fix: pin machine-id + seed shellular config from env vars to bypass rate limit

Dockerfile

@@ -1,24 +1,25 @@
 # ── Base image ────────────────────────────────────────────────────────────────
-# node:20-slim is Debian-based — needed for node-pty native compilation.
-# It ships with a built-in "node" user at UID 1000, which is what HF Spaces uses.
 FROM node:20-slim
 
-# ── System dependencies ───────────────────────────────────────────────────────
-# python3, make, g++ are required to build node-pty (native addon used by shellular)
+# ── System dependencies (needed to compile node-pty used by shellular) ────────
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-        python3 \
-        make \
-        g++ \
-    && rm -rf /var/lib/apt/lists/*
-
-# ── Use the existing "node" user (UID 1000) ───────────────────────────────────
-# node:20-slim already has a "node" user at UID 1000 — no need to create one.
+    apt-get install -y --no-install-recommends python3 make g++ && \
+    rm -rf /var/lib/apt/lists/*
+
+# ── Pin a fixed machine-id ────────────────────────────────────────────────────
+# node-machine-id reads /etc/machine-id.  By writing a fixed value here the
+# shellular config seeded from SHELLULAR_HOST_ID / SHELLULAR_KEY env vars will
+# always match — no re-registration needed across container restarts.
+RUN echo "d8904b4d338adf83688caac869f64c0b" > /etc/machine-id && \
+    mkdir -p /var/lib/dbus && \
+    echo "d8904b4d338adf83688caac869f64c0b" > /var/lib/dbus/machine-id
+
+# ── Use the built-in "node" user (UID 1000, matches HF Spaces runtime) ────────
 USER node
 ENV HOME=/home/node \
     PATH="/home/node/.npm-global/bin:${PATH}"
 
-# ── Install shellular globally (into the node user's prefix) ─────────────────
+# ── Install shellular globally ────────────────────────────────────────────────
 RUN npm config set prefix /home/node/.npm-global && \
     npm install -g shellular
 
@@ -31,7 +32,6 @@ RUN npm install --omit=dev
 COPY --chown=node:node . .
 
 # ── Runtime ───────────────────────────────────────────────────────────────────
-# Hugging Face Spaces expects port 7860
 EXPOSE 7860
 ENV PORT=7860
 

app.js

@@ -1,6 +1,8 @@
 import express from 'express';
 import { spawn } from 'child_process';
 import crypto from 'crypto';
+import fs from 'fs';
+import os from 'os';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
@@ -27,6 +29,42 @@ function stripAnsi(str) {
   return str.replace(/[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><~]/g, '');
 }
 
+// ── Pre-seed shellular config from env vars ───────────────────────────────────
+// If SHELLULAR_HOST_ID and SHELLULAR_KEY are set (as HF Secrets), we write
+// them into ~/.shellular/ so shellular skips the registration API call entirely.
+// This avoids rate-limit errors during container cold-starts.
+function seedShellularConfig() {
+  const hostId  = process.env.SHELLULAR_HOST_ID;
+  const keyB64  = process.env.SHELLULAR_KEY;       // base64-encoded 32-byte key
+  const machineId = process.env.SHELLULAR_MACHINE_ID; // must match registration
+
+  if (!hostId || !keyB64 || !machineId) return;
+
+  const shellularDir = path.join(os.homedir(), '.shellular');
+  const configFile   = path.join(shellularDir, 'config.json');
+  const keyFile      = path.join(shellularDir, `shellular-${machineId}.e2ee`);
+
+  try {
+    fs.mkdirSync(shellularDir, { recursive: true });
+
+    // Write config.json (skips registration on next shellular start)
+    if (!fs.existsSync(configFile)) {
+      fs.writeFileSync(configFile, JSON.stringify({ hostId, machineId }), 'utf-8');
+      console.log(`[shellular] seeded config: hostId=${hostId}`);
+    }
+
+    // Write the E2E key file (32 bytes from base64)
+    if (!fs.existsSync(keyFile)) {
+      fs.writeFileSync(keyFile, Buffer.from(keyB64, 'base64'), { mode: 0o600 });
+      console.log(`[shellular] seeded key: ${keyFile}`);
+    }
+  } catch (err) {
+    console.error('[shellular] failed to seed config:', err.message);
+  }
+}
+
+seedShellularConfig();
+
 // ── Auth routes ───────────────────────────────────────────────────────────────
 app.post('/api/login', (req, res) => {
   const { key } = req.body;
@@ -74,9 +112,6 @@ function startShellular() {
 
   broadcast({ type: 'status', status: 'starting' });
 
-  // shellular registers the VPS with the relay and prints a QR code on first
-  // connection. --unknown-clients always-allow means any phone that scans the
-  // QR is let in without an extra interactive prompt.
   shellularProc = spawn('shellular', ['--unknown-clients', 'always-allow'], {
     env: { ...process.env, FORCE_COLOR: '0' },
     stdio: ['ignore', 'pipe', 'pipe'],
@@ -124,10 +159,8 @@ app.get('/api/stream', requireAuth, (req, res) => {
   res.setHeader('X-Accel-Buffering', 'no'); // disable nginx buffering on HF
   res.flushHeaders();
 
-  // Send current state immediately so the UI can paint the right view
   send(res, { type: 'status', status: shellularProc ? 'running' : 'stopped' });
 
-  // Replay buffered output so a reconnecting client sees the existing QR code
   if (outputBuffer) {
     send(res, { type: 'output', text: outputBuffer });
   }
@@ -145,7 +178,7 @@ app.post('/api/shellular/start', requireAuth, (_req, res) => {
 app.post('/api/shellular/stop', requireAuth, (_req, res) => {
   stopShellular();
   outputBuffer = '';
-  broadcast({ type: 'output', text: '' }); // clear clients
+  broadcast({ type: 'output', text: '' });
   res.json({ ok: true });
 });