fix: proxy HF Inference API through FastAPI to bypass HF Spaces CSP

frontend/src/App.jsx

@@ -177,16 +177,12 @@ function runOneSimulation(computeROP, demandSeries, envKey) {
   };
 }
 
-// ─── HF INFERENCE API ─────────────────────────────────────────────────────────
+// ─── HF INFERENCE API (proxied through FastAPI to avoid CSP on HF Spaces) ────
 async function callQwen(messages, modelId, hfToken) {
-  const url = `https://api-inference.huggingface.co/models/${modelId}/v1/chat/completions`;
-  const resp = await fetch(url, {
+  const resp = await fetch("/api/qwen", {
     method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      ...(hfToken ? { Authorization: `Bearer ${hfToken}` } : {}),
-    },
-    body: JSON.stringify({ model: modelId, messages, max_tokens: 600, temperature: 0.7 }),
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ model: modelId, messages, max_tokens: 600, temperature: 0.7, hf_token: hfToken || "" }),
   });
   if (!resp.ok) throw new Error(`API error ${resp.status}: ${await resp.text()}`);
   const data = await resp.json();

requirements-server.txt

@@ -4,3 +4,4 @@ pydantic==2.12.5
 numpy==2.4.2
 ciw==3.2.7
 aiofiles==24.1.0
+httpx==0.28.1

server/inventory_env.py

@@ -5,6 +5,7 @@ sys.path.insert(0, os.path.dirname(os.path.dirname(__file__)))
 from dataclasses import dataclass, asdict
 from typing import List, Optional
 import numpy as np
+import httpx
 from fastapi import FastAPI, HTTPException
 from fastapi.staticfiles import StaticFiles
 from fastapi.responses import FileResponse
@@ -260,6 +261,30 @@ def state():
     )
 
 
+# ── HF Inference API proxy (avoids browser CSP restrictions on HF Spaces) ────
+
+class QwenRequest(BaseModel):
+    model: str
+    messages: list
+    max_tokens: int = 600
+    temperature: float = 0.7
+    hf_token: str = ""
+
+@app.post("/api/qwen", include_in_schema=False)
+async def qwen_proxy(req: QwenRequest):
+    token = req.hf_token or os.environ.get("HF_TOKEN", "")
+    headers = {"Content-Type": "application/json"}
+    if token:
+        headers["Authorization"] = f"Bearer {token}"
+    url = f"https://api-inference.huggingface.co/models/{req.model}/v1/chat/completions"
+    payload = {"model": req.model, "messages": req.messages, "max_tokens": req.max_tokens, "temperature": req.temperature}
+    async with httpx.AsyncClient(timeout=60.0) as client:
+        resp = await client.post(url, json=payload, headers=headers)
+    if resp.status_code != 200:
+        raise HTTPException(status_code=resp.status_code, detail=resp.text)
+    return resp.json()
+
+
 # ── Serve React frontend (static files built by Dockerfile) ──────────────────
 _static_dir = os.path.join(os.path.dirname(os.path.dirname(__file__)), "static")
 if os.path.isdir(_static_dir):