fix(code): broaden HF token detection so a11oy Code flips to generative

a11oy_code_engine.py

@@ -441,7 +441,21 @@ def _sandbox_exec(code: str, lang: str = "python", timeout_s: int = 6,
 #             (2) HF router IF a token is present (disclosed)
 #             (3) local DETERMINISTIC, retrieval-grounded responder (honest label)
 # ===========================================================================
-_HF_TOKEN = os.environ.get("HF_TOKEN") or os.environ.get("HUGGING_FACE_HUB_TOKEN") or ""
+# Token detection: read HF_TOKEN first, then a broad set of common fallback names so a
+# correctly-pasted token is picked up regardless of which secret NAME it was saved under
+# (HF Space secrets are sometimes saved as 'Token', 'HF_ROUTER_TOKEN', etc.). Values are
+# stripped of stray whitespace/quotes. Server-side only; never sent to the browser.
+def _detect_hf_token() -> str:
+    for _name in ("HF_TOKEN", "HUGGING_FACE_HUB_TOKEN", "HF_ROUTER_TOKEN",
+                  "HF_API_TOKEN", "HUGGINGFACE_TOKEN", "HUGGINGFACEHUB_API_TOKEN", "Token"):
+        _v = os.environ.get(_name)
+        if _v:
+            _v = _v.strip().strip('"').strip("'").strip()
+            if _v.startswith("hf_") or len(_v) >= 20:
+                return _v
+    return ""
+
+_HF_TOKEN = _detect_hf_token()
 _LOCAL_MODEL_CMD = os.environ.get("A11OY_LOCAL_MODEL_CMD") or ""
 
 # ---------------------------------------------------------------------------