From b6e945f8dedc8cc48084cbcba856c697fb9039b8 Mon Sep 17 00:00:00 2001
From: Laan Tungir <laantungir@proton.md>
Date: Sun, 28 Jun 2026 20:45:25 -0400
Subject: [PATCH] Use locally-hosted GPT-2 model to fix CORS over Tor/onion
 origins

---
 .gitignore                 | 3 +++
 www/js/version.json        | 6 +++---
 www/llm-steganography.html | 6 +++++-
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index ca7e8eb..07c9f43 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,6 @@
+# GPT-2 model files (271MB, too large for git — uploaded directly to server)
+www/models/
+
 hamburger_morphing/
 client/
 ndk/
diff --git a/www/js/version.json b/www/js/version.json
index 69ebd12..fdb1bd3 100644
--- a/www/js/version.json
+++ b/www/js/version.json
@@ -1,5 +1,5 @@
 {
-  "VERSION": "v0.7.63",
-  "VERSION_NUMBER": "0.7.63",
-  "BUILD_DATE": "2026-06-29T00:32:50.824Z"
+  "VERSION": "v0.7.64",
+  "VERSION_NUMBER": "0.7.64",
+  "BUILD_DATE": "2026-06-29T00:45:25.458Z"
 }
diff --git a/www/llm-steganography.html b/www/llm-steganography.html
index 413bca5..3a1e0da 100644
--- a/www/llm-steganography.html
+++ b/www/llm-steganography.html
@@ -1542,8 +1542,12 @@
     } from "https://cdn.jsdelivr.net/npm/@huggingface/transformers@3.0.0";
     import { encode, decode } from "./js/stego.mjs";
 
+    // Use locally-hosted model files (./models/Xenova/gpt2/) so the page
+    // works over Tor/onion origins where HuggingFace CORS is blocked.
     const MODEL_ID = "Xenova/gpt2";
-    env.allowLocalModels = false;
+    env.allowLocalModels = true;
+    env.localModelPath = "./models/";
+    env.allowRemoteModels = false;
 
     // ---------------------------------------------------------------------------
     // DOM references