Stronger HF-widget hide + (no_ai) clipboard lockdown

app.py

@@ -697,7 +697,9 @@ EMOJI_SWAP_HEAD = """
 
 HIDE_HF_WIDGET_HEAD = """
 <style>
-/* CSS targeting common HF Spaces floating widget classes */
+/* Broad CSS targeting HF Spaces injected chrome. Class names are unstable
+   so we shotgun common patterns, and also nuke any anchor that links back
+   to huggingface.co at the top level. */
 .space-header, .hf-spaces-header, .spaces-banner,
 [class*="space-header"],
 [class*="spaces-header"],
@@ -705,7 +707,13 @@ HIDE_HF_WIDGET_HEAD = """
 [class*="spaces-card"],
 [class*="spaces-banner"],
 [class*="hf-spaces"],
-[data-testid*="space-header"] {
+[class*="HfSpace"],
+[class*="SpaceHeader"],
+[class*="SpaceTag"],
+[id*="space-header"],
+[id*="hf-spaces"],
+[data-testid*="space-header"],
+[data-testid*="space-info"] {
     display: none !important;
     visibility: hidden !important;
     pointer-events: none !important;
@@ -713,58 +721,123 @@ HIDE_HF_WIDGET_HEAD = """
     width: 0 !important;
     overflow: hidden !important;
 }
+/* Body-direct anchors to HF (the floating "powered by" badge usually links there) */
+body > a[href*="huggingface.co"],
+body > a[href*="hf.co"] {
+    display: none !important;
+}
 </style>
 <script>
 (function() {
-    // HF Spaces floating widget signature: top-level element near top-right
-    // that mentions the Space repo path or an HF Spaces-style breadcrumb.
-    // We sweep on load and on every DOM mutation.
+    // HF injects a floating widget on .hf.space direct URLs. Class names
+    // change, so we use 3 detection strategies:
+    //   (1) text signatures (repo path, "Built with", "Hugging Face"),
+    //   (2) link signature (contains a link to huggingface.co / hf.co),
+    //   (3) position heuristic (small fixed/absolute element in a corner,
+    //       not inside our gradio container, not our own toast).
     const SIGNATURES = [
         'AE-Talk-bot/',
-        'huggingface.co/spaces/',
+        'huggingface.co/',
+        'hf.co/',
+        'Hugging Face',
         'Built with',
     ];
+    const SAFE_IDS = new Set([
+        'root', 'gradio-app',
+        '__arg_lockdown_toast__'
+    ]);
+    function isSafe(el) {
+        if (!el) return true;
+        if (SAFE_IDS.has(el.id)) return true;
+        if (el.classList && el.classList.contains('gradio-container')) return true;
+        if (el.tagName === 'SCRIPT' || el.tagName === 'STYLE' ||
+            el.tagName === 'LINK' || el.tagName === 'META' ||
+            el.tagName === 'NOSCRIPT' || el.tagName === 'IFRAME') return true;
+        // If the element CONTAINS our gradio root, it must not be hidden
+        if (el.querySelector && el.querySelector('.gradio-container, #root, #gradio-app, gradio-app')) return true;
+        return false;
+    }
     function looksLikeHfWidget(el) {
         if (!el || el.nodeType !== 1) return false;
-        // Don't touch our own gradio app
-        if (el.id === 'root' || el.id === 'gradio-app' ||
-            el.classList && el.classList.contains('gradio-container')) return false;
-        if (el.querySelector && el.querySelector('.gradio-container, #root, #gradio-app')) return false;
+        if (isSafe(el)) return false;
         const txt = (el.textContent || '').trim();
-        if (txt.length > 400) return false;  // too big, not a small badge
-        // Must match at least one signature
-        for (const sig of SIGNATURES) {
-            if (txt.includes(sig)) return true;
+        // Strategy 1: text signatures (small badge text only)
+        if (txt.length > 0 && txt.length < 400) {
+            for (const sig of SIGNATURES) {
+                if (txt.includes(sig)) return true;
+            }
+        }
+        // Strategy 2: contains a link to HF
+        if (el.querySelector && el.querySelector('a[href*="huggingface.co"], a[href*="hf.co"]')) {
+            return true;
         }
-        // Also flag obviously-HF class names
+        // Strategy 3: HF-shaped class / id names
         const cls = (el.className && el.className.toString) ? el.className.toString() : '';
-        if (/space[s-]?(header|tag|banner|card)/i.test(cls)) return true;
+        if (/(^|[^a-z])(hf|huggingface)[-_]/i.test(cls)) return true;
+        if (/space[s-]?(header|tag|banner|card|info|badge|widget|overlay)/i.test(cls)) return true;
+        const idAttr = el.id || '';
+        if (/(^|[^a-z])(hf|huggingface)[-_]/i.test(idAttr)) return true;
+        // Strategy 4: position heuristic for small floating badges
+        try {
+            const style = window.getComputedStyle(el);
+            if ((style.position === 'fixed' || style.position === 'absolute') &&
+                txt.length > 0 && txt.length < 200) {
+                const rect = el.getBoundingClientRect();
+                if (rect.width > 0 && rect.width < 400 &&
+                    rect.height > 0 && rect.height < 120) {
+                    const inCorner =
+                        (rect.top < 120 || rect.bottom > window.innerHeight - 120) &&
+                        (rect.left < 120 || rect.right > window.innerWidth - 120);
+                    if (inCorner) return true;
+                }
+            }
+        } catch (e) { /* ignore */ }
         return false;
     }
+    function nuke(el) {
+        try {
+            el.style.setProperty('display', 'none', 'important');
+            el.style.setProperty('visibility', 'hidden', 'important');
+            el.setAttribute('hidden', '');
+            console.log('[hf-widget-hide] removed', el.tagName, el.id || '', el.className || '');
+        } catch (e) { /* ignore */ }
+    }
     function sweep() {
-        // Only check direct body children to keep this cheap
+        if (!document.body) return;
+        // Direct body children first
         Array.from(document.body.children).forEach(el => {
-            if (looksLikeHfWidget(el)) {
-                el.style.display = 'none';
-                el.setAttribute('hidden', '');
-                console.log('[hf-widget-hide] removed', el.tagName, el.className || '(no class)');
-            }
+            if (looksLikeHfWidget(el)) nuke(el);
+        });
+        // Also check direct html children (some injection patterns put nodes there)
+        Array.from(document.documentElement.children).forEach(el => {
+            if (el.tagName === 'BODY' || el.tagName === 'HEAD') return;
+            if (looksLikeHfWidget(el)) nuke(el);
         });
+        // Sweep any body-level <a> pointing to HF
+        document.querySelectorAll('body > a[href*="huggingface.co"], body > a[href*="hf.co"]').forEach(nuke);
     }
     if (document.readyState === 'loading') {
         document.addEventListener('DOMContentLoaded', sweep);
     } else {
         sweep();
     }
-    // Re-sweep on every mutation in case HF injects later
-    const obs = new MutationObserver(sweep);
+    function attachObserver() {
+        if (!document.body) return;
+        const obs = new MutationObserver(sweep);
+        obs.observe(document.body, { childList: true, subtree: false });
+        obs.observe(document.documentElement, { childList: true, subtree: false });
+    }
     if (document.body) {
-        obs.observe(document.body, { childList: true });
+        attachObserver();
     } else {
-        document.addEventListener('DOMContentLoaded', () => {
-            obs.observe(document.body, { childList: true });
-        });
+        document.addEventListener('DOMContentLoaded', attachObserver);
     }
+    // Fallback: re-sweep every 1.5s for the first 30s, in case HF injects late
+    let ticks = 0;
+    const iv = setInterval(() => {
+        sweep();
+        if (++ticks >= 20) clearInterval(iv);
+    }, 1500);
 })();
 </script>
 """