feat: terminal on by default, uses GATEWAY_TOKEN, add dashboard button

- DEV_MODE defaults to true — no extra secret needed
- JUPYTER_TOKEN falls back to GATEWAY_TOKEN (single password)
- Add "Open Terminal →" button beside "Open Hermes Agent →" on dashboard
- Update README to reflect new defaults

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -202,22 +202,20 @@ With `CLOUDFLARE_WORKERS_TOKEN` set, HuggingMes can create a keep-alive worker t
 | `SYNC_INTERVAL` | `600` | Backup frequency in seconds |
 | `CLOUDFLARE_KEEPALIVE_ENABLED` | `true` | Set `false` to disable keep-awake worker |
 | `TELEGRAM_MODE` | `webhook` | `webhook` or `polling` |
-| `DEV_MODE` | `false` | Set `true` to enable JupyterLab terminal at `/terminal/` |
-| `JUPYTER_TOKEN` | — | Required when `DEV_MODE=true` — secures terminal access |
+| `DEV_MODE` | `true` | Set `false` to disable JupyterLab terminal at `/terminal/` |
+| `JUPYTER_TOKEN` | *(uses `GATEWAY_TOKEN`)* | Override terminal password (optional) |
 
 ## 💻 Terminal Access (JupyterLab)
 
-HuggingMes includes an optional JupyterLab terminal at `/terminal/` for direct shell access to the container — useful for running `hermes` commands, inspecting files, installing packages, and debugging.
+HuggingMes includes a JupyterLab terminal at `/terminal/` for direct shell access to the container — useful for running `hermes` commands, inspecting files, installing packages, and debugging. Enabled by default when `GATEWAY_TOKEN` is set.
 
 ### Setup
 
-1. Add two secrets to your Space:
-   - `DEV_MODE` = `true`
-   - `JUPYTER_TOKEN` = a strong random token (`openssl rand -hex 32`)
-2. Restart the Space.
-3. Open `https://your-space.hf.space/terminal/` — log in with your `GATEWAY_TOKEN` first, then JupyterLab will prompt for `JUPYTER_TOKEN`.
+The terminal is **on by default** — no extra configuration needed. Click **Open Terminal →** on the dashboard, then log in with your `GATEWAY_TOKEN`.
 
-> **Security:** JupyterLab grants full shell access to the container. Always use a strong, unique `JUPYTER_TOKEN`. The terminal will refuse to start if `JUPYTER_TOKEN` is empty or set to the insecure default.
+To disable it, set `DEV_MODE=false`. To use a separate terminal password, set `JUPYTER_TOKEN` to a different value.
+
+> **Security:** JupyterLab grants full shell access to the container. The terminal will not start if no `GATEWAY_TOKEN` is set.
 
 ### What you can do
 

health-server.js

@@ -492,8 +492,11 @@ function renderDashboard(data) {
     header { text-align:center; margin-bottom:22px; }
     h1 { margin:0; font-size:1.65rem; line-height:1; letter-spacing:0; }
     .subtitle { margin-top:12px; color:var(--muted); font-size:.72rem; text-transform:uppercase; letter-spacing:.14em; font-weight:800; }
-    .hero-action { display:flex; width:100%; min-height:46px; align-items:center; justify-content:center; border-radius:8px; background:#ffffff; color:#000000; text-decoration:none; font-weight:850; font-size:.98rem; margin:24px 0 20px; transition: background 0.15s ease; }
+    .hero-buttons { display:flex; gap:10px; margin:24px 0 20px; }
+    .hero-action { display:flex; flex:1; min-height:46px; align-items:center; justify-content:center; border-radius:8px; background:#ffffff; color:#000000; text-decoration:none; font-weight:850; font-size:.98rem; transition:background 0.15s ease; }
     .hero-action:hover { background:#e5e5e5; }
+    .hero-action.secondary { background:var(--panel); color:var(--text); border:1px solid var(--line); }
+    .hero-action.secondary:hover { background:var(--panel2); }
     .overview { display:grid; grid-template-columns:repeat(2, minmax(0, 1fr)); gap:10px; margin-bottom:10px; }
     .tile { border:1px solid var(--line); background:var(--panel); border-radius:11px; padding:18px; min-height:124px; display:flex; flex-direction:column; gap:10px; position:relative; }
     .tile.ok { border-color:rgba(34,197,94,.22); }
@@ -531,7 +534,10 @@ function renderDashboard(data) {
       <h1>HuggingMes</h1>
       <div class="subtitle">Self-hosted - Hermes Agent</div>
     </header>
-    <a class="hero-action" href="${APP_BASE}/" target="_blank" rel="noopener noreferrer">Open Hermes Agent -></a>
+    <div class="hero-buttons">
+      <a class="hero-action" href="${APP_BASE}/" target="_blank" rel="noopener noreferrer">Open Hermes Agent →</a>
+      <a class="hero-action secondary" href="/terminal/" target="_blank" rel="noopener noreferrer">Open Terminal →</a>
+    </div>
     <section class="overview">
       ${tiles}
     </section>

start.sh

@@ -308,17 +308,19 @@ echo "Dashboard : http://127.0.0.1:${DASHBOARD_PORT}"
 echo "Gateway   : http://127.0.0.1:${GATEWAY_API_PORT}"
 echo ""
 
-# ── JupyterLab terminal (DEV_MODE=true + JUPYTER_TOKEN required) ──
+# ── JupyterLab terminal (on by default, uses GATEWAY_TOKEN) ──
 start_jupyter() {
-  if [ "${DEV_MODE:-false}" != "true" ]; then
-    echo "JupyterLab disabled (set DEV_MODE=true to enable /terminal/)."
+  if [ "${DEV_MODE:-true}" = "false" ]; then
+    echo "JupyterLab disabled (DEV_MODE=false)."
     return 0
   fi
-  if [ -z "${JUPYTER_TOKEN:-}" ] || [ "${JUPYTER_TOKEN}" = "huggingface" ]; then
-    echo "ERROR: JUPYTER_TOKEN unset or insecure default. JupyterLab grants full shell — set a strong token." >&2
-    echo "       Hint: openssl rand -hex 32" >&2
+  # Use JUPYTER_TOKEN if set, otherwise fall back to GATEWAY_TOKEN
+  local token="${JUPYTER_TOKEN:-${API_SERVER_KEY:-}}"
+  if [ -z "$token" ]; then
+    echo "WARNING: No GATEWAY_TOKEN or JUPYTER_TOKEN set — JupyterLab skipped (terminal would be unauthenticated)." >&2
     return 1
   fi
+  export JUPYTER_TOKEN="$token"
   if ! python3 -c "import jupyterlab" >/dev/null 2>&1; then
     echo "WARNING: jupyterlab not installed; skipping terminal." >&2
     return 1