Use locally-hosted GPT-2 model to fix CORS over Tor/onion origins

.gitignore

@@ -1,3 +1,6 @@
+# GPT-2 model files (271MB, too large for git — uploaded directly to server)
+www/models/
+
 hamburger_morphing/
 client/
 ndk/

www/js/version.json

@@ -1,5 +1,5 @@
 {
-  "VERSION": "v0.7.62",
-  "VERSION_NUMBER": "0.7.62",
-  "BUILD_DATE": "2026-06-29T00:30:26.801Z"
+  "VERSION": "v0.7.64",
+  "VERSION_NUMBER": "0.7.64",
+  "BUILD_DATE": "2026-06-29T00:45:25.458Z"
 }

www/llm-steganography.html

@@ -745,7 +745,7 @@
             <div class="stegoCollapsibleContent stegoHidden">
               <p>
                 The direct inspiration for this project is a
-                <a href="https://primal.net/e/nevent1qqstxmgsd0egtq57gj8mghckthsv79dhegh7xh97hwtwve6l56g4s9sqtjd7k" target="_blank" rel="noopener">post by waxwing on Primal</a>
+                <a href="https://primal.net/e/nevent1qqstxmgsd0egtq57gj8mghckthsv79dhegh7xh97hwtwve6l56g4s9sqtjd7k" target="_blank" rel="noopener">post by waxwing on Nostr</a>
                 that walks through the core idea of using a language model's
                 next-token probability distribution as a steganographic carrier
                 channel. The post explains how secret bits can steer token selection
@@ -1542,8 +1542,12 @@
     } from "https://cdn.jsdelivr.net/npm/@huggingface/transformers@3.0.0";
     import { encode, decode } from "./js/stego.mjs";
 
+    // Use locally-hosted model files (./models/Xenova/gpt2/) so the page
+    // works over Tor/onion origins where HuggingFace CORS is blocked.
     const MODEL_ID = "Xenova/gpt2";
-    env.allowLocalModels = false;
+    env.allowLocalModels = true;
+    env.localModelPath = "./models/";
+    env.allowRemoteModels = false;
 
     // ---------------------------------------------------------------------------
     // DOM references