refactor: remove Turnstile + disable local file writes (HF ephemeral runtime)

- Remove Cloudflare Turnstile verification from /v1/keys/me endpoint
- Make dynamic providers storage ephemeral (no disk writes)
- HF Space runtime is ephemeral, local writes are lost on restart
- API keys already use GitHub Gist for persistence

.dockerignore

@@ -0,0 +1,45 @@
+# HuggingFace Space Docker build - keep image lean
+
+# Git / opencode meta
+.git/
+.gitignore
+.dockerignore
+.opencode/
+thoughts/
+*.md
+!README.md
+
+# Python artifacts
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+*.egg-info/
+.Python
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+htmlcov/
+.coverage
+
+# Virtual envs
+venv/
+.venv/
+env/
+.env
+.env.*
+
+# Local-only runtime data (HF Space provides its own persistence)
+app/data/
+app/__pycache__/
+
+# IDE / editor
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Tests & dev utilities
+test_gist.py
+encrypt_config.py

.opencode/config.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "agent": {
+    "commander": {
+      "model": "qwenim/qwen3.7-max"
+    },
+    "brainstormer": {
+      "model": "qwenim/qwen3.7-max"
+    },
+    "planner": {
+      "model": "qwenim/qwen3.7-max"
+    },
+    "executor": {
+      "model": "qwenim/qwen3.7-max"
+    },
+    "implementer": {
+      "model": "qwenim/qwen3.7-max"
+    },
+    "reviewer": {
+      "model": "qwenim/qwen3.7-max"
+    },
+    "codebase-locator": {
+      "model": "qwenim/qwen3.7-max"
+    },
+    "codebase-analyzer": {
+      "model": "qwenim/qwen3.7-max"
+    },
+    "pattern-finder": {
+      "model": "qwenim/qwen3.7-max"
+    },
+    "ledger-creator": {
+      "model": "qwenim/qwen3.7-max"
+    },
+    "artifact-searcher": {
+      "model": "qwenim/qwen3.7-max"
+    },
+    "mm-orchestrator": {
+      "model": "qwenim/qwen3.7-max"
+    }
+  }
+}

app/config.py

@@ -216,9 +216,6 @@ UPSTREAM_API_KEYS = {
 
 # ── GitHub Gist Storage ─────────────────────────────────────────────────────
 
-TURNSTILE_SITE_KEY = _decrypt("enc:v1:Q1ElsRjDMKIbb-7l:Q2ewoEx10wQFL-BXxTp8Xapb815hL5Iy1_H0Yz9zhQX6DTX2dTgiAA==")
-TURNSTILE_SECRET_KEY = _decrypt("enc:v1:5AVf8i4aUlDhzWIW:_yLBFEmdzSl3FRbaNI1t0FiKA7gXWNPlsBYLCBwMh6yvKCv3wGW_Uf6ArVs9wpzUqfvt")
-
 HF_TOKEN = os.environ.get("HF_TOKEN", "")
 HF_DATASET = "rnilkyway/apiarium-logs"
 

app/index.py

@@ -19,7 +19,6 @@ from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 from config import (
     DEFAULT_UPSTREAM_URL, UPSTREAMS, UPSTREAM_API_KEYS,
     GITHUB_TOKEN, GIST_ID,
-    TURNSTILE_SITE_KEY, TURNSTILE_SECRET_KEY,
     HF_TOKEN, HF_DATASET,
     MASTER_KEY,
     AI_GATEWAY_URL, UPSTREAM_14448_URL,
@@ -46,7 +45,6 @@ MAX_CONTINUATIONS = 0
 
 RPM_LIMIT = 4
 KEYS_FILE = os.path.join(os.path.dirname(__file__), "data", "api_keys.json")
-PROVIDERS_FILE = os.path.join(os.path.dirname(__file__), "data", "providers.json")
 
 _rate_limits: dict = defaultdict(list)
 
@@ -1142,27 +1140,20 @@ class ProviderImportRequest(BaseModel):
 
 
 def _load_providers():
-    """Load dynamic providers from disk and inject into UPSTREAMS."""
+    """Dynamic providers are ephemeral in HF Space runtime - no persistence."""
     global _dynamic_providers
-    try:
-        if os.path.exists(PROVIDERS_FILE):
-            with open(PROVIDERS_FILE, "r") as f:
-                _dynamic_providers = json.load(f) or {}
-            for pid, prov in _dynamic_providers.items():
-                _register_provider_in_upstreams(prov)
-            logger.info("Loaded %d dynamic providers", len(_dynamic_providers))
-    except Exception as e:
-        logger.warning("Failed to load providers: %s", e)
-        _dynamic_providers = {}
+    _dynamic_providers = {}
 
 
 def _save_providers():
-    """Persist dynamic providers to disk."""
-    try:
-        os.makedirs(os.path.dirname(PROVIDERS_FILE), exist_ok=True)
-        with open(PROVIDERS_FILE, "w") as f:
-            json.dump(_dynamic_providers, f, indent=2)
-    except Exception as e:
+    """No-op: HF Space runtime is ephemeral, local writes are lost on restart."""
+    pass
+    # Original code that wrote to PROVIDERS_FILE:
+    # try:
+    #     os.makedirs(os.path.dirname(PROVIDERS_FILE), exist_ok=True)
+    #     with open(PROVIDERS_FILE, "w") as f:
+    #         json.dump(_dynamic_providers, f, indent=2)
+    # except Exception as e:
         logger.warning("Failed to save providers: %s", e)
 
 
@@ -1436,25 +1427,7 @@ async def get_my_key(request: Request, cf_token: str = None):
             detail={"error": {"message": "VPN/Proxy detected. Please turn off VPN and try again.", "type": "verification_error", "code": "vpn_blocked", "provider": vpn_result["provider"]}}
         )
 
-    # ── Step 2: Turnstile verification (optional when TURNSTILE_SECRET_KEY not configured) ──
-    if TURNSTILE_SECRET_KEY:
-        if not cf_token:
-            raise HTTPException(status_code=403, detail={"error": {"message": "Verification required", "type": "verification_error", "code": "missing_cf_token"}})
-        try:
-            verify_resp = await make_client().post(
-                "https://challenges.cloudflare.com/turnstile/v0/siteverify",
-                data={"response": cf_token, "secret": TURNSTILE_SECRET_KEY},
-            )
-            verify_data = verify_resp.json()
-            if not verify_data.get("success"):
-                raise HTTPException(status_code=403, detail={"error": {"message": "Verification failed", "type": "verification_error", "code": "invalid_cf_token"}})
-        except HTTPException:
-            raise
-        except Exception as e:
-            logger.warning("Turnstile verification error: %s", e)
-            raise HTTPException(status_code=500, detail={"error": {"message": "Verification service error", "type": "server_error", "code": "cf_verification_error"}})
-    else:
-        logger.info("Turnstile disabled (no TURNSTILE_SECRET_KEY), allowing key generation for IP %s", client_ip)
+    # Turnstile removed - no longer needed
 
     # ── Step 3: Auto-generate key for verified user ──
     new_key = generate_api_key()

app/templates/landing.html

@@ -135,10 +135,7 @@
                         </div>
                     </div>
 
-                    <!-- Cloudflare Turnstile -->
-                    <div id="turnstile-container" class="hidden w-full flex justify-center py-4">
-                        <div class="cf-turnstile" data-sitekey="0x4AAAAAADTUsX1T7VmpXhDi" data-callback="onTurnstileSuccess"></div>
-                    </div>
+
 
                     <!-- Key Display Area -->
                     <div class="relative group cursor-pointer" onclick="copyKey()">
@@ -274,12 +271,11 @@
         Copied to clipboard
     </div>
 
-    <!-- Cloudflare Turnstile -->
-    <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
+
 
     <script>
         const myKey = { key: null, ip: null };
-        const turnstileContainer = document.getElementById('turnstile-container');
+        // Turnstile removed
         const keyBadge = document.getElementById('keyBadge');
         const ykStatus = document.getElementById('ykStatus');
         const ykHint = document.getElementById('ykHint');
@@ -315,7 +311,7 @@
                     ykIp.textContent = data.ip;
                     ykKey.textContent = data.key;
                     
-                    turnstileContainer.classList.add('hidden');
+                        // turnstileContainer.classList.add('hidden');
                     
                     keyBadge.textContent = data.status === 'new' ? 'NEW' : 'AUTHORIZED';
                     keyBadge.className = "px-2 py-1 text-[10px] font-mono uppercase tracking-wider rounded border border-emerald-500/30 bg-emerald-500/10 text-emerald-400";
@@ -328,7 +324,7 @@
                     if (err.code === 'vpn_blocked') {
                         ykIp.textContent = 'RESTRICTED';
                         ykKey.textContent = '••••••••••••••••••••••••••••••••';
-                        turnstileContainer.classList.add('hidden');
+                    // turnstileContainer.classList.add('hidden');
                         
                         keyBadge.textContent = 'BLOCKED';
                         keyBadge.className = "px-2 py-1 text-[10px] font-mono uppercase tracking-wider rounded border border-red-500/30 bg-red-500/10 text-red-400";
@@ -338,7 +334,7 @@
                     } else {
                         ykIp.textContent = 'Pending verification...';
                         ykKey.textContent = '••••••••••••••••••••••••••••••••';
-                        turnstileContainer.classList.remove('hidden');
+                         // turnstileContainer.classList.remove('hidden');
                         
                         keyBadge.textContent = 'CHALLENGE';
                         keyBadge.className = "px-2 py-1 text-[10px] font-mono uppercase tracking-wider rounded border border-blue-500/30 bg-blue-500/10 text-blue-400";