Restore LLM_MODEL picker type and catalog binding

env-builder.html

@@ -901,21 +901,6 @@ body {
       <aside class="right-panel">
         <div class="panel-scroll">
 
-          <!-- Summary -->
-          <div class="pblock">
-            <div class="pblock-head">
-              <span class="pblock-title">🧭 Quick Guide</span>
-            </div>
-            <div class="pblock-body">
-              <ol class="quick-guide">
-                <li>Click <strong>⚡ Required</strong> to select must-have vars.</li>
-                <li>Fill values in selected cards (search works by key/tag/group).</li>
-                <li>Click <strong># Generate Bundle</strong> and copy Bundle/Env line.</li>
-                <li>Paste into HF Space variables or use <strong>↓ Import & Apply</strong>.</li>
-              </ol>
-            </div>
-          </div>
-
           <div class="pblock">
             <div class="pblock-head">
               <span class="pblock-title">📊 Summary</span>

env-builder.js

@@ -54,25 +54,25 @@ const MODEL_CATALOGS = {
     "Groq": [
       "groq/compound",
       "groq/compound-mini",
-      "llama-3.1-8b-instant",
-      "llama-3.1-70b-versatile",
-      "llama-3.3-70b-versatile",
+      "groq/llama-3.1-8b-instant",
+      "groq/llama-3.1-70b-versatile",
+      "groq/llama-3.3-70b-versatile",
       "meta-llama/llama-4-scout-17b-16e-instruct",
       "openai/gpt-oss-20b",
       "openai/gpt-oss-120b",
       "qwen/qwen3-32b",
-      "mixtral-8x7b-32768"
+      "groq/mixtral-8x7b-32768"
     ],
     "Mistral": [
-      "mistral-large-latest",
-      "mistral-large-2",
-      "mistral-medium-3.5",
-      "mistral-small-latest",
-      "mistral-small-3.2",
-      "devstral-2",
-      "ocr-3-premier",
-      "voxtral-mini-transcribe-realtime",
-      "codestral-latest"
+      "mistral/mistral-large-latest",
+      "mistral/mistral-large-2",
+      "mistral/mistral-medium-3.5",
+      "mistral/mistral-small-latest",
+      "mistral/mistral-small-3.2",
+      "mistral/devstral-2",
+      "mistral/ocr-3-premier",
+      "mistral/voxtral-mini-transcribe-realtime",
+      "mistral/codestral-latest"
     ],
     "Cohere": [
       "command-a",
@@ -280,25 +280,25 @@ const MODEL_CATALOGS = {
   "GROQ_MODELS": [
     "groq/compound",
     "groq/compound-mini",
-    "llama-3.1-8b-instant",
-    "llama-3.1-70b-versatile",
-    "llama-3.3-70b-versatile",
+    "groq/llama-3.1-8b-instant",
+    "groq/llama-3.1-70b-versatile",
+    "groq/llama-3.3-70b-versatile",
     "openai/gpt-oss-20b",
     "openai/gpt-oss-120b",
     "meta-llama/llama-4-scout-17b-16e-instruct",
     "qwen/qwen3-32b",
-    "mixtral-8x7b-32768"
+    "groq/mixtral-8x7b-32768"
   ],
   "MISTRAL_MODELS": [
-    "mistral-large-latest",
-    "mistral-large-2",
-    "mistral-medium-3.5",
-    "mistral-small-latest",
-    "mistral-small-3.2",
-    "devstral-2",
-    "ocr-3-premier",
-    "voxtral-mini-transcribe-realtime",
-    "codestral-latest"
+    "mistral/mistral-large-latest",
+    "mistral/mistral-large-2",
+    "mistral/mistral-medium-3.5",
+    "mistral/mistral-small-latest",
+    "mistral/mistral-small-3.2",
+    "mistral/devstral-2",
+    "mistral/ocr-3-premier",
+    "mistral/voxtral-mini-transcribe-realtime",
+    "mistral/codestral-latest"
   ],
   "XAI_MODELS": [
     "grok-4.3",
@@ -1680,8 +1680,7 @@ const FIELDS = [
     "icon": "🔌",
     "k": "CUSTOM_MODEL_ID",
     "lbl": "Model ID",
-    "type": "model",
-    "options_key": "LLM_MODEL",
+    "type": "text",
     "ph": "custom model id",
     "tag": "feature"
   },
@@ -1732,7 +1731,7 @@ const FIELDS = [
     "k": "CUSTOM_MAX_TOKENS",
     "lbl": "Max output tokens",
     "type": "number",
-    "ph": "500",
+    "ph": "8192",
     "tag": "advanced"
   },
 {
@@ -2061,6 +2060,7 @@ function defaultValueFor(field) {
 }
 
 function valueControlHTML(field) {
+  if (!field || !field.k) return '<span style="color:red">Invalid field</span>';
   const key = esc(field.k);
   const placeholder = esc(field.ph || field.lbl || '');
   const isSecret = !!field.secret;
@@ -2100,7 +2100,6 @@ function valueControlHTML(field) {
       ${control}
     </div>`;
 
-  return control;
 }
 
 function cardHTML(f, origIdx = 0) {
@@ -2418,23 +2417,31 @@ function bindFieldEvents() {
 
 function renderSections() {
   const grouped = {};
-  FIELDS.forEach(f => { (grouped[f.g] ||= []).push(f); });
+  FIELDS.forEach(f => {
+    if (!f || !f.g || !f.k) return;
+    (grouped[f.g] ||= []).push(f);
+  });
 
   const wrap = $('sections');
+  if (!wrap) return;
   wrap.innerHTML = '';
   Object.entries(grouped).forEach(([grp, items]) => {
-    const sec = document.createElement('div');
-    sec.className = 'sec';
-    sec.dataset.section = grp;
-    sec.innerHTML = `
-      <div class="sec-header">
-        <span class="sec-icon">${ICONS[grp] || '📁'}</span>
-        <span class="sec-title">${esc(grp)}</span>
-        <span class="sec-count">${items.length}</span>
-        <div class="sec-line"></div>
-      </div>
-      <div class="cards">${items.map((f, i) => cardHTML(f, i)).join('')}</div>`;
-    wrap.appendChild(sec);
+    try {
+      const sec = document.createElement('div');
+      sec.className = 'sec';
+      sec.dataset.section = grp;
+      sec.innerHTML = `
+        <div class="sec-header">
+          <span class="sec-icon">${ICONS[grp] || '📁'}</span>
+          <span class="sec-title">${esc(grp)}</span>
+          <span class="sec-count">${items.length}</span>
+          <div class="sec-line"></div>
+        </div>
+        <div class="cards">${items.map((f, i) => { try { return cardHTML(f, i); } catch(e) { console.error('cardHTML error for field', f.k, e); return ''; } }).join('')}</div>`;
+      wrap.appendChild(sec);
+    } catch(e) {
+      console.error('renderSections error for group', grp, e);
+    }
   });
   bindFieldEvents();
 }
@@ -2457,11 +2464,17 @@ function copyText(text) {
 }
 
 // ── Init ──
-renderSidebar();
-renderSections();
-addCustomRow();
-filter();
-refresh();
+try {
+  renderSidebar();
+  renderSections();
+  addCustomRow();
+  filter();
+  refresh();
+} catch(e) {
+  console.error('HuggingClaw ENV Builder init error:', e);
+  const wrap = document.getElementById('sections');
+  if (wrap) wrap.innerHTML = '<div style="color:red;padding:20px">ENV Builder failed to load. Open browser console for details. Error: ' + e.message + '</div>';
+}
 
 // ── Events ──
 $('search').oninput = filter;

health-server.js

@@ -22,10 +22,15 @@ const JUPYTER_HOST = "127.0.0.1";
 const JUPYTER_BASE = normalizeBase(process.env.JUPYTER_BASE, "/terminal");
 const GATEWAY_TOKEN = (process.env.GATEWAY_TOKEN || "").trim();
 const DEV_MODE_ENABLED = isTrue(process.env.DEV_MODE);
-// Default true. Only false when DEV_MODE=false or HUGGINGCLAW_JUPYTER_ENABLED=false is explicitly set.
+// Explicit HUGGINGCLAW_JUPYTER_ENABLED=true enables Jupyter.
+// Otherwise DEV_MODE=true enables it unless HUGGINGCLAW_JUPYTER_ENABLED is explicitly false.
+// HUGGINGCLAW_JUPYTER_ENABLED=true is the explicit user override and always wins.
 const JUPYTER_ENABLED =
-  !/^(false|0|no|off)$/i.test(String(process.env.DEV_MODE || "").trim()) &&
-  !/^(false|0|no|off)$/i.test(String(process.env.HUGGINGCLAW_JUPYTER_ENABLED || "").trim());
+  /^(true|1|yes|on)$/i.test(String(process.env.HUGGINGCLAW_JUPYTER_ENABLED || "").trim()) ||
+  (
+    isTrue(process.env.DEV_MODE) &&
+    !/^(false|0|no|off)$/i.test(String(process.env.HUGGINGCLAW_JUPYTER_ENABLED || "").trim())
+  );
 const startTime = Date.now();
 const LLM_MODEL = process.env.LLM_MODEL || "Not Set";
 const LLM_PROVIDER = LLM_MODEL.includes("/") ? LLM_MODEL.split("/")[0] : "";
@@ -100,7 +105,7 @@ async function detectSpacePrivacy() {
     return;
   }
 
-  const token = (process.env.HF_TOKEN || "").trim();
+  const token = (process.env.HF_TOKEN || process.env.HUGGINGFACE_HUB_TOKEN || "").trim();
   const reqOptions = {
     hostname: "huggingface.co",
     path: `/api/spaces/${SPACE_ID}`,
@@ -248,9 +253,14 @@ function parseCookies(req) {
 
 // Constant-time comparison — prevent timing attacks on token check
 function safeEqual(a, b) {
-  if (typeof a !== "string" || typeof b !== "string" || a.length !== b.length) return false;
-  let d = 0;
-  for (let i = 0; i < a.length; i++) d |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  if (typeof a !== "string" || typeof b !== "string") return false;
+  // Pad both to the same length so the loop always takes constant time,
+  // preventing token length from being leaked via early-return timing.
+  const len = Math.max(a.length, b.length, 1);
+  const pa = a.padEnd(len, "\0");
+  const pb = b.padEnd(len, "\0");
+  let d = a.length === b.length ? 0 : 1; // length mismatch → always fail
+  for (let i = 0; i < len; i++) d |= pa.charCodeAt(i) ^ pb.charCodeAt(i);
   return d === 0;
 }
 
@@ -664,7 +674,7 @@ const server = http.createServer(async (req, res) => {
       const body = await readBody(req);
       const token = decodeURIComponent((body.match(/(?:^|&)token=([^&]*)/) || [])[1] || "").replace(/\+/g, " ");
       if (safeEqual(token, GATEWAY_TOKEN)) {
-        const cookie = `hc_env_auth=${encodeURIComponent(GATEWAY_TOKEN)}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`;
+        const cookie = `hc_env_auth=${encodeURIComponent(GATEWAY_TOKEN)}; Path=/; HttpOnly; SameSite=None; Secure; Max-Age=86400`;
         res.writeHead(302, { Location: "/env-builder", "Set-Cookie": cookie, "Cache-Control": "no-store" });
         return res.end();
       }
@@ -676,7 +686,7 @@ const server = http.createServer(async (req, res) => {
   }
 
   if (pathname === "/env-builder/logout") {
-    res.writeHead(302, { Location: "/env-builder", "Set-Cookie": "hc_env_auth=; Path=/; HttpOnly; Max-Age=0", "Cache-Control": "no-store" });
+    res.writeHead(302, { Location: "/env-builder", "Set-Cookie": "hc_env_auth=; Path=/; HttpOnly; SameSite=None; Secure; Max-Age=0", "Cache-Control": "no-store" });
     return res.end();
   }
 

multi-provider-key-rotator.cjs

@@ -86,6 +86,13 @@ const PROVIDERS = [
     envPlural:  'ZAI_API_KEYS',
     envSingular:'ZAI_API_KEY',
   },
+  {
+    name:       'kimi-coding',
+    // kimi-coding routes through api.moonshot.cn; dedicated entry so KIMI_API_KEYS pool is used
+    hostname:   /(?:^|\.)api\.moonshot\.cn$/i,
+    envPlural:  'KIMI_API_KEYS',
+    envSingular:'KIMI_API_KEY',
+  },
   {
     name:       'moonshot',
     hostname:   /(?:^|\.)api\.moonshot\.cn$/i,

start.sh

@@ -203,7 +203,7 @@ case "$LLM_PROVIDER" in
   byteplus|byteplus-plan)       export BYTEPLUS_API_KEY="$LLM_API_KEY" ;;
   qianfan)                      export QIANFAN_API_KEY="$LLM_API_KEY" ;;
   # ── Western Providers ──
-  mistral|mistralai)            export MISTRAL_API_KEY="$LLM_API_KEY" ;;
+  mistral)                      export MISTRAL_API_KEY="$LLM_API_KEY" ;;
   xai|x-ai)                     export XAI_API_KEY="$LLM_API_KEY" ;;
   nvidia)                       export NVIDIA_API_KEY="$LLM_API_KEY" ;;
   cohere)                       export COHERE_API_KEY="$LLM_API_KEY" ;;
@@ -214,8 +214,18 @@ case "$LLM_PROVIDER" in
   venice)                       export VENICE_API_KEY="$LLM_API_KEY" ;;
   synthetic)                    export SYNTHETIC_API_KEY="$LLM_API_KEY" ;;
   github-copilot)               export COPILOT_GITHUB_TOKEN="$LLM_API_KEY" ;;
+  llama-3.*|llama-4.*|mixtral-*|gemma-*)
+    export GROQ_API_KEY="$LLM_API_KEY"
+    echo "Note: bare Groq model '$LLM_MODEL' detected; mapped LLM_API_KEY → GROQ_API_KEY. Use 'groq/${LLM_MODEL}' prefix to be explicit." ;;
+  mistral-*|codestral-*|devstral-*|voxtral-*)
+    export MISTRAL_API_KEY="$LLM_API_KEY"
+    echo "Note: bare Mistral model '$LLM_MODEL' detected; mapped LLM_API_KEY → MISTRAL_API_KEY. Use 'mistral/${LLM_MODEL}' prefix to be explicit." ;;
+  moonshotai|meta-llama|deepseek-ai|MiniMaxAI|minimax-ai|Qwen|zai-org|mistralai|google)
+    echo "Warning: LLM_MODEL='$LLM_MODEL' uses sub-provider prefix '$LLM_PROVIDER'. This is a router-namespaced model (Together/OpenRouter). Mapping LLM_API_KEY → TOGETHER_API_KEY. If using OpenRouter, also set OPENROUTER_API_KEY as a separate secret."
+    export TOGETHER_API_KEY="${TOGETHER_API_KEY:-$LLM_API_KEY}" ;;
   # ── Fallback: Anthropic (default) ──
   *)
+    echo "Warning: Unknown provider prefix '$LLM_PROVIDER' in LLM_MODEL='$LLM_MODEL'. Defaulting to ANTHROPIC_API_KEY. If using a router-namespaced model (e.g. moonshotai/Kimi-K2.5), set TOGETHER_API_KEY or OPENROUTER_API_KEY as a separate secret."
     export ANTHROPIC_API_KEY="$LLM_API_KEY"
     ;;
 esac
@@ -553,6 +563,7 @@ ensure_chromium_for_browser_plugin() {
   echo "ERROR: Browser plugin is enabled, but Chromium install failed. Disable browser plugin or rebuild image with Chromium preinstalled." >&2
   return 1
 }
+HC_STARTUP_FAILURES=0
 ensure_chromium_for_browser_plugin || HC_STARTUP_FAILURES=$((HC_STARTUP_FAILURES + 1))
 
 # On Debian/Ubuntu, /usr/bin/chromium is often a shell wrapper while the real
@@ -1374,7 +1385,7 @@ fi
 # Runs user-provided boot commands one by one so failures are visible in logs.
 # By default failures are logged and boot continues; set
 # HUGGINGCLAW_STARTUP_STRICT=true to fail the Space startup on any error.
-HC_STARTUP_FAILURES=0
+# HC_STARTUP_FAILURES initialized earlier (before Chromium ensure check)
 HC_STARTUP_STRICT_NORMALIZED=$(printf '%s' "${HUGGINGCLAW_STARTUP_STRICT:-false}" | tr '[:upper:]' '[:lower:]')
 hc_run_startup_command() {
   local source_label="$1"
@@ -1761,16 +1772,6 @@ while true; do
   # 11. Start WhatsApp Guardian after the gateway is accepting connections
   start_guardian_once
 
-  # ── Silence D-Bus errors for headless Chromium ──
-  if [ -z "${DBUS_SESSION_BUS_ADDRESS:-}" ]; then
-    if command -v dbus-launch >/dev/null 2>&1; then
-      eval "$(dbus-launch --sh-syntax 2>/dev/null)" || true
-      export DBUS_SESSION_BUS_ADDRESS="${DBUS_SESSION_BUS_ADDRESS:-disabled:}"
-    else
-      export DBUS_SESSION_BUS_ADDRESS="disabled:"
-    fi
-  fi
-
   # 11.5 Warm up the managed browser so first browser actions have a live tab
   warmup_browser