Segmentation Annotation Studio — annotation tooling, AI-assisted selection, exports, hardening & docs

.dockerignore

@@ -0,0 +1,41 @@
+# Build artifacts & deps (rebuilt inside the image)
+**/node_modules
+**/dist
+**/.vite
+frontend/dist
+backend/static
+
+# Python envs / caches
+.venv
+.conda-py312
+**/__pycache__
+**/*.pyc
+.pytest_cache
+htmlcov
+.coverage
+
+# Tiled server config, data & catalog (external in production — never bundled)
+.tiled
+tiled/
+
+# Local data, backups, runtime files
+data
+.drafts
+.reset-backups
+*.pid
+.run
+
+# VCS / editor / OS
+.git
+.gitignore
+.idea
+.vscode
+.DS_Store
+
+# Plans / docs not needed in the image
+*.md
+
+# peter's version of the repo
+peter/
+
+.reset-backups/

.gitignore

@@ -14,11 +14,15 @@ build/
 .env
 
 # Tiled catalog database (binary, regenerated on first run via start_all.sh)
-# The zarr data under .tiled/data/ IS committed so clones get demo data.
 .tiled/catalog.db
 .tiled/catalog.db-shm
 .tiled/catalog.db-wal
 
+# Tiled data written at runtime (drag-and-drop ingest, etc.).
+# Demo datasets already committed under .tiled/data/ stay tracked; new arrays
+# ingested locally are ignored. To commit a new demo dataset, use `git add -f`.
+.tiled/data/
+
 # Runtime Tiled thumbnail containers created on save
 **/*__v_thumbs/
 
@@ -27,6 +31,9 @@ node_modules/
 dist/
 .vite/
 
+# Production SPA build served by FastAPI (generated by `PROD=1 ./start_all.sh`)
+backend/static/
+
 # OS
 .DS_Store
 Thumbs.db
@@ -45,3 +52,14 @@ Thumbs.db
 htmlcov/
 .coverage
 coverage.xml
+
+# Vendored SAM model (large, fetched via frontend/scripts/fetch-sam-model.mjs)
+frontend/public/models/
+
+# MkDocs build output (regenerate with `mkdocs build`)
+site/
+
+# peter's version of the repo
+peter/
+
+.reset-backups/

.tiled/README.md

@@ -6,9 +6,21 @@ SQLite catalog and sample array data (~1 MB).
 - **`catalog.db`** — Tiled catalog metadata (paths, structure, metadata keys).
 - **`data/`** — Writable storage (Zarr chunks) for `browse/generated_data/*` sample datasets.
 
-After clone, run `./start_all.sh` from the repo root. The script still creates
-`backend/.env` from `.env.example` and may generate a `TILED_API_KEY` if missing;
-that key is only for authenticating to the local server, not stored inside these files.
+After clone, run `./start_all.sh` from the repo root. The script creates
+`backend/.env` from `.env.example` and **generates a strong `TILED_API_KEY`** into it
+when the key is missing (or still the old committed value, which it auto-rotates).
+`tiled/config.yml` holds no literal key — the script passes the generated key to
+Tiled at launch via `--api-key` (robust across Tiled versions). The key lives only
+in the gitignored `backend/.env`, never inside these catalog files and never sent
+to the frontend.
 
 To replace this with an empty catalog, delete `.tiled/` and run `tiled catalog init`
 (see `start_all.sh`). To add more datasets, use `backend/scripts/seed_generated_data_to_tiled.py`.
+
+## Security note
+Earlier commits of `tiled/config.yml` contained a hardcoded `single_user_api_key`
+(`3b1d23cd…`). It has been removed from the working tree and is auto-rotated on the
+next `./start_all.sh`, but it **remains in git history**. It only guards a
+local-only (127.0.0.1) server with anonymous read enabled, so exposure is low. To
+purge it from history, use `git filter-repo` (or BFG) to replace the blob, then
+force-push — destructive; coordinate with anyone who has cloned the repo.

AGENTS.md

@@ -1,4 +1,4 @@
-# AGENTS.md — SAM3 Annotation Studio
+# AGENTS.md — Segmentation Annotation Studio
 
 ## Stack
 - Backend: FastAPI, Python ≥ 3.11, pyproject.toml, pytest

COPYRIGHT.txt

@@ -0,0 +1,14 @@
+MLExchange Copyright (c) 2023, The Regents of the University of California,
+through Lawrence Berkeley National Laboratory (subject to receipt of
+any required approvals from the U.S. Dept. of Energy). All rights reserved.
+
+If you have questions about your rights to use or distribute this software,
+please contact Berkeley Lab's Intellectual Property Office at
+IPO@lbl.gov.
+
+NOTICE.  This Software was developed under funding from the U.S. Department
+of Energy and the U.S. Government consequently retains certain rights.  As
+such, the U.S. Government has been granted for itself and others acting on
+its behalf a paid-up, nonexclusive, irrevocable, worldwide license in the
+Software to reproduce, distribute copies to the public, prepare derivative
+works, and perform publicly and display publicly, and to permit others to do so.

Dockerfile

@@ -0,0 +1,36 @@
+# syntax=docker/dockerfile:1
+# Lightweight production image: builds the SPA and serves it from the FastAPI
+# backend (single container, one port). Tiled is NOT included — point the app at
+# an external Tiled via TILED_URI/TILED_API_KEY. Local dev still uses start_all.sh.
+
+# --- Stage 1: build the frontend (same-origin: VITE_API_BASE left empty) ---
+FROM node:22-alpine AS web
+WORKDIR /web
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci
+COPY frontend/ ./
+RUN npm run build   # → /web/dist
+
+# --- Stage 2: backend + built SPA ---
+FROM python:3.12-slim AS app
+WORKDIR /app
+
+# Install Python deps first (cached until pyproject changes). py-modules=[] means
+# this installs dependencies only; the app code runs from the copied source below.
+# pyproject pins tiled[client] (not [all]/[server]), so the Tiled server is NOT
+# installed into this image — the app only connects to an external Tiled.
+# If a wheel is unavailable for pycocotools/imagecodecs on this platform, add:
+#   RUN apt-get update && apt-get install -y --no-install-recommends build-essential
+COPY backend/pyproject.toml ./pyproject.toml
+RUN pip install --no-cache-dir .
+
+# App source + the built SPA (served from ./static by annotation_server.py).
+COPY backend/ ./
+COPY --from=web /web/dist ./static
+
+# Drafts/versions/exports persist here — mount a volume in production.
+ENV LOCAL_DATA_ROOT=/data
+VOLUME ["/data"]
+
+EXPOSE 8002
+CMD ["uvicorn", "annotation_server:app", "--host", "0.0.0.0", "--port", "8002"]