semikap/index.html at main · ArioMoniri/semikap · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
<!doctype html>
<html lang="en">
  <head>
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
    <meta name="theme-color" content="#0b1d3a" />
    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />

    <!--
      Strict Content Security Policy enforcing the no-egress promise.
      - default-src 'self'    : nothing loads from third-party origins
      - connect-src 'self' blob: data: : XHR/fetch only against the app origin
        and to in-memory blobs (model files chosen from local disk are read
        via FileReader / object URLs, not network)
      - script-src 'self' 'wasm-unsafe-eval' : permits the WebAssembly compile
        used by ONNX Runtime Web; otherwise locked down
      - worker-src 'self' blob: : Vite ships workers as blob URLs in dev
      - img-src 'self' data: blob: : viewer renders to canvas/blob URLs
    -->
    <!--
      connect-src adds raw.githubusercontent.com so the in-app "Download
      example kit" button can fetch the smoke-test files from this repo.
      Image data still cannot be uploaded — fetch() is one-way (download).
    -->
    <!--
      `frame-ancestors` is intentionally NOT in the meta CSP — browsers ignore
      it there and emit a console warning. Send `X-Frame-Options: DENY` (or
      `frame-ancestors` in a real HTTP CSP) at the server level instead.
      HuggingFace domains are added so the browser PWA can pull the SAM
      checkpoints (Tauri shell already gets them via app.security.csp).
    -->
    <!--
      v0.7.9 — two CSP additions:
      1. `https://*.xethub.hf.co` (and the canonical
         `cas-bridge.xethub.hf.co`). HuggingFace migrated their LFS
         storage backend to "Xet" in early 2026 — every
         `huggingface.co/<repo>/resolve/main/<big-file>` now issues a
         302 redirect to `https://cas-bridge.xethub.hf.co/...`. Without
         this entry SAM/MedSAM/SAM-2.1 downloads die with "Refused to
         connect to https://cas-bridge.xethub.hf.co/...".
      2. `ipc:`, `ipc://localhost`, `http://ipc.localhost`,
         `https://tauri.localhost`, `http://tauri.localhost`, `tauri:`.
         The bundled Tauri build uses tauri.conf.json's CSP which
         already had these; the dev build serves through Vite which
         uses *this* meta CSP, so the fix has to land here too —
         otherwise `npm run tauri dev` floods with "Refused to connect
         to ipc://localhost/plugin%3Aupdater%7Ccheck" on every launch.
    -->
    <meta
      http-equiv="Content-Security-Policy"
      content="default-src 'self' ipc: http://ipc.localhost https://tauri.localhost http://tauri.localhost tauri:; connect-src 'self' blob: data: ipc: ipc://localhost http://ipc.localhost https://tauri.localhost http://tauri.localhost tauri: https://raw.githubusercontent.com https://huggingface.co https://*.huggingface.co https://cdn-lfs.huggingface.co https://cdn-lfs-us-1.huggingface.co https://*.xethub.hf.co https://cas-bridge.xethub.hf.co https://cdn.jsdelivr.net https://files.pythonhosted.org https://pypi.org https://proxy.imaging.datacommons.cancer.gov; script-src 'self' 'wasm-unsafe-eval' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; worker-src 'self' blob:; img-src 'self' data: blob:; font-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'none'"
    />

    <title>TAMIAS — Local Medical Image Analysis</title>
  </head>
  <body class="bg-slate-50 text-slate-900 antialiased">
    <a
      href="#viewer"
      class="sr-only focus:not-sr-only focus:absolute focus:left-2 focus:top-2 focus:z-50 focus:rounded focus:bg-white focus:px-3 focus:py-2 focus:text-sm focus:shadow"
    >Skip to viewer</a>
    <div id="root"></div>
    <!-- coi-serviceworker promotes the page to cross-origin isolation on hosts
         (e.g. GitHub Pages) that don't set COOP/COEP. coi-config.js gates
         registration to http:/https: only — under the Tauri custom protocol
         (`tauri://`) navigator.serviceWorker.register() throws
         "scriptURL must be HTTP or HTTPS"; the desktop bundle gets
         COOP/COEP from app.security.headers in tauri.conf.json instead.
         Both files are external (script-src 'self') because our strict
         CSP doesn't allow inline scripts (`'unsafe-inline'`). -->
    <script src="/coi-config.js"></script>
    <script src="/coi-serviceworker.min.js"></script>
    <script type="module" src="/src/main.tsx"></script>
  </body>
</html>