Update app.py

app.py

@@ -20,6 +20,12 @@ rag_service = RAGService()
 metrics_service = MetricsService(settings.metrics_path)
 _agent_slots = asyncio.Semaphore(settings.max_concurrent_agent_requests)
 
+# Hugging Face displays a Space inside an iframe whose parent is
+# huggingface.co. Only the public status pages may be framed there. Admin and
+# API routes remain protected against framing/clickjacking.
+_HF_PREVIEW_PATHS = {"/", "/health/live", "/health/ready"}
+_HF_FRAME_ANCESTORS = "frame-ancestors 'self' https://huggingface.co https://*.huggingface.co"
+
 
 def get_rag_service() -> RAGService:
     return rag_service
@@ -147,7 +153,16 @@ async def secure_origin(request: Request, call_next):
     response.headers["X-Content-Type-Options"] = "nosniff"
     response.headers["Referrer-Policy"] = "no-referrer"
     response.headers["Permissions-Policy"] = "geolocation=(), microphone=(), camera=(), payment=()"
-    response.headers["X-Frame-Options"] = "SAMEORIGIN" if path.startswith("/admin") else "DENY"
+    if path in _HF_PREVIEW_PATHS:
+        # X-Frame-Options cannot express an allowlist. Omit it only on these
+        # harmless GET endpoints and use CSP's exact parent-origin allowlist.
+        response.headers.pop("X-Frame-Options", None)
+        response.headers["Content-Security-Policy"] = _HF_FRAME_ANCESTORS
+    else:
+        response.headers["X-Frame-Options"] = "SAMEORIGIN" if path.startswith("/admin") else "DENY"
+        response.headers["Content-Security-Policy"] = (
+            "frame-ancestors 'self'" if path.startswith("/admin") else "frame-ancestors 'none'"
+        )
     if protected or path.startswith("/admin"):
         response.headers["Cache-Control"] = "no-store"
     return response