Add HF_TOKEN preflight + LICENSE + ignore build artifacts

- Sync workflow now fails fast with a human-readable error if
HF_TOKEN is missing, malformed, or rejected by HF's whoami, so
token-rotation regressions surface in 2 lines instead of 40.
- Add MIT LICENSE file (pyproject already declares MIT but the
file itself was missing, which bare-sdist consumers and some
lints flag).
- Ignore `build/` and `dist/` so release artifacts don't pollute
the working tree.

.github/workflows/sync-to-hf-space.yml

@@ -26,6 +26,45 @@ jobs:
           fetch-depth: 0
           lfs: true
 
+      # Fail fast with a human-readable message if HF_TOKEN is missing or
+      # obviously invalid, rather than letting `git push` die with a cryptic
+      # "Authentication required" 40 lines into the log.
+      - name: Preflight — HF_TOKEN sanity check
+        env:
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+        run: |
+          if [ -z "${HF_TOKEN}" ]; then
+            echo "::error::HF_TOKEN secret is not set on this repository."
+            echo "Create a Write-scope token at https://huggingface.co/settings/tokens"
+            echo "and add it as a repo secret named HF_TOKEN (Settings → Secrets → Actions)."
+            exit 1
+          fi
+          # Real HF user tokens start with `hf_` and are >=20 chars. This
+          # catches pasted-in empties/quotes without hitting the API.
+          case "${HF_TOKEN}" in
+            hf_*) : ;;
+            *)
+              echo "::error::HF_TOKEN does not look like a Hugging Face user token (expected prefix 'hf_')."
+              echo "Regenerate at https://huggingface.co/settings/tokens with Write scope."
+              exit 1
+              ;;
+          esac
+          if [ "${#HF_TOKEN}" -lt 20 ]; then
+            echo "::error::HF_TOKEN is suspiciously short (${#HF_TOKEN} chars) — likely truncated."
+            exit 1
+          fi
+          # Verify the token is actually accepted by HF's whoami endpoint
+          # before we try to push. Saves wading through git's auth output.
+          http_code=$(curl -s -o /tmp/hf_whoami.json -w "%{http_code}" \
+            -H "Authorization: Bearer ${HF_TOKEN}" \
+            https://huggingface.co/api/whoami-v2)
+          if [ "${http_code}" != "200" ]; then
+            echo "::error::HF whoami returned ${http_code}. Token is invalid or revoked."
+            echo "Regenerate at https://huggingface.co/settings/tokens with Write scope."
+            exit 1
+          fi
+          echo "HF_TOKEN looks good (whoami returned 200)."
+
       - name: Push to Hugging Face Space
         env:
           HF_TOKEN: ${{ secrets.HF_TOKEN }}

.gitignore

@@ -1,6 +1,8 @@
 __pycache__/
 *.py[cod]
 *.egg-info/
+build/
+dist/
 .venv/
 venv/
 .env

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 QCal Copilot contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.