fix: propagate private-space __sign JWT to all same-origin requests

duck.js

@@ -19,6 +19,11 @@ export const MESH_VERSION = "8";
 // targets them.
 export const MODEL_DIR = "./robot/mjlab";
 
+// On a private HF Space, rl.js installs a URL signer that appends the
+// ?__sign JWT to same-origin requests (auth cookies may be blocked in the
+// hub iframe). Identity everywhere else.
+const signed = (url) => (window.__hfSigned ? window.__hfSigned(url) : url);
+
 // Meshes fully occluded inside the shells at every demo camera angle,
 // verified empirically by per-mesh pixel-diff (front 3/4, back, low
 // front close-up): hiding each changes exactly 0 pixels. Skipped at
@@ -29,7 +34,7 @@ const HIDDEN_MESHES = new Set([]);
 export async function loadKinematics(url) {
   // Same cache-buster as the STLs: force-cache would otherwise keep
   // serving a stale kinematics.json after the mesh list changes.
-  const r = await fetch(`${url}?v=${MESH_VERSION}`, { cache: "force-cache" });
+  const r = await fetch(signed(`${url}?v=${MESH_VERSION}`), { cache: "force-cache" });
   if (!r.ok) throw new Error(`kinematics fetch ${r.status}`);
   const k = await r.json();
   // Full-resolution meshes by default (the reduction will be redone
@@ -75,7 +80,7 @@ export async function buildRig(k, opts = {}) {
     if (!meshCache.has(name)) {
       meshCache.set(
         name,
-        loader.loadAsync(`${k.mesh_dir}/${name}?v=${MESH_VERSION}`).then((raw) => {
+        loader.loadAsync(signed(`${k.mesh_dir}/${name}?v=${MESH_VERSION}`)).then((raw) => {
           raw.deleteAttribute("normal");
           const welded = mergeVertices(raw, 1e-4);
           welded.scale(1000, 1000, 1000);

index.html

@@ -178,6 +178,13 @@
         }
       }
     </script>
-    <script type="module" src="./rl.js"></script>
+    <!-- rl.js is imported dynamically with the private-space ?__sign JWT
+         appended: a plain src attribute can 401 when the browser blocks the
+         *.static.hf.space auth cookie inside the hub iframe. -->
+    <script type="module">
+      const sign = new URLSearchParams(location.search).get("__sign");
+      const suffix = sign ? `?__sign=${encodeURIComponent(sign)}` : "";
+      import(`./rl.js${suffix}`);
+    </script>
   </body>
 </html>

rl.js

@@ -17,11 +17,26 @@
 import * as THREE from "three";
 import { OrbitControls } from "three/addons/controls/OrbitControls.js";
 import { RoomEnvironment } from "three/addons/environments/RoomEnvironment.js";
-import { buildRig, loadKinematics, setJoint, setJawOpen, MODEL_DIR, MESH_VERSION } from "./duck.js";
-import { VARIANTS, VARIANT_NAMES, materialHookFor, randomVariantName, applyVariant, specToHex } from "./variants.js";
 import loadMujoco from "https://cdn.jsdelivr.net/npm/@mujoco/mujoco@3.11.0/mujoco.js";
 import * as ort from "https://cdn.jsdelivr.net/npm/onnxruntime-web@1.27.0/dist/ort.min.mjs";
 
+// Private HF Space auth: the hub iframe URL carries a ?__sign JWT, but
+// subresource requests normally rely on a *.static.hf.space cookie that
+// browsers often block inside the iframe (third-party cookie blocking),
+// which 401s every same-origin fetch. Appending the JWT to each request
+// authenticates them regardless of cookie policy. No-op locally.
+const HF_SIGN = new URLSearchParams(location.search).get("__sign");
+const signed = (url) =>
+  HF_SIGN ? `${url}${url.includes("?") ? "&" : "?"}__sign=${encodeURIComponent(HF_SIGN)}` : url;
+window.__hfSigned = signed; // duck.js uses it for kinematics + STL requests
+
+// Local modules are imported dynamically through signed() for the same
+// reason: a static import of ./duck.js would 401 without the cookie.
+const { buildRig, loadKinematics, setJoint, setJawOpen, MODEL_DIR, MESH_VERSION } =
+  await import(signed("./duck.js"));
+const { VARIANTS, VARIANT_NAMES, materialHookFor, randomVariantName, applyVariant, specToHex } =
+  await import(signed("./variants.js"));
+
 ort.env.wasm.wasmPaths = "https://cdn.jsdelivr.net/npm/onnxruntime-web@1.27.0/dist/";
 ort.env.wasm.numThreads = 1; // static hosting sends no COOP/COEP headers
 
@@ -94,7 +109,7 @@ const traced = (label, p) => {
 // Stripping them means the MuJoCo VFS only needs the ~10 meshes referenced
 // by collision geoms.
 async function buildPhysicsXml() {
-  const src = await (await fetch(`${MODEL_DIR}/robot_allcollisions.xml`)).text();
+  const src = await (await fetch(signed(`${MODEL_DIR}/robot_allcollisions.xml`))).text();
   const doc = new DOMParser().parseFromString(src, "text/xml");
   for (const g of [...doc.querySelectorAll('geom[class="visual"]')]) g.remove();
   const usedMeshes = new Set(
@@ -138,7 +153,7 @@ await Promise.all(
   meshFiles.map(async (f) => {
     // Same cache-busted URL as duck.js so the browser reuses the render
     // meshes instead of downloading the collision subset a second time.
-    const buf = await (await fetch(`${MODEL_DIR}/meshes/${f}?v=${MESH_VERSION}`, { cache: "force-cache" })).arrayBuffer();
+    const buf = await (await fetch(signed(`${MODEL_DIR}/meshes/${f}?v=${MESH_VERSION}`), { cache: "force-cache" })).arrayBuffer();
     // meshdir="assets" in the MJCF, so the compiler looks up "assets/<f>".
     vfs.addBuffer(`assets/${f}`, new Uint8Array(buf));
   }),
@@ -151,9 +166,9 @@ const rigPromise = (async () => {
 })();
 const sessionOpts = { executionProviders: ["wasm"] };
 [sessions.walk, sessions.sitstand, sessions.roulade] = await Promise.all([
-  ort.InferenceSession.create(POLICIES.walk, sessionOpts),
-  ort.InferenceSession.create(POLICIES.sitstand, sessionOpts),
-  ort.InferenceSession.create(POLICIES.roulade, sessionOpts),
+  ort.InferenceSession.create(signed(POLICIES.walk), sessionOpts),
+  ort.InferenceSession.create(signed(POLICIES.sitstand), sessionOpts),
+  ort.InferenceSession.create(signed(POLICIES.roulade), sessionOpts),
 ]);
 
 setLoading("Compiling physics\u2026");