Use locally-hosted GPT-2 model to fix CORS over Tor/onion origins

.gitignore

@@ -1,3 +1,6 @@
+# GPT-2 model files (271MB, too large for git — uploaded directly to server)
+www/models/
+
 hamburger_morphing/
 client/
 ndk/

www/js/version.json

@@ -1,5 +1,5 @@
 {
-  "VERSION": "v0.7.63",
-  "VERSION_NUMBER": "0.7.63",
-  "BUILD_DATE": "2026-06-29T00:32:50.824Z"
+  "VERSION": "v0.7.64",
+  "VERSION_NUMBER": "0.7.64",
+  "BUILD_DATE": "2026-06-29T00:45:25.458Z"
 }

www/llm-steganography.html

@@ -1542,8 +1542,12 @@
     } from "https://cdn.jsdelivr.net/npm/@huggingface/transformers@3.0.0";
     import { encode, decode } from "./js/stego.mjs";
 
+    // Use locally-hosted model files (./models/Xenova/gpt2/) so the page
+    // works over Tor/onion origins where HuggingFace CORS is blocked.
     const MODEL_ID = "Xenova/gpt2";
-    env.allowLocalModels = false;
+    env.allowLocalModels = true;
+    env.localModelPath = "./models/";
+    env.allowRemoteModels = false;
 
     // ---------------------------------------------------------------------------
     // DOM references