fix: 2 more Mac path leaks + /selftest endpoint to catch this pattern early

USER: 'นายจะลงมา Mac เรื่อยๆ ทำไม ในเมื่อเราให้ไปใช้ HF แล้ว'
ROOT PATTERN: Mac mindset \u2192 hardcoded /Users/Ashira paths leak into HF code

LEAKS FOUND (verified by greping HF Space code):
1. bin/dataset-enrich.sh:35
WORK = Path('/Users/Ashira/.hermes/workspace/dataset-enrich')
\u2192 PermissionError on HF Space \u2192 every shard crashed
2. bin/ask-sqlite.py:19
AXENTX = Path('/Users/Ashira/axentx')

FIXED:
Both replaced with Path.home() / ... \u2192 portable

PREVENTION: NEW /selftest endpoint:
GET https://axentx-surrogate-1.hf.space/selftest
Returns:
- import_datasets / huggingface_hub / pyarrow / numpy / sqlite3 (must all be true)
- path_~/.surrogate/{bin,state,logs} (must all exist)
- no_mac_paths (greps active .sh files for '/Users/Ashira' \u2192 must be empty)
- hf_token_set
ok: True only if ALL checks pass

This catches Mac-mindset bugs IMMEDIATELY after deploy.
Workflow now: push \u2192 wait rebuild \u2192 curl /selftest \u2192 fix anything red.

Lesson learned: don't test on Mac and assume HF works.
HF Space is the only environment that matters.

bin/ask-sqlite.py

@@ -16,7 +16,7 @@ DB = str(Path.home() / ".surrogate/index.db")
 OLLAMA = "http://localhost:11434/api/chat"
 DEFAULT_MODEL = "granite4:7b-a1b-h"
 
-AXENTX = Path("/Users/Ashira/axentx")
+AXENTX = Path.home() / "axentx"
 PROJECTS = ["Costinel", "Vanguard", "arkship", "surrogate", "workio"]
 
 

bin/dataset-enrich.sh

@@ -32,7 +32,7 @@ from pathlib import Path
 from datasets import load_dataset
 import hashlib, json, time, os
 
-WORK = Path("/Users/Ashira/.hermes/workspace/dataset-enrich")
+WORK = Path.home() / ".hermes/workspace/dataset-enrich"
 WORK.mkdir(parents=True, exist_ok=True)
 api = HfApi()
 

bin/hermes-status-server.py

@@ -200,6 +200,50 @@ class ChatRequest(BaseModel):
     timeout_sec: int = 180
 
 
+
+
+@app.get("/selftest")
+def selftest() -> dict:
+    """Verify HF Space environment — catches Mac-mindset bugs early.
+    Tests: critical imports, hardcoded path leaks, key file existence."""
+    results = {"ok": True, "checks": {}}
+    
+    # 1. Required imports
+    for mod in ["datasets", "huggingface_hub", "pyarrow", "numpy", "sqlite3"]:
+        try:
+            __import__(mod)
+            results["checks"][f"import_{mod}"] = True
+        except ImportError as e:
+            results["checks"][f"import_{mod}"] = False
+            results["ok"] = False
+    
+    # 2. Critical paths exist (HF Space side)
+    for path_str in ["~/.surrogate/bin", "~/.surrogate/state", "~/.surrogate/logs"]:
+        p = Path(os.path.expanduser(path_str))
+        results["checks"][f"path_{path_str}"] = p.exists()
+        if not p.exists():
+            results["ok"] = False
+    
+    # 3. No Mac path leaks in active scripts
+    bad_paths = []
+    for f in (HOME / ".surrogate/bin").rglob("*.sh"):
+        try:
+            text_content = f.read_text(errors="ignore")
+            if "/Users/Ashira" in text_content:
+                bad_paths.append(f.name)
+        except Exception:
+            pass
+    results["checks"]["no_mac_paths"] = len(bad_paths) == 0
+    if bad_paths:
+        results["ok"] = False
+        results["mac_path_leaks"] = bad_paths[:10]
+    
+    # 4. HF token present
+    results["checks"]["hf_token_set"] = bool(os.environ.get("HF_TOKEN") or os.environ.get("HUGGING_FACE_HUB_TOKEN"))
+    
+    return results
+
+
 @app.post("/chat")
 async def chat(req: ChatRequest) -> JSONResponse:
     """Run a prompt through the surrogate CLI inside the container, return result.