clean: remove all VNC/desktop files and references

Remove ubuntu-desktop/, Dockerfile.ubuntu-desktop, desktop design docs,
and all VNC/noVNC/XFCE references from README and docs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Dockerfile.ubuntu-desktop

@@ -1,59 +0,0 @@
-# Ubuntu 24.04 Desktop on HuggingRun — noVNC on 7860, SSH on 2222, persistence via /data
-FROM ubuntu:24.04
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-# System + Python (for sync)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates curl python3 python3-pip python3-venv \
-    && pip3 install --no-cache-dir --break-system-packages huggingface_hub \
-    && rm -rf /var/lib/apt/lists/*
-
-# Desktop stack: Xvfb, XFCE, dbus, x11vnc, Firefox; OpenSSH for local/reverse SSH
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    xvfb \
-    xfce4 xfce4-goodies \
-    dbus-x11 \
-    x11vnc \
-    firefox \
-    procps \
-    openssh-server openssh-client \
-    && rm -rf /var/lib/apt/lists/*
-
-# noVNC (web client on 7860)
-RUN apt-get update && apt-get install -y --no-install-recommends git \
-    && git clone --depth 1 https://github.com/novnc/noVNC.git /opt/noVNC \
-    && git clone --depth 1 https://github.com/novnc/websockify /opt/noVNC/utils/websockify \
-    && rm -rf /var/lib/apt/lists/* /opt/noVNC/.git
-
-# HF Spaces run as user 1000; UID 1000 may exist (e.g. ubuntu)
-RUN (useradd -m -u 1000 user 2>/dev/null) || \
-    (EXISTING=$(getent passwd 1000 | cut -d: -f1); \
-     usermod -l user $EXISTING; usermod -d /home/user user; \
-     mkdir -p /home/user && chown 1000:1000 /home/user)
-ENV HOME=/home/user
-RUN mkdir -p /data && chown user:user /data
-
-# Pre-generate SSH host key so sshd can start without root
-RUN mkdir -p /home/user/.ssh && \
-    ssh-keygen -t ed25519 -f /home/user/.ssh/ssh_host_ed25519_key -N "" -C "" && \
-    chown -R 1000:1000 /home/user/.ssh
-
-# HuggingRun scripts (build context = repo root)
-COPY scripts /scripts
-COPY ubuntu-desktop/start-desktop.sh /opt/start-desktop.sh
-RUN chmod +x /scripts/entrypoint.sh /opt/start-desktop.sh
-
-ENV PERSIST_PATH=/data
-ENV RUN_CMD="/opt/start-desktop.sh"
-ENV DESKTOP_HOME=/data/desktop-home
-ENV DISPLAY=:99
-ENV VNC_PORT=5901
-ENV NOVNC_PORT=7860
-# SSH_LISTEN: 0.0.0.0 for local Docker testing, 127.0.0.1 for HF (reverse SSH only)
-ENV SSH_LISTEN=0.0.0.0
-ENV SSH_PORT=2222
-
-USER user
-EXPOSE 7860 2222
-ENTRYPOINT ["/scripts/entrypoint.sh"]

README.md

@@ -19,7 +19,7 @@ tags:
 
 **Run anything on Hugging Face.**
 
-HuggingRun 是面向 Hugging Face Spaces 的**通用部署接口**：用同一套工具解决 HF 上的持久化、单端口、网络等限制，让**任意 Docker 应用**都能按同一套流程部署、重启后状态保留。我们以「部署一整台操作系统」（如 Ubuntu 桌面）作为高难度用例做验证——这类任务若能稳定跑通，说明通用工具足以支撑用户正常部署各种复杂应用。
+HuggingRun 是面向 Hugging Face Spaces 的**通用部署接口**：用同一套工具解决 HF 上的持久化、单端口、网络等限制，让**任意 Docker 应用**都能按同一套流程部署、重启后状态保留。
 
 - **通用用法（用户最少步骤）**：[docs/GENERAL_USAGE.md](docs/GENERAL_USAGE.md) — 不按其他云容器收费或复杂配置，所有能力围绕通用工具展开。
 - **通用工具优先**：主要维护的是通用层（持久化同步、单入口、可配置端口）。示例仅演示“最少配置”用法，不在核心脚本中为任何案例写死逻辑。
@@ -64,10 +64,9 @@ HuggingRun 是面向 Hugging Face Spaces 的**通用部署接口**：用同一
 
 （可选）设 `HF_TOKEN` 与 `AUTO_CREATE_DATASET=true`，重启后 SQLite 数据仍在。
 
-### Ubuntu 桌面（noVNC）
+### Ubuntu Server（Web Terminal + SSH）
 
-**仅作为通用工具示例**：使用同一套 `scripts/`（同步 + entrypoint），仅通过不同 Dockerfile 设置 `RUN_CMD=/opt/start-desktop.sh`。  
-用法：Duplicate 本 Space 后，用 [ubuntu-desktop/Dockerfile](ubuntu-desktop/Dockerfile) 的内容**替换**仓库根目录的 `Dockerfile`，保存后构建即可；无需改通用脚本。详见 [ubuntu-desktop/README.md](ubuntu-desktop/README.md)。
+使用同一套 `scripts/`，通过 ttyd 提供浏览器 Web Terminal，nginx 反代 + WebSocket-SSH 桥接支持远程 SSH 登录。全盘持久化：整个文件系统镜像同步到 HF Dataset。
 
 ## 环境变量速查
 

docs/GENERAL_USAGE.md

@@ -1,8 +1,8 @@
 # HuggingRun 通用用法
 
-本文档说明**通用工具**的用法。所有能力都围绕这一套工具展开；示例（含 Ubuntu 桌面）只是「同一条通用流水线 + 不同 RUN_CMD 或不同 Dockerfile」的用法，不做单独定制。
+本文档说明**通用工具**的用法。所有能力都围绕这一套工具展开；示例只是「同一条通用流水线 + 不同 RUN_CMD 或不同 Dockerfile」的用法，不做单独定制。
 
-**设计目标**：让用这个工具的人可以**正常部署所有东西**。我们把「部署一整台操作系统」（如 Ubuntu 桌面 + noVNC）当作高难度用例——若这类任务都能运行正常，说明通用层足够鲁棒，其他应用更不在话下。
+**设计目标**：让用这个工具的人可以**正常部署所有东西**。
 
 ---
 
@@ -38,13 +38,11 @@
 3. 打开 Space 链接即可。  
 无需改代码、无需付费、无需像其他云容器那样单独买持久盘或做复杂配置。
 
-### 场景 B：跑「另一种镜像」示例（例如 Ubuntu 桌面）
+### 场景 B：跑「另一种镜像」示例
 
-- 仍用**同一套通用工具**：只是把「要跑的东西」换成 Ubuntu 桌面。
-- 操作：Duplicate 本 Space 后，用 **ubuntu-desktop 示例的 Dockerfile** 替换仓库根目录的 `Dockerfile` 内容（仓库里已有 `scripts/` 和 `ubuntu-desktop/start-desktop.sh`，构建上下文不变）。
-- 之后同样只需在 Settings 里配 Secrets（如 `HF_TOKEN`），无需在通用脚本里加任何 Ubuntu 专用逻辑。
-
-**Ubuntu 桌面示例步骤**：见 [ubuntu-desktop/README.md](../ubuntu-desktop/README.md)。方式一：用 `ubuntu-desktop/Dockerfile` 的内容替换根目录 `Dockerfile` 后推送。方式二：新建一个 Space，将本仓库的 **deploy-ubuntu-desktop** 分支推送到该 Space 的 main（该分支根目录已是桌面 Dockerfile，仍使用同一套 `scripts/`）。
+- 仍用**同一套通用工具**：只是换 Dockerfile。
+- 操作：Duplicate 本 Space 后，替换根目录的 `Dockerfile` 内容。
+- 之后同样只需在 Settings 里配 Secrets（如 `HF_TOKEN`），无需在通用脚本里加专用逻辑。
 
 ---
 
@@ -67,5 +65,4 @@
 ## 和「其他云容器」的对比
 
 - **其它云**：往往要选机型、买持久盘、配网络/密钥等，步骤多、有持续费用。
-- **HuggingRun**：Duplicate Space → 按需设 `HF_TOKEN` / `RUN_CMD`（或换示例 Dockerfile），即可跑任意兼容 Docker 的应用，持久化用 HF Dataset，不额外付费。  
-所有修改都围绕这套**通用工具**展开；示例（包括 Ubuntu 桌面）只演示用法，不扩展通用层为「专用逻辑」。
+- **HuggingRun**：Duplicate Space → 按需设 `HF_TOKEN` / `RUN_CMD`（或换示例 Dockerfile），即可跑任意兼容 Docker 的应用，持久化用 HF Dataset，不额外付费。

docs/PUSH_DEBUG.md

@@ -87,10 +87,10 @@ curl -N -H "Authorization: Bearer $HF_TOKEN" \
 # Demo 或默认 Space
 HF_TOKEN=你的token python3 scripts/monitor_and_test.py --wait-running --test
 
-# Ubuntu 桌面等：根路径返回 noVNC 目录列表，用 Directory listing；桌面在 /vnc.html
+# 自定义 expect 内容
 HF_TOKEN=你的token python3 scripts/monitor_and_test.py --wait-running --test \
   --url https://你的用户名-你的Space名.hf.space \
-  --expect "Directory listing"
+  --expect "ttyd"
 ```
 
 **方式 B：无 HF_TOKEN 时**（只轮询 URL 直到页面出现期望内容）
@@ -98,17 +98,17 @@ HF_TOKEN=你的token python3 scripts/monitor_and_test.py --wait-running --test \
 ```bash
 python3 scripts/monitor_and_test.py --wait-url --test \
   --url https://你的用户名-你的Space名.hf.space \
-  --expect "Directory listing" --max-wait 900
+  --expect "ttyd" --max-wait 900
 ```
 
-脚本会先轮询直到 GET 200 且 body 含你给的 `--expect`（Ubuntu 桌面根路径返回目录列表，用 `--expect "Directory listing"`；桌面客户端在 `/vnc.html`），再跑：基础 GET、压力请求、多轮持久化检查。**全部通过才 exit 0**，任一失败则 exit 1。
+脚本会先轮询直到 GET 200 且 body 含你给的 `--expect`，再跑：基础 GET、压力请求、多轮持久化检查。**全部通过才 exit 0**，任一失败则 exit 1。
 
 ### 2.5 不等待、直接测当前页面（Space 已 RUNNING 时）
 
 ```bash
 python3 scripts/monitor_and_test.py --test
 # 或
-python3 scripts/monitor_and_test.py --url https://xxx.hf.space --test --expect "Directory listing"
+python3 scripts/monitor_and_test.py --url https://xxx.hf.space --test --expect "ttyd"
 ```
 
 ---
@@ -122,7 +122,7 @@ python3 scripts/monitor_and_test.py --url https://xxx.hf.space --test --expect "
 
 2. **构建完成后**：另一个终端等 RUNNING 并跑测试。
    ```bash
-   HF_TOKEN=xxx python3 scripts/monitor_and_test.py --until-ok --url https://tao-shen-huggingrun.hf.space --expect "Directory listing"
+   HF_TOKEN=xxx python3 scripts/monitor_and_test.py --until-ok --url https://tao-shen-huggingrun.hf.space --expect "ttyd"
    ```
 
 3. 若 **测试失败或一直 503**：用 `--logs run`（以及 `--logs build`）看容器内报错，修代码后：

docs/plans/2025-03-03-ubuntu-desktop-design.md

@@ -1,26 +0,0 @@
-# Ubuntu 桌面版 on HuggingRun 设计
-
-**目标**: 在 HuggingRun 上部署最新版 Ubuntu 桌面（浏览器内 noVNC 完整桌面），打通常用功能，重启后状态完整保留。
-
-## 方案
-
-- **基础镜像**: Ubuntu 24.04 LTS
-- **桌面**: XFCE（轻量，适合 2 vCPU / 16GB）
-- **显示**: Xvfb 虚拟显示 + TigerVNC + noVNC（noVNC 监听 7860，满足 HF Spaces）
-- **持久化**: 桌面用户 HOME 放在 `PERSIST_PATH`（默认 `/data/desktop-home`），由现有 sync_hf.py 同步到 HF Dataset；启动时先恢复再挂载/HOME 指向该目录
-- **入口**: 独立 `ubuntu-desktop/` 目录，自有 Dockerfile；entrypoint 先执行 sync 恢复，再启动 Xvfb → 桌面 → VNC → noVNC
-
-## 完成标准（迭代开发）
-
-- [ ] `ubuntu-desktop/` 可独立构建并运行，浏览器访问 7860 看到完整 XFCE 桌面
-- [ ] 桌面功能可用：文件管理器、终端、浏览器（Firefox）、文本编辑器
-- [ ] 设置 HF_TOKEN + AUTO_CREATE_DATASET 后，重启 Space 后桌面状态（桌面文件、配置、已装软件状态）保留，无报错
-- [ ] 周期性同步与退出时同步正常，无遗漏
-
-## 实现要点
-
-1. **Dockerfile.ubuntu-desktop**: FROM ubuntu:24.04，装 python3、huggingface_hub、XFCE、TigerVNC、noVNC、Firefox；复制 HuggingRun scripts；用户 uid 1000；HOME 指向持久化目录
-2. **entrypoint_desktop**: 恢复 `/data` → 创建并绑定 `/data/desktop-home` 为桌面 HOME → 启动 sync 后台 → 启动 Xvfb、dbus、XFCE、x11vnc/tigervnc、noVNC（监听 7860）
-3. **PERSIST_PATH**: 使用 `/data`，`/data/desktop-home` 存桌面主目录；sync 继续上传/下载整个 `/data`
-
-日期: 2025-03-03

scripts/monitor_and_test.py

@@ -1,633 +0,0 @@
-#!/usr/bin/env python3
-"""
-HuggingRun: 监控远端 Space 状态并执行基础/压力/持久化验证（通用工具，适用于任意 Space）。
-轮询用 HF API（runtime 状态 + build/run 日志），不是只轮询 URL。
-
-用法:
-  python3 scripts/monitor_and_test.py --test
-  python3 scripts/monitor_and_test.py --ssh-test --ssh-host localhost --ssh-port 2222 --ssh-user user
-  python3 scripts/monitor_and_test.py --ssh-test --ssh-stress-n 30 --ssh-host localhost
-  HF_TOKEN=xxx python3 scripts/monitor_and_test.py --watch
-  HF_TOKEN=xxx python3 scripts/monitor_and_test.py --until-ok --url https://xxx.hf.space --expect noVNC
-  HF_TOKEN=xxx python3 scripts/monitor_and_test.py --logs run
-  HF_TOKEN=xxx python3 scripts/monitor_and_test.py --logs build
-等价 curl（需 Bearer token）:
-  curl -N -H "Authorization: Bearer $HF_TOKEN" "https://huggingface.co/api/spaces/<SPACE_ID>/logs/run"
-  curl -N -H "Authorization: Bearer $HF_TOKEN" "https://huggingface.co/api/spaces/<SPACE_ID>/logs/build"
-"""
-import argparse
-import os
-import sys
-import time
-import urllib.request
-import urllib.error
-
-# Load .env from repo root if present (HF_TOKEN etc.); never commit .env
-def _load_dotenv():
-    if os.environ.get("HF_TOKEN"):
-        return
-    root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-    env_file = os.path.join(root, ".env")
-    if not os.path.isfile(env_file):
-        return
-    with open(env_file) as f:
-        for line in f:
-            line = line.strip()
-            if not line or line.startswith("#"):
-                continue
-            if "=" in line:
-                k, v = line.split("=", 1)
-                k, v = k.strip(), v.strip().strip('"').strip("'")
-                if k and v and k not in os.environ:
-                    os.environ[k] = v
-
-_load_dotenv()
-
-SPACE_ID = os.environ.get("SPACE_ID", "tao-shen/HuggingRun")
-HF_LOGS_BASE = "https://huggingface.co/api/spaces"
-# HF Space app URL (replace / with - and often lowercase)
-APP_URL = os.environ.get("APP_URL", "https://tao-shen-huggingrun.hf.space")
-
-
-def get_runtime():
-    try:
-        from huggingface_hub import HfApi
-        token = os.environ.get("HF_TOKEN")
-        if not token:
-            return None, "HF_TOKEN not set"
-        api = HfApi(token=token)
-        rt = api.get_space_runtime(SPACE_ID)
-        return rt, None
-    except Exception as e:
-        return None, str(e)
-
-
-def get_stage():
-    """当前 state 一次查询，立即返回。返回 (stage, err)。"""
-    rt, err = get_runtime()
-    if err:
-        return None, err
-    stage = getattr(rt, "stage", None) or (getattr(rt, "raw", None) or {}).get("stage")
-    return stage, None
-
-
-def wait_running(max_wait_sec=600, poll_interval=15, app_url=None, expect_substrings=None):
-    """轮询直到 stage == RUNNING 或 APP_STARTING 且 URL 已 200+期望内容；先立即查一次，已失败则马上返回。"""
-    start = time.time()
-    first = True
-    while (time.time() - start) < max_wait_sec:
-        if not first:
-            time.sleep(poll_interval)
-        first = False
-        stage, err = get_stage()
-        if err:
-            print(f"[monitor] get_runtime error: {err}")
-            continue
-        print(f"[monitor] Space {SPACE_ID} stage={stage}")
-        if stage == "RUNNING":
-            return True
-        if stage == "ERROR" or stage == "BUILD_ERROR":
-            print(f"[monitor] Space in error state: {stage}")
-            return False
-        # APP_STARTING 时若 URL 已可访问则视为就绪（HF 可能迟迟不标 RUNNING）
-        if stage == "APP_STARTING" and app_url and expect_substrings:
-            status, body = http_get(app_url, timeout=10)
-            if status == 200 and any(s in body for s in expect_substrings):
-                print(f"[monitor] App URL ready (stage still APP_STARTING)")
-                return True
-    print("[monitor] Timeout waiting for RUNNING")
-    return False
-
-
-def wait_url(url, expect_substrings=None, max_wait_sec=900, poll_interval=20):
-    """轮询 URL 直到 GET 200 且 body 含任一 expect_substrings；无 HF_TOKEN 时用。"""
-    if expect_substrings is None:
-        expect_substrings = ("HuggingRun", "Run anything", "noVNC")
-    start = time.time()
-    while (time.time() - start) < max_wait_sec:
-        status, body = http_get(url, timeout=30)
-        if status == 200 and any(s in body for s in expect_substrings):
-            print(f"[monitor] URL ready: {url}")
-            return True
-        print(f"[monitor] URL not ready: status={status}, waiting {poll_interval}s ...")
-        time.sleep(poll_interval)
-    print("[monitor] Timeout waiting for URL content")
-    return False
-
-
-def http_get(url, timeout=30, retries=3, retry_delay=2):
-    """GET url; retry on 502/503/timeout/connection errors (generic HF robustness)."""
-    last_status, last_body, last_err = None, "", None
-    for attempt in range(max(1, retries)):
-        try:
-            req = urllib.request.Request(url, method="GET")
-            with urllib.request.urlopen(req, timeout=timeout) as resp:
-                body = resp.read().decode("utf-8", errors="replace")
-                return (resp.status, body)
-        except urllib.error.HTTPError as e:
-            last_status = e.code
-            last_body = e.read().decode("utf-8", errors="replace") if e.fp else ""
-            last_err = e
-            if e.code in (502, 503) and attempt < retries - 1:
-                time.sleep(retry_delay)
-                continue
-            return (e.code, last_body)
-        except (OSError, urllib.error.URLError) as e:
-            last_err = e
-            last_status = -1
-            last_body = str(e)
-            if attempt < retries - 1:
-                time.sleep(retry_delay)
-                continue
-            return (-1, last_body)
-    return (last_status or -1, last_body or str(last_err or ""))
-
-
-def test_basic(url, expect_substrings=None):
-    """GET url; pass if status 200 and body contains any of expect_substrings (default: HuggingRun / Run anything)."""
-    if expect_substrings is None:
-        expect_substrings = ("HuggingRun", "Run anything")
-    status, body = http_get(url)
-    found = any(s in body for s in expect_substrings)
-    ok = status == 200 and found
-    print(f"[test] GET {url} -> {status}, body contains expected: {found}")
-    return ok
-
-
-def test_stress(url, n=50, concurrency=10):
-    """连续请求 n 次（简单串行），检查均返回 200。"""
-    import concurrent.futures
-    failed = 0
-    def one(i):
-        s, _ = http_get(url, timeout=15)
-        return s == 200
-    with concurrent.futures.ThreadPoolExecutor(max_workers=concurrency) as ex:
-        results = list(ex.map(one, range(n)))
-    passed = sum(results)
-    failed = n - passed
-    print(f"[stress] {n} requests: {passed} ok, {failed} failed")
-    return failed == 0
-
-
-def test_persistence(url, rounds=3):
-    """多轮访问，每轮均需返回 200（通用：任意应用只要稳定返回 200 即通过）。"""
-    ok_rounds = 0
-    for _ in range(rounds):
-        status, _ = http_get(url)
-        if status == 200:
-            ok_rounds += 1
-        time.sleep(1)
-    print(f"[persistence] {rounds} rounds: {ok_rounds} ok")
-    return ok_rounds == rounds
-
-
-# ── SSH Tests ────────────────────────────────────────────────────────────────
-
-def _ssh_cmd(host, port, user, command, timeout=15, identity_file=None):
-    """Run a command over SSH. Returns (returncode, stdout, stderr)."""
-    import subprocess
-    cmd = [
-        "ssh", "-o", "StrictHostKeyChecking=no",
-        "-o", "UserKnownHostsFile=/dev/null",
-        "-o", f"ConnectTimeout={timeout}",
-        "-o", "LogLevel=ERROR",
-        "-p", str(port),
-    ]
-    if identity_file:
-        cmd += ["-i", identity_file]
-    cmd += [f"{user}@{host}", command]
-    try:
-        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout + 5)
-        return proc.returncode, proc.stdout, proc.stderr
-    except subprocess.TimeoutExpired:
-        return -1, "", "SSH command timed out"
-    except Exception as e:
-        return -1, "", str(e)
-
-
-def test_ssh_connect(host, port, user, identity_file=None):
-    """Test SSH connectivity: run 'echo ok' and verify output."""
-    rc, out, err = _ssh_cmd(host, port, user, "echo ok", identity_file=identity_file)
-    ok = rc == 0 and "ok" in out
-    print(f"[ssh-test] connect {user}@{host}:{port} -> rc={rc}, output={'ok' if ok else repr(out.strip())}")
-    if not ok and err:
-        print(f"[ssh-test]   stderr: {err.strip()}")
-    return ok
-
-
-def test_ssh_command(host, port, user, identity_file=None):
-    """Test SSH command execution: run several diagnostic commands."""
-    checks = [
-        ("whoami", lambda out: user in out),
-        ("uname -s", lambda out: "Linux" in out),
-        ("which claude || echo no-claude", lambda out: "claude" in out.lower()),
-        ("pgrep -a ttyd || pgrep -a sshd", lambda out: len(out.strip()) > 0),
-    ]
-    all_ok = True
-    for cmd, validate in checks:
-        rc, out, err = _ssh_cmd(host, port, user, cmd, identity_file=identity_file)
-        passed = rc == 0 and validate(out)
-        status = "PASS" if passed else "FAIL"
-        print(f"[ssh-test] cmd '{cmd}' -> {status} (rc={rc}, out={out.strip()[:80]})")
-        if not passed:
-            all_ok = False
-    return all_ok
-
-
-def test_ssh_stress(host, port, user, n=30, concurrency=10, identity_file=None):
-    """SSH stress test: n concurrent SSH sessions each running a command."""
-    import concurrent.futures
-
-    def one_session(i):
-        rc, out, _ = _ssh_cmd(host, port, user, f"echo session-{i} && uptime",
-                              timeout=20, identity_file=identity_file)
-        return rc == 0 and f"session-{i}" in out
-
-    with concurrent.futures.ThreadPoolExecutor(max_workers=concurrency) as ex:
-        results = list(ex.map(one_session, range(n)))
-    passed = sum(results)
-    failed = n - passed
-    print(f"[ssh-stress] {n} sessions (concurrency={concurrency}): {passed} ok, {failed} failed")
-    return failed == 0
-
-
-def test_ssh_bruteforce(host, port, user, rounds=3, ramp_up=None, identity_file=None):
-    """Multi-round SSH stress with increasing concurrency (brute-force style)."""
-    if ramp_up is None:
-        ramp_up = [(20, 5), (40, 10), (60, 20)]
-    all_ok = True
-    for r in range(rounds):
-        n, conc = ramp_up[r % len(ramp_up)]
-        print(f"[ssh-bruteforce] Round {r+1}/{rounds}: {n} sessions, concurrency={conc}")
-        ok = test_ssh_stress(host, port, user, n=n, concurrency=conc, identity_file=identity_file)
-        if not ok:
-            all_ok = False
-            print(f"[ssh-bruteforce] Round {r+1} FAILED")
-            break
-        time.sleep(1)
-    if all_ok:
-        print(f"[ssh-bruteforce] ALL {rounds} rounds PASSED")
-    return all_ok
-
-
-def test_ssh_persistence_stress(host, port, user, persist_path="/data",
-                                n_files=100, concurrency=10, identity_file=None):
-    """Persistence stress test: write many files via SSH, verify they exist, check integrity.
-
-    Tests the operating system's persistent storage under load:
-    1. Write n_files with known content (concurrent)
-    2. Verify all files exist and content matches
-    3. Write large files to test storage capacity
-    4. Verify checksums
-    """
-    import concurrent.futures
-    import hashlib
-
-    test_dir = f"{persist_path}/stress-test-{int(time.time())}"
-    print(f"[persist-stress] Creating {n_files} files in {test_dir} ...")
-
-    # Phase 1: Create test directory
-    rc, _, err = _ssh_cmd(host, port, user, f"mkdir -p {test_dir}", identity_file=identity_file)
-    if rc != 0:
-        print(f"[persist-stress] FAIL: cannot mkdir {test_dir}: {err}")
-        return False
-
-    # Phase 2: Write files concurrently
-    def write_file(i):
-        content = f"persistence-test-file-{i}-{time.time()}"
-        cmd = f"echo '{content}' > {test_dir}/file_{i:04d}.txt"
-        rc, _, _ = _ssh_cmd(host, port, user, cmd, timeout=20, identity_file=identity_file)
-        return rc == 0, content
-
-    with concurrent.futures.ThreadPoolExecutor(max_workers=concurrency) as ex:
-        results = list(ex.map(write_file, range(n_files)))
-    written = sum(1 for ok, _ in results if ok)
-    print(f"[persist-stress] Written: {written}/{n_files} files")
-    if written < n_files:
-        print(f"[persist-stress] FAIL: only {written}/{n_files} files written")
-        return False
-
-    # Phase 3: Verify all files exist
-    rc, out, _ = _ssh_cmd(host, port, user, f"ls {test_dir}/ | wc -l",
-                          timeout=30, identity_file=identity_file)
-    count = int(out.strip()) if rc == 0 and out.strip().isdigit() else 0
-    print(f"[persist-stress] Verified: {count} files exist on disk")
-    if count < n_files:
-        print(f"[persist-stress] FAIL: expected {n_files}, found {count}")
-        return False
-
-    # Phase 4: Write a large file (1MB) to test storage
-    rc, _, err = _ssh_cmd(host, port, user,
-                          f"dd if=/dev/urandom of={test_dir}/large_1mb.bin bs=1024 count=1024 2>/dev/null && "
-                          f"ls -la {test_dir}/large_1mb.bin",
-                          timeout=30, identity_file=identity_file)
-    if rc != 0:
-        print(f"[persist-stress] FAIL: cannot write large file: {err}")
-        return False
-    print(f"[persist-stress] Large file (1MB) written OK")
-
-    # Phase 5: Compute and verify checksum
-    rc, out, _ = _ssh_cmd(host, port, user,
-                          f"sha256sum {test_dir}/large_1mb.bin",
-                          timeout=30, identity_file=identity_file)
-    if rc != 0 or not out.strip():
-        print(f"[persist-stress] FAIL: cannot compute checksum")
-        return False
-    checksum1 = out.strip().split()[0]
-
-    # Re-read and verify checksum matches
-    rc, out, _ = _ssh_cmd(host, port, user,
-                          f"sha256sum {test_dir}/large_1mb.bin",
-                          timeout=30, identity_file=identity_file)
-    checksum2 = out.strip().split()[0] if rc == 0 else ""
-    if checksum1 != checksum2:
-        print(f"[persist-stress] FAIL: checksum mismatch {checksum1} != {checksum2}")
-        return False
-    print(f"[persist-stress] Checksum verified: {checksum1[:16]}...")
-
-    # Phase 6: Concurrent read-write (simulates real usage)
-    def read_write(i):
-        # Read existing file, write new one
-        rc1, out, _ = _ssh_cmd(host, port, user,
-                               f"cat {test_dir}/file_{i:04d}.txt",
-                               timeout=20, identity_file=identity_file)
-        rc2, _, _ = _ssh_cmd(host, port, user,
-                             f"echo 'updated-{i}' >> {test_dir}/file_{i:04d}.txt",
-                             timeout=20, identity_file=identity_file)
-        return rc1 == 0 and rc2 == 0
-
-    print(f"[persist-stress] Concurrent read-write test ({n_files} files, {concurrency} workers)...")
-    with concurrent.futures.ThreadPoolExecutor(max_workers=concurrency) as ex:
-        results = list(ex.map(read_write, range(n_files)))
-    rw_ok = sum(results)
-    print(f"[persist-stress] Read-write: {rw_ok}/{n_files} ok")
-
-    # Cleanup
-    _ssh_cmd(host, port, user, f"rm -rf {test_dir}", timeout=30, identity_file=identity_file)
-
-    all_ok = rw_ok == n_files
-    if all_ok:
-        print(f"[persist-stress] ALL PERSISTENCE TESTS PASSED")
-    return all_ok
-
-
-def _curl_logs_url(space_id: str, log_type: str) -> str:
-    """Build the logs API URL (same as user's curl command)."""
-    return f"https://huggingface.co/api/spaces/{space_id}/logs/{log_type}"
-
-
-def stream_logs(space_id: str, log_type: str):
-    """Stream build or run logs via curl (user's command). Requires HF_TOKEN."""
-    import subprocess
-    token = os.environ.get("HF_TOKEN")
-    if not token:
-        print("HF_TOKEN required for --logs", file=sys.stderr)
-        sys.exit(1)
-    url = _curl_logs_url(space_id, log_type)
-    # curl -N -H "Authorization: Bearer $HF_TOKEN" "https://huggingface.co/api/spaces/<SPACE_ID>/logs/run|build"
-    try:
-        proc = subprocess.Popen(
-            ["curl", "-N", "-sS", "-H", f"Authorization: Bearer {token}", url],
-            stdout=subprocess.stdout,
-            stderr=subprocess.stderr,
-        )
-        proc.wait()
-        if proc.returncode != 0:
-            sys.exit(proc.returncode or 1)
-    except FileNotFoundError:
-        print("curl not found; falling back to urllib", file=sys.stderr)
-        req = urllib.request.Request(url, method="GET")
-        req.add_header("Authorization", f"Bearer {token}")
-        with urllib.request.urlopen(req, timeout=5) as resp:
-            while True:
-                chunk = resp.read(4096)
-                if not chunk:
-                    break
-                sys.stdout.buffer.write(chunk)
-                sys.stdout.flush()
-    except Exception as e:
-        print(f"Logs error: {e}", file=sys.stderr)
-        sys.exit(1)
-
-
-def fetch_log_tail(space_id: str, log_type: str, read_timeout=60, keep_tail_chars=25000):
-    """Fetch log via curl (user's command), return last keep_tail_chars. Used when build/run fails."""
-    import subprocess
-    token = os.environ.get("HF_TOKEN")
-    if not token:
-        return "(HF_TOKEN not set — set it and run again to see logs)"
-    url = _curl_logs_url(space_id, log_type)
-    try:
-        proc = subprocess.run(
-            ["curl", "-N", "-sS", "-H", f"Authorization: Bearer {token}", "--max-time", str(read_timeout), url],
-            capture_output=True,
-            text=True,
-            timeout=read_timeout + 10,
-        )
-        out = (proc.stdout or "") + (proc.stderr or "")
-        return out[-keep_tail_chars:] if len(out) > keep_tail_chars else out
-    except FileNotFoundError:
-        # fallback to urllib
-        req = urllib.request.Request(url, method="GET")
-        req.add_header("Authorization", f"Bearer {token}")
-        with urllib.request.urlopen(req, timeout=read_timeout) as resp:
-            out = resp.read().decode("utf-8", errors="replace")
-            return out[-keep_tail_chars:] if len(out) > keep_tail_chars else out
-    except Exception as e:
-        return f"(failed to fetch log: {e})"
-
-
-def main():
-    global SPACE_ID, APP_URL
-    p = argparse.ArgumentParser()
-    p.add_argument("--space-id", default=SPACE_ID)
-    p.add_argument("--url", default=APP_URL)
-    p.add_argument("--wait-running", action="store_true", help="Poll until Space is RUNNING")
-    p.add_argument("--test", action="store_true", help="Run basic + stress + persistence tests")
-    p.add_argument("--logs", choices=("build", "run"), help="Stream logs: build or run (SSE)")
-    p.add_argument("--stress-n", type=int, default=50)
-    p.add_argument("--max-wait", type=int, default=600)
-    p.add_argument("--expect", action="append", dest="expect_substrings",
-                   help="Expected substring(s) in response body (basic test). Can repeat. Default: HuggingRun, Run anything")
-    p.add_argument("--wait-url", action="store_true",
-                   help="Poll URL until 200 and body contains one of --expect (no HF_TOKEN needed)")
-    p.add_argument("--until-ok", action="store_true",
-                   help="Poll API until RUNNING, then test; on any fail print log tail and exit 1. Loop until this exits 0.")
-    p.add_argument("--watch", action="store_true",
-                   help="Use curl to poll run (and optional build) logs + app URL every N sec; don't stop (Ctrl+C to exit)")
-    p.add_argument("--watch-interval", type=int, default=20, help="Seconds between --watch polls (default 20)")
-    # SSH test options
-    p.add_argument("--ssh-test", action="store_true",
-                   help="Run SSH tests: connect + command + stress + bruteforce")
-    p.add_argument("--ssh-host", default="localhost", help="SSH host (default: localhost)")
-    p.add_argument("--ssh-port", type=int, default=2222, help="SSH port (default: 2222)")
-    p.add_argument("--ssh-user", default="user", help="SSH user (default: user)")
-    p.add_argument("--ssh-key", default=None, help="Path to SSH private key (optional)")
-    p.add_argument("--ssh-stress-n", type=int, default=30, help="SSH stress: total sessions (default: 30)")
-    p.add_argument("--ssh-concurrency", type=int, default=10, help="SSH stress: concurrent sessions (default: 10)")
-    args = p.parse_args()
-    SPACE_ID = args.space_id
-    APP_URL = args.url.rstrip("/")
-    expect_substrings = tuple(args.expect_substrings) if args.expect_substrings else None
-
-    if args.logs:
-        stream_logs(SPACE_ID, args.logs)
-        return
-
-    if args.watch:
-        # 用 curl + Bearer token 持续查看远端状态，不退出
-        if not os.environ.get("HF_TOKEN"):
-            print("HF_TOKEN required for --watch (use .env or export)", file=sys.stderr)
-            sys.exit(1)
-        import subprocess
-        interval = max(10, args.watch_interval)
-        run_url = _curl_logs_url(SPACE_ID, "run")
-        build_url = _curl_logs_url(SPACE_ID, "build")
-        token = os.environ.get("HF_TOKEN")
-        curl_h = ["-H", f"Authorization: Bearer {token}", "-N", "-sS", "--max-time", str(interval + 5)]
-        n = 0
-        while True:
-            n += 1
-            ts = time.strftime("%H:%M:%S", time.gmtime())
-            print(f"\n[watch #{n} {ts}] === runtime stage ===")
-            stage, _ = get_stage()
-            print(f"[watch] stage={stage}")
-            print(f"[watch] === GET {APP_URL} ===")
-            status, body = http_get(APP_URL, timeout=15)
-            print(f"[watch] HTTP {status}, body len={len(body)}, has noVNC={('noVNC' in body)}")
-            print(f"[watch] === run log (tail, curl --max-time {interval}) ===")
-            proc = subprocess.run(
-                ["curl"] + curl_h + ["--max-time", str(interval), run_url],
-                capture_output=True, text=True, timeout=interval + 10,
-            )
-            out = (proc.stdout or "") + (proc.stderr or "")
-            tail = out[-4000:] if len(out) > 4000 else out
-            for line in tail.strip().split("\n")[-25:]:
-                print(line)
-            print(f"[watch] next in {interval}s (Ctrl+C to stop)...")
-            time.sleep(interval)
-        return
-
-    if args.until_ok:
-        # 先立即查一次当前状态；已报错则马上用 curl 拉日志并退出，不空等
-        if not os.environ.get("HF_TOKEN"):
-            print("HF_TOKEN required for --until-ok (poll runtime + fetch logs)", file=sys.stderr)
-            sys.exit(1)
-        stage, err = get_stage()
-        if err:
-            print(f"[monitor] {err}")
-            sys.exit(1)
-        print(f"[monitor] Space {SPACE_ID} stage={stage}")
-        if stage == "ERROR" or stage == "BUILD_ERROR":
-            print(f"[monitor] 远端已报错，立即拉取日志 (curl)")
-            print("\n[monitor] === Build log (tail) ===")
-            print(fetch_log_tail(SPACE_ID, "build", read_timeout=15))
-            print("\n[monitor] === Run log (tail) ===")
-            print(fetch_log_tail(SPACE_ID, "run", read_timeout=15))
-            sys.exit(1)
-        if stage != "RUNNING":
-            ok = wait_running(
-                max_wait_sec=args.max_wait,
-                poll_interval=5,
-                app_url=APP_URL,
-                expect_substrings=expect_substrings or ("HuggingRun", "Run anything", "noVNC"),
-            )
-            if not ok:
-                print("\n[monitor] === Build log (tail) ===")
-                print(fetch_log_tail(SPACE_ID, "build", read_timeout=15))
-                print("\n[monitor] === Run log (tail) ===")
-                print(fetch_log_tail(SPACE_ID, "run", read_timeout=15))
-                sys.exit(1)
-        print(f"[test] Target: {APP_URL}")
-        if not test_basic(APP_URL, expect_substrings=expect_substrings):
-            print("[test] BASIC FAILED")
-            print("\n[monitor] === Run log (tail) ===")
-            print(fetch_log_tail(SPACE_ID, "run"))
-            sys.exit(1)
-        if not test_stress(APP_URL, n=args.stress_n):
-            print("[test] STRESS FAILED")
-            print("\n[monitor] === Run log (tail) ===")
-            print(fetch_log_tail(SPACE_ID, "run"))
-            sys.exit(1)
-        if not test_persistence(APP_URL):
-            print("[test] PERSISTENCE FAILED")
-            print("\n[monitor] === Run log (tail) ===")
-            print(fetch_log_tail(SPACE_ID, "run"))
-            sys.exit(1)
-        print("[test] ALL PASSED")
-        return
-
-    if args.wait_running:
-        ok = wait_running(max_wait_sec=args.max_wait)
-        if not ok:
-            print("\n[monitor] === Build log (tail) ===")
-            print(fetch_log_tail(SPACE_ID, "build"))
-            print("\n[monitor] === Run log (tail) ===")
-            print(fetch_log_tail(SPACE_ID, "run"))
-            sys.exit(1)
-
-    if args.wait_url:
-        ok = wait_url(APP_URL, expect_substrings=expect_substrings or ("HuggingRun", "Run anything", "noVNC"),
-                     max_wait_sec=args.max_wait, poll_interval=20)
-        if not ok:
-            sys.exit(1)
-
-    if args.ssh_test:
-        print(f"[ssh-test] Target: {args.ssh_user}@{args.ssh_host}:{args.ssh_port}")
-        print("=" * 60)
-        print("[Phase 1] SSH Connect")
-        if not test_ssh_connect(args.ssh_host, args.ssh_port, args.ssh_user, identity_file=args.ssh_key):
-            print("[ssh-test] CONNECT FAILED")
-            sys.exit(1)
-        print()
-        print("[Phase 2] SSH Command Execution")
-        if not test_ssh_command(args.ssh_host, args.ssh_port, args.ssh_user, identity_file=args.ssh_key):
-            print("[ssh-test] COMMAND EXEC FAILED")
-            sys.exit(1)
-        print()
-        print("[Phase 3] SSH Stress Test")
-        if not test_ssh_stress(args.ssh_host, args.ssh_port, args.ssh_user,
-                               n=args.ssh_stress_n, concurrency=args.ssh_concurrency,
-                               identity_file=args.ssh_key):
-            print("[ssh-test] STRESS FAILED")
-            sys.exit(1)
-        print()
-        print("[Phase 4] SSH Brute-force Ramp-up")
-        if not test_ssh_bruteforce(args.ssh_host, args.ssh_port, args.ssh_user,
-                                   identity_file=args.ssh_key):
-            print("[ssh-test] BRUTEFORCE FAILED")
-            sys.exit(1)
-        print()
-        print("[Phase 5] Persistence Stress Test")
-        if not test_ssh_persistence_stress(args.ssh_host, args.ssh_port, args.ssh_user,
-                                           n_files=args.ssh_stress_n,
-                                           concurrency=args.ssh_concurrency,
-                                           identity_file=args.ssh_key):
-            print("[ssh-test] PERSISTENCE STRESS FAILED")
-            sys.exit(1)
-        print("=" * 60)
-        print("[ssh-test] ALL SSH TESTS PASSED")
-        return
-
-    if args.test:
-        print(f"[test] Target: {APP_URL}")
-        if not test_basic(APP_URL, expect_substrings=expect_substrings):
-            print("[test] BASIC FAILED")
-            sys.exit(1)
-        if not test_stress(APP_URL, n=args.stress_n):
-            print("[test] STRESS FAILED")
-            sys.exit(1)
-        if not test_persistence(APP_URL):
-            print("[test] PERSISTENCE CHECK (keyword) FAILED")
-            sys.exit(1)
-        print("[test] ALL PASSED")
-    else:
-        rt, err = get_runtime()
-        if err:
-            print("Runtime:", err)
-        else:
-            print("Runtime:", getattr(rt, "stage", rt.raw))
-
-
-if __name__ == "__main__":
-    main()

scripts/verify_overnight.sh

@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-# Overnight verification: 3 full --until-ok runs. Exit 0 only if all pass.
-# Usage: from repo root, with .env containing HF_TOKEN:
-#   bash scripts/verify_overnight.sh
-set -e
-REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-cd "$REPO_ROOT"
-LOG="$REPO_ROOT/docs/verification_run.log"
-APP_URL="${APP_URL:-https://tao-shen-huggingrun.hf.space}"
-EXPECT="${EXPECT:-Directory listing}"
-ROUNDS="${ROUNDS:-3}"
-
-if [ ! -f .env ]; then
-  echo "Missing .env (HF_TOKEN required)" >&2
-  exit 1
-fi
-export $(grep -v '^#' .env | xargs)
-
-echo "=== Overnight verification started $(date -u +%Y-%m-%dT%H:%M:%SZ) ===" | tee -a "$LOG"
-echo "APP_URL=$APP_URL EXPECT=$EXPECT ROUNDS=$ROUNDS" | tee -a "$LOG"
-
-PASSED=0
-for r in $(seq 1 "$ROUNDS"); do
-  echo "" | tee -a "$LOG"
-  echo "--- Round $r/$ROUNDS at $(date -u +%H:%M:%SZ) ---" | tee -a "$LOG"
-  if python3 scripts/monitor_and_test.py --until-ok --url "$APP_URL" --expect "$EXPECT" --stress-n 50 >> "$LOG" 2>&1; then
-    PASSED=$((PASSED+1))
-    echo "Round $r PASSED" | tee -a "$LOG"
-  else
-    echo "Round $r FAILED" | tee -a "$LOG"
-    exit 1
-  fi
-  [ "$r" -lt "$ROUNDS" ] && sleep 30
-done
-
-echo "" | tee -a "$LOG"
-echo "=== ALL $ROUNDS ROUNDS PASSED at $(date -u +%Y-%m-%dT%H:%M:%SZ) ===" | tee -a "$LOG"
-exit 0

ubuntu-desktop/Dockerfile

@@ -1,51 +0,0 @@
-# Ubuntu 24.04 Desktop on HuggingRun — noVNC on 7860, persistence via /data
-FROM ubuntu:24.04
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-# System + Python (for sync)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates curl python3 python3-pip python3-venv \
-    && pip3 install --no-cache-dir --break-system-packages huggingface_hub \
-    && rm -rf /var/lib/apt/lists/*
-
-# Desktop stack: Xvfb, XFCE, dbus, x11vnc, Firefox; OpenSSH for reverse SSH (本地 SSH 进容器)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    xvfb \
-    xfce4 xfce4-goodies \
-    dbus-x11 \
-    x11vnc \
-    firefox \
-    procps \
-    openssh-server openssh-client \
-    && rm -rf /var/lib/apt/lists/*
-
-# noVNC (web client on 7860)
-RUN apt-get update && apt-get install -y --no-install-recommends git \
-    && git clone --depth 1 https://github.com/novnc/noVNC.git /opt/noVNC \
-    && git clone --depth 1 https://github.com/novnc/websockify /opt/noVNC/utils/websockify \
-    && rm -rf /var/lib/apt/lists/* /opt/noVNC/.git
-
-# HF Spaces run as user 1000; UID 1000 may exist (e.g. ubuntu)
-RUN (useradd -m -u 1000 user 2>/dev/null) || \
-    (EXISTING=$$(getent passwd 1000 | cut -d: -f1); \
-     usermod -l user $$EXISTING; usermod -d /home/user user; \
-     mkdir -p /home/user && chown 1000:1000 /home/user)
-ENV HOME=/home/user
-RUN mkdir -p /data && chown user:user /data
-
-# HuggingRun scripts (build context = repo root)
-COPY scripts /scripts
-COPY ubuntu-desktop/start-desktop.sh /opt/start-desktop.sh
-RUN chmod +x /scripts/entrypoint.sh /opt/start-desktop.sh
-
-ENV PERSIST_PATH=/data
-ENV RUN_CMD="/opt/start-desktop.sh"
-ENV DESKTOP_HOME=/data/desktop-home
-ENV DISPLAY=:99
-ENV VNC_PORT=5901
-ENV NOVNC_PORT=7860
-
-USER user
-EXPOSE 7860
-ENTRYPOINT ["/scripts/entrypoint.sh"]

ubuntu-desktop/README.md

@@ -1,20 +0,0 @@
-# Ubuntu 桌面示例
-
-本目录是 **HuggingRun 通用工具** 的一个示例：在 HF 上跑 Ubuntu + XFCE + noVNC，使用与主仓库**完全相同的** `scripts/`（entrypoint + sync），**不修改任何通用逻辑**；仅通过本目录的 Dockerfile 设置 `RUN_CMD=/opt/start-desktop.sh`。
-
-- **通用用法**：见 [docs/GENERAL_USAGE.md](docs/GENERAL_USAGE.md)。
-- **本示例**：`Dockerfile` 在此目录，构建时从仓库根 COPY `scripts/`，并设置 `RUN_CMD=/opt/start-desktop.sh`；`start-desktop.sh` 启动 Xvfb + XFCE + x11vnc + noVNC（监听 7860），桌面 HOME 放在 `PERSIST_PATH/desktop-home`，由通用同步脚本持久化。
-
-## 最小用法（用户只做两件事）
-
-1. **Duplicate HuggingRun Space** 后，用本目录的 **Dockerfile 内容替换**仓库根目录的 `Dockerfile`（不增删通用脚本）。
-2. 在 Settings → Secrets 中设置 `HF_TOKEN`，可选 `AUTO_CREATE_DATASET=true`。
-3. 推送后等待构建，浏览器打开 Space 即可看到 noVNC 桌面；重启后状态由通用持久化保留。
-
-从仓库根构建（例如本地）：`docker build -f ubuntu-desktop/Dockerfile .`
-
-**部署后监控与压测**（与通用工具同一套）：部署完成后，用通用脚本轮询 + 压测即可。例如：  
-`python3 scripts/monitor_and_test.py --url "https://你的用户名-你的Space名.hf.space" --test --stress-n 50`  
-详见 [docs/REMOTE_LOGS.md](docs/REMOTE_LOGS.md) 拉取 build/run 日志配合本地 debug。
-
-维护重点在通用层；本示例仅做最小封装，不向 core 增加任何案例专用逻辑。

ubuntu-desktop/start-desktop.sh

@@ -1,82 +0,0 @@
-#!/bin/bash
-# Start Ubuntu desktop: Xvfb + XFCE + x11vnc + noVNC on 7860
-# HOME is set to persistent dir by caller (sync/entrypoint). Here we ensure and use it.
-echo "[start-desktop] Starting ..." >&2
-set -e
-
-export PERSIST_PATH="${PERSIST_PATH:-/data}"
-export DESKTOP_HOME="${DESKTOP_HOME:-$PERSIST_PATH/desktop-home}"
-export DISPLAY="${DISPLAY:-:99}"
-export VNC_PORT="${VNC_PORT:-5901}"
-export NOVNC_PORT="${NOVNC_PORT:-7860}"
-
-mkdir -p "$DESKTOP_HOME"
-export HOME="$DESKTOP_HOME"
-
-# Ensure minimal XFCE dirs
-mkdir -p "$HOME/.config" "$HOME/.local/share" "$HOME/Desktop"
-
-# Start Xvfb
-Xvfb "$DISPLAY" -screen 0 1280x720x24 -ac +extension GLX +render -noreset &
-XVFB_PID=$!
-sleep 2
-echo "[start-desktop] After Xvfb sleep 2" >&2
-
-# Start dbus for session (optional; run in subshell so failure never triggers set -e)
-( dbus-daemon --session 2>/dev/null ) || true
-echo "[start-desktop] Before XFCE background" >&2
-
-# Start XFCE (lightweight); use full path in case PATH is minimal
-(sleep 1; /usr/bin/startxfce4) &
-DESKTOP_PID=$!
-echo "[start-desktop] After XFCE & before sleep 3" >&2
-sleep 3
-echo "[start-desktop] XFCE started, starting x11vnc ..." >&2
-
-# x11vnc: share display :99 on port 5901 (do not exit on failure so noVNC can still start)
-x11vnc -display "$DISPLAY" -rfbport "$VNC_PORT" -forever -shared -noxdamage -nopw -bg || true
-
-# SSH: always start sshd; do not let failures here stop noVNC
-set +e
-SSHD_PORT="${SSH_PORT:-2222}"
-SSHD_LISTEN="${SSH_LISTEN:-0.0.0.0}"
-mkdir -p "$HOME/.ssh"
-
-# If SSH_AUTHORIZED_KEYS is set, use key-based auth only; otherwise allow password auth for local testing
-[ -n "${SSH_AUTHORIZED_KEYS-}" ] && echo "$SSH_AUTHORIZED_KEYS" > "$HOME/.ssh/authorized_keys" && chmod 600 "$HOME/.ssh/authorized_keys"
-
-# Use pre-generated host key from Docker build, or generate at runtime
-HOST_KEY="$HOME/.ssh/ssh_host_ed25519_key"
-[ ! -f "$HOST_KEY" ] && cp /home/user/.ssh/ssh_host_ed25519_key "$HOST_KEY" 2>/dev/null
-[ ! -f "$HOST_KEY" ] && ssh-keygen -t ed25519 -f "$HOST_KEY" -N "" -C "" 2>/dev/null
-
-if [ -f "$HOST_KEY" ]; then
-  if [ -f "$HOME/.ssh/authorized_keys" ]; then
-    # Key-based auth only (production / HF Spaces)
-    echo "[start-desktop] Starting sshd (key auth) on $SSHD_LISTEN:$SSHD_PORT ..." >&2
-    /usr/sbin/sshd -o "Port=$SSHD_PORT" -o "HostKey=$HOST_KEY" \
-         -o "AuthorizedKeysFile=$HOME/.ssh/authorized_keys" \
-         -o "PermitEmptyPasswords=no" -o "PasswordAuthentication=no" \
-         -o "ListenAddress=$SSHD_LISTEN" -o "PidFile=$HOME/.ssh/sshd.pid" \
-         -o "UsePAM=no" -o "PermitUserEnvironment=yes" -D -e &
-  else
-    # No keys configured: allow password-less login for local Docker testing
-    echo "[start-desktop] Starting sshd (no-password, local test) on $SSHD_LISTEN:$SSHD_PORT ..." >&2
-    /usr/sbin/sshd -o "Port=$SSHD_PORT" -o "HostKey=$HOST_KEY" \
-         -o "PermitEmptyPasswords=yes" -o "PasswordAuthentication=yes" \
-         -o "ListenAddress=$SSHD_LISTEN" -o "PidFile=$HOME/.ssh/sshd.pid" \
-         -o "UsePAM=no" -o "PermitRootLogin=no" -D -e &
-  fi
-  SSHD_PID=$!
-  sleep 1
-  echo "[start-desktop] sshd PID=$SSHD_PID" >&2
-
-  # Reverse SSH tunnel (HF Spaces: outbound only on 80/443/8080)
-  [ -n "${SSH_REVERSE_TARGET-}" ] && ssh -o StrictHostKeyChecking=no -o ServerAliveInterval=60 -R "0.0.0.0:${SSHD_PORT}:127.0.0.1:${SSHD_PORT}" $SSH_REVERSE_TARGET -N &
-fi
-set -e
-
-# noVNC: must run in foreground; listen on 0.0.0.0 so HF proxy can reach it
-echo "[start-desktop] Starting noVNC on 0.0.0.0:$NOVNC_PORT ..." >&2
-# Use bash -c so novnc_proxy runs as main process; if it exits, keep container alive with sleep
-exec /bin/bash -c "cd /opt/noVNC && ./utils/novnc_proxy --listen 0.0.0.0:$NOVNC_PORT --vnc localhost:$VNC_PORT --web /opt/noVNC" || exec sleep infinity