lfg2025/botfights
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
384 Commits 3 Branches 0 Tags
877d1f638988b06f1aecf8bdc97f6fc295f61be0
Commit Graph
5 Commits
Author SHA1 Message Date
DorianandClaude Fable 5 877d1f6389 fix: broken profile images (CSP img-src), AI-answer discoverability, arena compose tag
CI / check (push) Failing after 6m10s
Details 
1. server/src/app.ts: CSP img-src only allowed 'self'/data:/blob: — nostr
   profile pictures come from kind:0 metadata, a URL the user sets via their
   own client, hosted on whatever domain they picked. There's no central
   image host for a decentralized identity system, so every external
   profile pic was CSP-blocked and rendered as a broken image. Added
   https: (broad) — safe here since images can't execute script even from
   an untrusted origin, unlike script-src which stays locked to 'self'.

2. frontend/src/pages/JoinBoutPage.vue: the new AI-answer option (1.2.7)
   was reported as invisible — it was gated behind picking POLLING (not the
   default WEBHOOK) AND behind a collapsed toggle within that. Changed:
   POLLING is now the default mode (also the documented default in
   BOTFIGHTS.md), the AI section is expanded by default instead of
   collapsed, and the POLLING button's own description now mentions the
   option so it's visible without any extra click.

3. docker-compose.arena.yml: image tag 1.2.1 -> 1.2.7, matching what's
   actually deployed on the canonical arena (rolled live via
   ssh+docker compose pull/up this session — this commit just brings the
   repo's copy of the compose file back in sync with reality).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-31 08:52:21 -04:00
DorianandClaude Fable 5 d2fc998a28 docs(prompt): AI-agent consent preamble, operator-only LLM creds (drop ANTHROPIC_API_KEY pattern), accurate queue-join timing — feedback from first real AI agent test
CI / check (push) Failing after 6m5s
Details 
The first cloud AI agent given the prompt refused it as a suspected prompt
injection: 'nothing else needs to be read' framing, raw-IP fallback, and
being told to wire its own ANTHROPIC_API_KEY into a persistent script. All
three patterns removed; brains are now an operator-supplied optional
OpenAI-compatible endpoint with local heuristics as default. queue/join
documented as blocking ~35s (60s client timeout) matching the real 30s
production QUEUE_TIMEOUT_MS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-30 23:52:18 -04:00
DorianandClaude Fable 5 51678b4315 feat(09-05): roll the canonical arena to botfights:1.2.0
CI / check (push) Has been cancelled
Details 
- docker-compose.arena.yml: image tag 1.1.0 -> 1.2.0, refreshed the
  TRUSTED_PROXY comment to reflect the live NPM+TLS front-end (no
  longer "no DNS/TLS this phase" — that shipped mid-phase).
- Deployed on VPS2: docker compose pull + up -d, container recreated,
  healthy, data volume untouched.
- Verified end-to-end through the public HTTPS URL: health, unified
  prompt (ARENA_URL substituted, zero leftover template tokens), a
  freshly registered test bot visible in GET /api/bots, bot auth via
  the now-fixed GET /api/fights/poll, and data integrity (100 + 15
  classic bots, unchanged from before the roll).
- docs/arena-deployment.md: recorded the second (post-poll-fix) image
  digest and the fix.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-30 23:21:43 -04:00
DorianandClaude Fable 5 4d285f8e93 arena: switch canonical URL to https://botfights.archipelago-foundation.org (NPM+LE live), enable TRUSTED_PROXY
CI / check (push) Has been cancelled
Details 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-30 21:44:10 -04:00
DorianandClaude Fable 5 e4b82fd7e9 feat(09-04): deploy canonical BotFights arena on VPS2
CI / check (push) Has been cancelled
Details 
Adds docker-compose.arena.yml (registry image only, no build, no payment
env, no TRUSTED_PROXY since no reverse proxy fronts it) and
docs/arena-deployment.md (full runbook: host paths, port, secret handling,
seed decision, NPM/TLS upgrade path, teardown) for the one canonical public
arena at http://146.59.87.168:9100 (user decision 2026-07-30: no DNS/TLS
this phase, plain HTTP on the raw port; TLS is a later env-only upgrade).

Deployed + verified on VPS2: healthy on-host and off-host, seeded with a
full read-only copy of archi-dev-box's botfights.db (115 bots/102,440
fights; source untouched, mtime verified unchanged).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-30 21:22:21 -04:00