ImageXpert is a static reverse image search hub for fast attribution work. Drop images, paste image URLs, or load short videos; the app dispatches selected engines, computes local hashes, and keeps prior searches in browser storage.

The site remains dependency-free and no-build: index.html loads same-origin CSS and JavaScript modules directly under a restrictive Content Security Policy.

• 12 reverse-search targets: Google Lens, Yandex, Bing, TinEye, SauceNAO, ASCII2D, TraceMoe, PimEyes, and IQDB variants.
• Bounded batch image mode and cancellable short-video keyframe extraction.
• Automatic exact-file deduplication plus configurable local pHash/dHash warnings for probable batch duplicates; similarity remains advisory and never removes a file.
• Local SHA-256, pHash, and dHash display with copy-on-click hash cards.
• Local preprocess tools for rotate, center crop, and bottom-strip trimming.
• Drag-to-select region search with original-hash retention and optional Bing text context.
• Local-only mode is the default. External upload requires explicit consent, uses litterbox.catbox.moe with 1-hour retention, and then exposes a retryable per-engine dispatch queue. Authorization lasts only for the open browser session; the decision names recipient engines and links the host policy.
• Temporary hosted history records carry explicit expiry metadata. Expired or legacy-unknown links cannot be redispatched and instead offer local-file or manual-engine recovery.
• Local history search and composable date/source/engine/outcome/expiry filters, with a versioned metadata export that redacts URLs, thumbnails, filenames, and queries.
• Tampermonkey userscript and Chrome/Edge/Firefox MV3 companion extensions for right-click image handoff.
• Persistent English and Spanish UI selection in Settings, plus an expansion-test locale for layout QA.
• Versioned JSON case export/import with a pre-import review, schema migration, strict data-only validation, expired-host warnings, and resumable remote cases.
• PWA manifest and offline shell for installable use.
• Cache-first versioned PWA updates that keep the active shell intact until a visible Save and reload action; failed installs discard only the incomplete cache, and remote-URL investigations reopen after activation.
• Versioned English/Spanish UI dictionaries with browser fallback and localized companion and userscript metadata.
• Data-only custom engine manifest import/export with HTTPS validation, preview, and one-step rollback.
• Portable settings/custom-engine bundles with conflict review, strict rejection of privilege-bearing fields, a durable pre-import backup, and one-click rollback.
• Local file facts and a no-upload C2PA adapter with explicit unsupported, no-manifest, invalid-signature, and valid-signature states.

ImageXpert never downloads provenance code at runtime. A deployment may provide a same-origin globalThis.ImageXpertC2PAAdapter with contract version 1, @contentauth/c2pa-web version 0.8.3 or newer, worker execution, abort support, and inspect(bytes, { signal }). Older c2pa-web versions are rejected. Local inspection is capped at 25 MB, 40 million pixels, and 5 seconds; signature validity and credential trust are reported as separate fields.

Open ImageXpert or serve the repo locally:

python -m http.server 8765

index.html is the canonical app. ImageXpert.html remains only as a redirect for older bookmarks.

Then visit http://127.0.0.1:8765/.

Run the dependency-free unit, release-contract, desktop browser, and exact 390px/320px mobile smoke suite. Browser checks include an accessibility-tree scan, accessible names/states, representative contrast, focus restoration, keyboard region selection, reduced motion, and 200%/400% reflow:

npm test

Build the unsigned site plus Chrome, Edge, and Firefox companion archives with npm run package. The same package and test sequence runs in GitHub Actions on pushes and pull requests, and publishes the validated unsigned archives as workflow artifacts.

version.json is the release metadata contract for the shared version, PWA theme colors, and required PWA/extension icon sizes. Release checks compare it against manifests, the app shell, CSS, userscript, service-worker cache, README badge, image dimensions, and archive allowlists.

Run npm run check:engines for deterministic registry and URL-construction validation. Add -- --network for a timeout-bounded public endpoint report; reachability failures are reported but do not fail deterministic validation. Each built-in engine exposes capabilities, dispatch method, privacy class, active/degraded/deprecated state, and an ISO lastVerified date.

Chrome and Edge use extension/manifest.json; Firefox uses extension/manifest.firefox.json as its packaged manifest.json. The release command produces separate unsigned archives for sideloading. Right-click a web image and choose Search with ImageXpert.

MediaHunter runs on HTTPS pages and keeps the browser's native context menu. Its Tampermonkey permissions are limited to these features:

• GM_addStyle: isolated MediaHunter interface styles.
• GM_openInTab: user-triggered ImageXpert and search-engine tabs.
• GM_xmlhttpRequest: anonymous, timeout-bounded searches of the six declared source families: Unsplash, Pexels, Pixabay, Mixkit, YouTube, and Wikimedia.
• GM_download: user-triggered downloads from validated HTTP(S) media URLs.
• GM_getValue / GM_setValue: bounded preferences, galleries, and history.
• GM_setClipboard: explicit copy actions and redacted diagnostics.
• GM_registerMenuCommand: panel, bar, visibility, handoff, and diagnostic commands.

The six @connect entries correspond one-for-one to the cross-origin source families above. Search engines and result image hosts open or load through normal browser requests and therefore receive no userscript cross-origin grant.