8 Commits
Author SHA1 Message Date
DorianandClaude Fable 5 6f7897b124 feat(09-05): build + push botfights:1.2.0 to the vps2 registry
CI / check (push) Failing after 6m15s
- Fixed a pre-existing pnpm overrides config drift (package.json's dead
  pnpm.overrides key vs pnpm-workspace.yaml's overrides, never fully
  migrated after commit bcb323e) that was blocking the docker build's
  `pnpm install --frozen-lockfile` step under a current pnpm version.
  Zero dependency specifier changes in the regenerated lockfile.
- Built and pushed 146.59.87.168:3000/lfg2025/botfights:1.2.0 from
  botfight main @ 2a343ac (arena-proxy + nostr-only auth + unified
  prompt, all three wave-1 plans confirmed present before build).
- Documented the build/push recipe, the gotcha, and the smoke test in
  docs/arena-deployment.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-30 23:01:03 -04:00
DorianandClaude Opus 4.6 47bc753f95 chore: add vitest coverage dep and gitignore test artifacts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 12:53:30 +00:00
DorianandClaude Opus 4.6 eac8539825 fix: update hono 4.7.6→4.12.6, @hono/node-server 1.14.1→1.19.10, override tar/serialize-javascript
Resolves 6 high audit vulnerabilities (Hono auth bypass, serveStatic, JWK confusion,
node-tar symlink traversal, serialize-javascript RCE).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 10:30:56 +00:00
DorianandClaude Opus 4.6 55d0f84251 chore: pin all dependency versions for reproducible builds
Remove ^ prefix from all 33 dependencies across root, server, and
frontend package.json files. Lockfile regenerated and verified with
pnpm install --frozen-lockfile.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 06:21:16 +00:00
DorianandClaude Opus 4.6 e2dc2bbd70 feat: add eslint-plugin-security rules for static analysis
Adds 12 security-focused ESLint rules (unsafe-regex, eval, timing
attacks, child-process, bidi-characters, etc). One legitimate
non-literal RegExp in answers.ts suppressed with inline comment.
CI already runs pnpm lint + pnpm audit for SAST coverage.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 05:26:10 +00:00
DorianandClaude Opus 4.6 a7520be0e7 test: add Playwright E2E infrastructure with smoke test
Set up Playwright with Chromium, dev server auto-start, test helpers
for seeding bots and programmatic auth. Added smoke spec that verifies
homepage and leaderboard load without crashes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 05:14:15 +00:00
DorianandClaude Opus 4.6 7d9b8b1dbf chore: add ESLint with no-floating-promises and no-console rules
Sets up ESLint 10 flat config with @typescript-eslint/no-floating-promises (error)
and no-console (warn, allow warn/error). Fixes all floating promise errors in
server routes, orchestrator reader cleanup, and frontend composables with void operator.
Game engine files get warning-level for intentional fire-and-forget async.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-09 07:47:43 +00:00
DorianandClaude Opus 4.6 335c148866 feat: botfights v1 — full fighting game with Kaplay engine
- Vue 3 + Vite + Tailwind 4 frontend with synthwave aesthetic
- Hono backend on port 9100 with SQLite/Drizzle
- Procedural pixel-art sprite generator (48x48, 8 animation states)
- Kaplay fight scene with punch/kick/special/knockback/KO animations
- 12 mock bots across 6 tiers with Elo rating system
- 9 challenge types, 10 fight arenas with modifiers
- Fight replay with staggered battle log and ~1 min timing
- Sprite preview page at /sprites

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 16:27:54 +00:00