feat: persist WeChat credentials via HF Space Secrets + account JSON

Three-layer persistence ensures WeChat NEVER needs re-scanning:
1. HF Space Secrets (WEIXIN_TOKEN, WEIXIN_ACCOUNT_ID) — survives everything
2. .env file — gateway's load_env picks these up
3. /data/hermes/weixin/accounts/<id>.json — gateway's load_weixin_account()

On every startup, start.sh:
- Reads WEIXIN_TOKEN/ACCOUNT_ID from HF Secrets (env vars)
- Writes them to both .env and account JSON
- Falls back to reading from persisted account JSON if secrets missing
- Logs masked values (never full tokens in build logs)

start.sh

@@ -33,42 +33,48 @@ if [ ! -L "$WEIXIN_DIR" ]; then
     echo "Symlink: weixin -> /data/hermes/weixin"
 fi
 
-# Auto-discover WeChat account_id AND token from persisted session files
-# The QR login flow saves credentials to ~/.hermes/weixin/accounts/<account_id>.json
-# We export both WEIXIN_ACCOUNT_ID and WEIXIN_TOKEN so the gateway picks them up
+# ── WeChat credential persistence ──
+# Priority: HF Space Secrets > persisted account JSON file > .env file
+# Once set via HF Space Secrets, WeChat survives ALL container rebuilds.
 ACCOUNTS_DIR="/data/hermes/weixin/accounts"
-if [ -z "$WEIXIN_ACCOUNT_ID" ] && [ -d "$ACCOUNTS_DIR" ]; then
-    LATEST=$(find "$ACCOUNTS_DIR" -name "*.json" ! -name "*.context-tokens.json" ! -name "*.sync.json" -type f -printf '%T@ %p\n' 2>/dev/null | sort -rn | head -1 | awk '{print $2}')
-    if [ -n "$LATEST" ]; then
-        DISCOVERED_ID=$(basename "$LATEST" .json)
-        export WEIXIN_ACCOUNT_ID="$DISCOVERED_ID"
-        echo "Auto-discovered WEIXIN_ACCOUNT_ID=$DISCOVERED_ID"
-    else
-        echo "No WeChat account files found in $ACCOUNTS_DIR"
+mkdir -p "$ACCOUNTS_DIR"
+
+if [ -z "$WEIXIN_ACCOUNT_ID" ] || [ -z "$WEIXIN_TOKEN" ]; then
+    # Fallback: restore from persisted account JSON file
+    if [ -z "$WEIXIN_ACCOUNT_ID" ] && [ -d "$ACCOUNTS_DIR" ]; then
+        LATEST=$(find "$ACCOUNTS_DIR" -name "*.json" ! -name "*.context-tokens.json" ! -name "*.sync.json" -type f -printf '%T@ %p\n' 2>/dev/null | sort -rn | head -1 | awk '{print $2}')
+        if [ -n "$LATEST" ]; then
+            DISCOVERED_ID=$(basename "$LATEST" .json)
+            export WEIXIN_ACCOUNT_ID="$DISCOVERED_ID"
+            echo "Auto-discovered WEIXIN_ACCOUNT_ID=$DISCOVERED_ID"
+        fi
+    fi
+    if [ -z "$WEIXIN_TOKEN" ] && [ -n "$WEIXIN_ACCOUNT_ID" ]; then
+        ACCOUNT_FILE="$ACCOUNTS_DIR/${WEIXIN_ACCOUNT_ID}.json"
+        if [ -f "$ACCOUNT_FILE" ]; then
+            DISCOVERED_TOKEN=$(python3 -c "import json; d=json.load(open('$ACCOUNT_FILE')); print(d.get('token',''))" 2>/dev/null)
+            if [ -n "$DISCOVERED_TOKEN" ]; then
+                export WEIXIN_TOKEN="$DISCOVERED_TOKEN"
+                echo "Restored WEIXIN_TOKEN from persisted account file"
+            fi
+        fi
     fi
 fi
 
-# Also restore WEIXIN_TOKEN from persisted account file if not already set
-# This is needed because .env generated from HF Space Secrets doesn't contain WEIXIN_TOKEN
-if [ -z "$WEIXIN_TOKEN" ] && [ -n "$WEIXIN_ACCOUNT_ID" ]; then
+if [ -n "$WEIXIN_ACCOUNT_ID" ] && [ -n "$WEIXIN_TOKEN" ]; then
+    echo "WeChat credentials ready (account=$(_mask_val "$WEIXIN_ACCOUNT_ID"))"
+    # Persist credentials to account JSON so gateway's load_weixin_account() also finds them
     ACCOUNT_FILE="$ACCOUNTS_DIR/${WEIXIN_ACCOUNT_ID}.json"
-    if [ -f "$ACCOUNT_FILE" ]; then
-        DISCOVERED_TOKEN=$(python3 -c "
-import json, sys
-try:
-    d = json.load(open('$ACCOUNT_FILE'))
-    print(d.get('token', ''))
-except: print('')
-" 2>/dev/null)
-        if [ -n "$DISCOVERED_TOKEN" ]; then
-            export WEIXIN_TOKEN="$DISCOVERED_TOKEN"
-            echo "Restored WEIXIN_TOKEN from persisted account file"
-        else
-            echo "WARNING: WeChat account file found but token is empty — QR re-scan needed"
-        fi
-    else
-        echo "WARNING: WeChat account file $ACCOUNT_FILE not found — QR scan needed"
+    if [ ! -f "$ACCOUNT_FILE" ] || ! python3 -c "import json; d=json.load(open('$ACCOUNT_FILE')); exit(0 if d.get('token') else 1)" 2>/dev/null; then
+        python3 -c "
+import json, time
+payload = {'token': '$WEIXIN_TOKEN', 'base_url': 'https://ilinkai.weixin.qq.com', 'saved_at': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())}
+with open('$ACCOUNT_FILE', 'w') as f: json.dump(payload, f)
+" 2>/dev/null && chmod 600 "$ACCOUNT_FILE"
+        echo "WeChat credentials persisted to account file"
     fi
+else
+    echo "WARNING: WeChat not configured (no token/account). Run 'hermes gateway setup' to scan QR."
 fi
 
 # -- Persist .env across container rebuilds --
@@ -98,6 +104,8 @@ if [ ! -f "$ENV_DATA" ] && [ -n "$OPENROUTER_API_KEY" ]; then
         echo "HERMES_ACCEPT_HOOKS=1"
         [ -n "$MEMPALACE_PALACE_PATH" ] && echo "MEMPALACE_PALACE_PATH=$MEMPALACE_PALACE_PATH"
         [ -n "$FIRECRAWL_API_KEY" ] && echo "FIRECRAWL_API_KEY=$FIRECRAWL_API_KEY"
+        [ -n "$WEIXIN_ACCOUNT_ID" ] && echo "WEIXIN_ACCOUNT_ID=$WEIXIN_ACCOUNT_ID"
+        [ -n "$WEIXIN_TOKEN" ] && echo "WEIXIN_TOKEN=$WEIXIN_TOKEN"
     } > "$ENV_DATA"
     chmod 600 "$ENV_DATA"
     echo "Created .env from Space Secrets (keys masked below)"
@@ -106,6 +114,7 @@ if [ ! -f "$ENV_DATA" ] && [ -n "$OPENROUTER_API_KEY" ]; then
     [ -n "$FEISHU_APP_ID" ] && echo "  FEISHU_APP_ID=$FEISHU_APP_ID"
     [ -n "$FEISHU_APP_SECRET" ] && echo "  FEISHU_APP_SECRET=$(_mask_val "$FEISHU_APP_SECRET")"
     [ -n "$FIRECRAWL_API_KEY" ] && echo "  FIRECRAWL_API_KEY=$(_mask_val "$FIRECRAWL_API_KEY")"
+    [ -n "$WEIXIN_TOKEN" ] && echo "  WEIXIN_TOKEN=$(_mask_val "$WEIXIN_TOKEN")"
 fi
 
 # Fallback: if no secrets and no persistent data
@@ -123,6 +132,14 @@ else
     echo "Symlink exists: .env"
 fi
 
+# Ensure WEIXIN_TOKEN/ACCOUNT_ID are in .env even if file was created earlier without them
+if [ -f "$ENV_DATA" ] && [ -n "$WEIXIN_TOKEN" ] && ! grep -q '^WEIXIN_TOKEN=' "$ENV_DATA" 2>/dev/null; then
+    echo "WEIXIN_TOKEN=$WEIXIN_TOKEN" >> "$ENV_DATA"
+fi
+if [ -f "$ENV_DATA" ] && [ -n "$WEIXIN_ACCOUNT_ID" ] && ! grep -q '^WEIXIN_ACCOUNT_ID=' "$ENV_DATA" 2>/dev/null; then
+    echo "WEIXIN_ACCOUNT_ID=$WEIXIN_ACCOUNT_ID" >> "$ENV_DATA"
+fi
+
 # ── Persist config.yaml across container rebuilds ──
 # WebUI settings page and WeChat save flow update ~/.hermes/config.yaml at runtime
 CFG_FILE="$HERMES_HOME/config.yaml"