Fix sandbox HF_TOKEN not available inside container

Secret was injected after the Space was already running, so the env var
was never present in the container. Move secret injection to before the
build/start cycle. Also bump OAuth token lifetime to 30 days.

README.md

@@ -6,6 +6,7 @@ colorTo: purple
 sdk: docker
 app_port: 7860
 hf_oauth: true
+hf_oauth_expiration_minutes: 43200
 hf_oauth_scopes:
   - read-repos
   - write-repos

agent/tools/sandbox_client.py

@@ -519,6 +519,7 @@ class Sandbox:
         private: bool = False,
         sleep_time: int | None = None,
         token: str | None = None,
+        secrets: dict[str, str] | None = None,
         wait_timeout: int = WAIT_TIMEOUT,
         log: "Callable[[str], object] | None" = None,
         cancel_event: "Any | None" = None,
@@ -579,6 +580,13 @@ class Sandbox:
 
         _check_cancel()
 
+        # Inject secrets BEFORE uploading server files (which triggers rebuild).
+        # Secrets added after a Space is running aren't available until restart,
+        # so they must be set before the build/start cycle.
+        if secrets:
+            for key, val in secrets.items():
+                api.add_space_secret(space_id, key, val)
+
         # Upload sandbox server and Dockerfile (triggers rebuild)
         cls._setup_server(space_id, api, log=_log)
 

agent/tools/sandbox_tool.py

@@ -124,6 +124,7 @@ async def _ensure_sandbox(
         "owner": owner,
         "hardware": hardware,
         "token": token,
+        "secrets": {"HF_TOKEN": token},
         "log": _log,
         "cancel_event": cancel_flag,
         **create_kwargs,
@@ -150,9 +151,6 @@ async def _ensure_sandbox(
         token=token,
     )
 
-    # Inject the OAuth token into the sandbox so Hub operations work inside it
-    await asyncio.to_thread(api.add_space_secret, sb.space_id, "HF_TOKEN", token)
-
     await session.send_event(
         Event(
             event_type="tool_log",