feat(lumen-app): hf_client helper with HF_TOKEN auto-attach + startup detection log

Single `models::hf_client(timeout)` builder consolidates all HuggingFace
HTTP touchpoints (`fetch_hub_sha`, `models::download`, periodic
`check_model_updates`). When `HF_TOKEN` (or legacy
`HUGGING_FACE_HUB_TOKEN`) env var is set, attaches
`Authorization: Bearer <token>` as a default header on every request
— unlocks gated HF repos and raises the anonymous rate-limit ceiling
for the update-check sweep.

Token is read from env only; no persistence in config.toml (avoids
plaintext-secret storage; future iteration can add Keychain). Startup
log reports detection status by env var name only, never the token
value, so users see "[lumen-app] HuggingFace token detected via
$HF_TOKEN — gated repos accessible" if it's set, or a clear "no
HuggingFace token configured" otherwise.

Author: rabbitson87

crates/lumen-app/src/commands.rs

@@ -288,11 +288,12 @@ pub async fn check_model_updates(
     let entries = models::scan_local(&dir, &cat).map_err(err)?;
     drop(cat);
 
-    let client = reqwest::Client::builder()
-        .user_agent(concat!("lumen-app/", env!("CARGO_PKG_VERSION")))
-        .timeout(std::time::Duration::from_secs(8))
-        .build()
-        .map_err(|e| e.to_string())?;
+    // 8s timeout — anonymous HF API replies in <200ms; if we hit the cap
+    // something is wrong with the network and we'd rather skip the update
+    // check than wedge the UI. `hf_client` attaches HF_TOKEN automatically
+    // when set, so private/gated repos work for users who configured one.
+    let client =
+        models::hf_client(Some(std::time::Duration::from_secs(8))).map_err(|e| e.to_string())?;
 
     let mut results = Vec::with_capacity(repo_ids.len());
     let mut new_outdated = std::collections::HashSet::new();

crates/lumen-app/src/main.rs

@@ -17,6 +17,36 @@ use state::AppState;
 use tauri::Manager;
 
 fn main() {
+    // Surface HF_TOKEN detection at startup so users who configured one
+    // can see it took effect (no token value is logged — only its
+    // presence + source env var). Token unlocks gated HF repos and
+    // raises the anonymous rate limit ceiling for periodic update checks.
+    let hf_token_src = if std::env::var("HF_TOKEN")
+        .ok()
+        .filter(|t| !t.trim().is_empty())
+        .is_some()
+    {
+        Some("HF_TOKEN")
+    } else if std::env::var("HUGGING_FACE_HUB_TOKEN")
+        .ok()
+        .filter(|t| !t.trim().is_empty())
+        .is_some()
+    {
+        Some("HUGGING_FACE_HUB_TOKEN")
+    } else {
+        None
+    };
+    match hf_token_src {
+        Some(name) => {
+            eprintln!("[lumen-app] HuggingFace token detected via ${name} — gated repos accessible");
+        }
+        None => {
+            eprintln!(
+                "[lumen-app] no HuggingFace token configured (HF_TOKEN / HUGGING_FACE_HUB_TOKEN); anonymous HF access only — gated repos will 401"
+            );
+        }
+    }
+
     tauri::Builder::default()
         .plugin(tauri_plugin_dialog::init())
         .plugin(tauri_plugin_fs::init())

crates/lumen-app/src/models.rs

@@ -445,6 +445,43 @@ pub fn local_path_for(models_dir: &Path, repo_id: &str) -> PathBuf {
     models_dir.join(flat)
 }
 
+/// Build a `reqwest::Client` configured for HuggingFace Hub calls.
+///
+/// Attaches `Authorization: Bearer <token>` automatically when one of the
+/// well-known HF token env vars is set:
+///   - `HF_TOKEN` (preferred; matches `huggingface_hub` Python lib + the
+///     `huggingface-cli login` convention)
+///   - `HUGGING_FACE_HUB_TOKEN` (legacy fallback)
+///
+/// Without a token the client behaves identically to before — anonymous
+/// access works for any non-gated repo.
+///
+/// Single source of truth so `fetch_hub_sha`, `download`, and the
+/// periodic `check_model_updates` path all auth-up consistently. Adding a
+/// new HTTP call site? Use this builder, don't roll your own.
+pub fn hf_client(timeout: Option<std::time::Duration>) -> Result<reqwest::Client> {
+    let token = std::env::var("HF_TOKEN")
+        .ok()
+        .or_else(|| std::env::var("HUGGING_FACE_HUB_TOKEN").ok())
+        .map(|t| t.trim().to_string())
+        .filter(|t| !t.is_empty());
+    let mut builder = reqwest::Client::builder()
+        .user_agent(concat!("lumen-app/", env!("CARGO_PKG_VERSION")));
+    if let Some(d) = timeout {
+        builder = builder.timeout(d);
+    }
+    if let Some(t) = &token {
+        use reqwest::header::{AUTHORIZATION, HeaderMap, HeaderValue};
+        let mut headers = HeaderMap::new();
+        let mut val = HeaderValue::try_from(format!("Bearer {t}"))
+            .context("invalid HF_TOKEN — must be ASCII (no newline / non-printable bytes)")?;
+        val.set_sensitive(true);
+        headers.insert(AUTHORIZATION, val);
+        builder = builder.default_headers(headers);
+    }
+    builder.build().context("init hf http client")
+}
+
 /// Latest commit SHA for the `main` branch of an HF Hub repo. Used to detect
 /// "same repo id, new weights" the way `hsng95/gemma-4-26b-a4b-mlx-imatrix3plus-awq` was
 /// rebuilt in v0.1.3 — the old broken-3bit and the new imatrix mixed-precision
@@ -517,10 +554,7 @@ pub async fn download(
     files: Option<Vec<String>>,
     tx: tokio::sync::mpsc::Sender<DownloadProgress>,
 ) -> Result<PathBuf> {
-    let client = reqwest::Client::builder()
-        .user_agent(concat!("lumen-app/", env!("CARGO_PKG_VERSION")))
-        .build()
-        .context("init http client")?;
+    let client = hf_client(None).context("init hf http client for download")?;
 
     let target = local_path_for(models_dir, repo_id);
     std::fs::create_dir_all(&target)