fix(redeploy): use cached huggingface-cli login by default

HF_TOKEN was a hard requirement; HfApi() falls back to the
~/.cache/huggingface/token written by 'huggingface-cli login' so the
env var is unnecessary when the user is already authed.

- update_hf_env.sh: HfApi(token=os.environ.get('HF_TOKEN')) — None
routes to cached login.
- redeploy.sh: replace the HF_TOKEN guard with a real auth probe via
HfApi().whoami(); exits early with a clear hint if neither path is
authed.
- runbook: drop the HF_TOKEN= prefix from the quick-redeploy snippet.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/DROPLET-RUNBOOK.md

@@ -2,12 +2,13 @@
 
 _Last verified: 2026-05-09 (terramind synthesis + LoRA adapters confirmed firing live)_
 
-> **Quick redeploy:** `HF_TOKEN=<write-token> scripts/redeploy.sh <new-droplet-ip>`
+> **Quick redeploy:** `scripts/redeploy.sh <new-droplet-ip>`
 > generates a fresh bearer token, builds + brings up vLLM + riprap-models, updates
 > the HF Space env vars, restarts the Space, and runs the end-to-end probe.
-> Source-committed fixes (e.g. the May 9 terramind chip-tensor + synthesis
-> patches) are inherited automatically because `deploy_droplet.sh` tars
-> `services/riprap-models/` from this repo at run time.
+> HF auth comes from `huggingface-cli login` (cached) — `HF_TOKEN` env override
+> is supported but not required. Source-committed fixes (e.g. the May 9
+> terramind chip-tensor + synthesis patches) are inherited automatically because
+> `deploy_droplet.sh` tars `services/riprap-models/` from this repo at run time.
 
 ## Spec
 

scripts/redeploy.sh

@@ -9,7 +9,7 @@
 # Usage: scripts/redeploy.sh <droplet-ip>
 #
 # Requires:
-#   HF_TOKEN  env var with write access to the HF Space
+#   HF auth — either `huggingface-cli login` (preferred) or HF_TOKEN env var
 #   .venv     Python virtual environment with probe_addresses.py deps
 #   SSH access to the droplet (ssh-agent or SSH_KEY env var)
 #
@@ -27,8 +27,20 @@ fi
 
 IP="$1"
 
-if [ -z "${HF_TOKEN:-}" ]; then
-    echo "Error: HF_TOKEN env var is required (write access to the HF Space)" >&2
+# Verify HF auth is available before doing the long droplet build.
+# Either HF_TOKEN env or a cached CLI login works — HfApi() picks up
+# whichever is set.
+if ! python3 -c "
+import sys
+from huggingface_hub import HfApi
+try:
+    HfApi().whoami()
+except Exception as e:
+    print(f'HF auth check failed: {e}', file=sys.stderr)
+    print('Run: huggingface-cli login   (or: export HF_TOKEN=...)',
+          file=sys.stderr)
+    sys.exit(1)
+" >/dev/null; then
     exit 1
 fi
 

scripts/update_hf_env.sh

@@ -5,9 +5,12 @@
 # Usage: scripts/update_hf_env.sh <droplet-ip> <bearer-token>
 #
 # Requires:
-#   HF_TOKEN  env var with write access to the Space
 #   huggingface_hub >= 0.36 installed (provides the Python API used below;
 #   note: 'huggingface-cli space variables' does not exist in this version)
+#   Either:
+#     - `huggingface-cli login` cached token (preferred), OR
+#     - HF_TOKEN env var
+#   HfApi() picks up the cached login automatically; HF_TOKEN overrides.
 #
 # Space slug: lablab-ai-amd-developer-hackathon/riprap-nyc
 # Variables set (from docs/DROPLET-RUNBOOK.md §Required secrets):
@@ -17,6 +20,7 @@
 #   RIPRAP_ML_BACKEND     remote
 #   RIPRAP_ML_BASE_URL    http://<ip>:7860
 #   RIPRAP_ML_API_KEY     <token>
+#   RIPRAP_NYCHA_REGISTERS 1
 set -euo pipefail
 
 if [ "$#" -ne 2 ]; then
@@ -27,11 +31,6 @@ fi
 IP="$1"
 TOKEN="$2"
 
-if [ -z "${HF_TOKEN:-}" ]; then
-    echo "Error: HF_TOKEN env var is required (write access to the Space)" >&2
-    exit 1
-fi
-
 SPACE_ID="lablab-ai-amd-developer-hackathon/riprap-nyc"
 SPACE_URL="https://lablab-ai-amd-developer-hackathon-riprap-nyc.hf.space"
 VLLM_PORT=8001
@@ -55,7 +54,7 @@ except ImportError:
     print('Error: huggingface_hub not installed', file=sys.stderr)
     sys.exit(1)
 
-api = HfApi(token=os.environ['HF_TOKEN'])
+api = HfApi(token=os.environ.get('HF_TOKEN'))  # None → cached CLI login
 space_id = '${SPACE_ID}'
 ip = '${IP}'
 token = '${TOKEN}'
@@ -90,7 +89,7 @@ echo "==> Restarting HF Space"
 python3 -c "
 import os
 from huggingface_hub import HfApi
-api = HfApi(token=os.environ['HF_TOKEN'])
+api = HfApi(token=os.environ.get('HF_TOKEN'))  # None → cached CLI login
 rt = api.restart_space(repo_id='${SPACE_ID}')
 print(f'    stage after restart request: {rt.stage}')
 "