"Connect NWC" was 500ing — server/src/engine/crypto.ts's getKey() throws
immediately under NODE_ENV=production when this var is unset. Generated a
random 32-byte key directly on the VPS2 host into /opt/botfights-arena/.env
(0600, never committed — same pattern as JWT_SECRET), wired the reference
into the deployed docker-compose.yml, and restarted. Only enables storing
per-user NWC connection strings encrypted at rest — does not enable any
actual money movement (BOTFIGHTS_NWC_URL, the arena's own wallet, is still
unset and deliberately not touched here).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1. server/src/app.ts: CSP img-src only allowed 'self'/data:/blob: — nostr
profile pictures come from kind:0 metadata, a URL the user sets via their
own client, hosted on whatever domain they picked. There's no central
image host for a decentralized identity system, so every external
profile pic was CSP-blocked and rendered as a broken image. Added
https: (broad) — safe here since images can't execute script even from
an untrusted origin, unlike script-src which stays locked to 'self'.
2. frontend/src/pages/JoinBoutPage.vue: the new AI-answer option (1.2.7)
was reported as invisible — it was gated behind picking POLLING (not the
default WEBHOOK) AND behind a collapsed toggle within that. Changed:
POLLING is now the default mode (also the documented default in
BOTFIGHTS.md), the AI section is expanded by default instead of
collapsed, and the POLLING button's own description now mentions the
option so it's visible without any extra click.
3. docker-compose.arena.yml: image tag 1.2.1 -> 1.2.7, matching what's
actually deployed on the canonical arena (rolled live via
ssh+docker compose pull/up this session — this commit just brings the
repo's copy of the compose file back in sync with reality).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The first cloud AI agent given the prompt refused it as a suspected prompt
injection: 'nothing else needs to be read' framing, raw-IP fallback, and
being told to wire its own ANTHROPIC_API_KEY into a persistent script. All
three patterns removed; brains are now an operator-supplied optional
OpenAI-compatible endpoint with local heuristics as default. queue/join
documented as blocking ~35s (60s client timeout) matching the real 30s
production QUEUE_TIMEOUT_MS.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- docker-compose.arena.yml: image tag 1.1.0 -> 1.2.0, refreshed the
TRUSTED_PROXY comment to reflect the live NPM+TLS front-end (no
longer "no DNS/TLS this phase" — that shipped mid-phase).
- Deployed on VPS2: docker compose pull + up -d, container recreated,
healthy, data volume untouched.
- Verified end-to-end through the public HTTPS URL: health, unified
prompt (ARENA_URL substituted, zero leftover template tokens), a
freshly registered test bot visible in GET /api/bots, bot auth via
the now-fixed GET /api/fights/poll, and data integrity (100 + 15
classic bots, unchanged from before the roll).
- docs/arena-deployment.md: recorded the second (post-poll-fix) image
digest and the fix.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds docker-compose.arena.yml (registry image only, no build, no payment
env, no TRUSTED_PROXY since no reverse proxy fronts it) and
docs/arena-deployment.md (full runbook: host paths, port, secret handling,
seed decision, NPM/TLS upgrade path, teardown) for the one canonical public
arena at http://146.59.87.168:9100 (user decision 2026-07-30: no DNS/TLS
this phase, plain HTTP on the raw port; TLS is a later env-only upgrade).
Deployed + verified on VPS2: healthy on-host and off-host, seeded with a
full read-only copy of archi-dev-box's botfights.db (115 bots/102,440
fights; source untouched, mtime verified unchanged).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
