user -- make /app world-readable,