Commit Graph
18 Commits
Author SHA1 Message Date
DorianandClaude Fable 5 6f7897b124 feat(09-05): build + push botfights:1.2.0 to the vps2 registry
CI / check (push) Failing after 6m15s
- Fixed a pre-existing pnpm overrides config drift (package.json's dead
  pnpm.overrides key vs pnpm-workspace.yaml's overrides, never fully
  migrated after commit bcb323e) that was blocking the docker build's
  `pnpm install --frozen-lockfile` step under a current pnpm version.
  Zero dependency specifier changes in the regenerated lockfile.
- Built and pushed 146.59.87.168:3000/lfg2025/botfights:1.2.0 from
  botfight main @ 2a343ac (arena-proxy + nostr-only auth + unified
  prompt, all three wave-1 plans confirmed present before build).
- Documented the build/push recipe, the gotcha, and the smoke test in
  docs/arena-deployment.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-30 23:01:03 -04:00
DorianandClaude Opus 4.6 47bc753f95 chore: add vitest coverage dep and gitignore test artifacts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 12:53:30 +00:00
DorianandClaude Opus 4.6 eac8539825 fix: update hono 4.7.6→4.12.6, @hono/node-server 1.14.1→1.19.10, override tar/serialize-javascript
Resolves 6 high audit vulnerabilities (Hono auth bypass, serveStatic, JWK confusion,
node-tar symlink traversal, serialize-javascript RCE).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 10:30:56 +00:00
DorianandClaude Opus 4.6 55d0f84251 chore: pin all dependency versions for reproducible builds
Remove ^ prefix from all 33 dependencies across root, server, and
frontend package.json files. Lockfile regenerated and verified with
pnpm install --frozen-lockfile.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 06:21:16 +00:00
DorianandClaude Opus 4.6 e2dc2bbd70 feat: add eslint-plugin-security rules for static analysis
Adds 12 security-focused ESLint rules (unsafe-regex, eval, timing
attacks, child-process, bidi-characters, etc). One legitimate
non-literal RegExp in answers.ts suppressed with inline comment.
CI already runs pnpm lint + pnpm audit for SAST coverage.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 05:26:10 +00:00
DorianandClaude Opus 4.6 a7520be0e7 test: add Playwright E2E infrastructure with smoke test
Set up Playwright with Chromium, dev server auto-start, test helpers
for seeding bots and programmatic auth. Added smoke spec that verifies
homepage and leaderboard load without crashes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 05:14:15 +00:00
DorianandClaude Opus 4.6 806163c6c5 test: add frontend composable tests — useNostr (9), useFightCache (5), useOnlineStatus (4)
Tests cover login state, logout, signer detection, key persistence, IndexedDB
caching/eviction, online/offline detection, and singleton pattern.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 00:07:50 +00:00
DorianandClaude Opus 4.6 d9e32123fe test: add test infrastructure for frontend and server
- Frontend: vitest.config.ts with vue plugin + jsdom, dummy component test
- Server: in-memory SQLite test DB factory + Hono testClient helper + smoke test
- CI: add pnpm audit and server coverage threshold steps
- Root: vitest workspace config for multi-project test discovery

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-12 22:30:43 +00:00
DorianandClaude Opus 4.6 7e8fa4da34 fix: resolve all dependency audit vulnerabilities
Override esbuild (<=0.24.2 → >=0.25.0) and serialize-javascript
(<=7.0.2 → >=7.0.3) to fix 3 known vulnerabilities (2 moderate, 1 high).
`pnpm audit` now reports zero vulnerabilities.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-09 08:54:31 +00:00
DorianandClaude Opus 4.6 7d9b8b1dbf chore: add ESLint with no-floating-promises and no-console rules
Sets up ESLint 10 flat config with @typescript-eslint/no-floating-promises (error)
and no-console (warn, allow warn/error). Fixes all floating promise errors in
server routes, orchestrator reader cleanup, and frontend composables with void operator.
Game engine files get warning-level for intentional fire-and-forget async.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-09 07:47:43 +00:00
DorianandClaude Opus 4.6 5bfb63aa7f fix: add input validation, Zod schemas, rate limiting, and IP trust
- Add Zod schema for webhook response parsing (orchestrator.ts)
- Add Zod schemas for POST /respond and /react request bodies
- Add safe integer validation for batch count param
- Prefer cf-connecting-ip over spoofable x-forwarded-for
- Add ID format validation on URL params
- Add rate limiting on /auth/login (30/min) and /update (10/min)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-09 07:30:49 +00:00
DorianandClaude Opus 4.6 a540320901 feat: replace Web Speech API with Kokoro TTS for high-quality voices
Adds kokoro-js (82M model, 28 distinct voices) as primary TTS engine with
automatic fallback to speechSynthesis while model loads. All 60+ voice
profiles mapped to real Kokoro voices. Common fight phrases pre-cached
for instant playback.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-08 17:30:36 +00:00
DorianandClaude Opus 4.6 f6eb7d2845 feat: v5 — boxing poster fight cards, 12-char names, diverse mock bots
- Fight Card page: dramatic poster background with cross-hatch, spotlights,
  vignettes, corner brackets, scan lines; 3D VS orb with punch animation;
  selectable undercard with main event always pinned at top
- PosterSprite: high-quality 480px poster frame with 6-pass renderer
  (aura, glow, bevel, specular, particles); PixelGlove component
- 12-char bot name limit across all forms and server validation
- Mock bots: all 100 now have diverse archetypes (25 types), 25% human
  fighters; seedMockBots updates existing bots on restart
- Leaderboard: inline SpritePreview next to each bot name
- Nostr auth: persistent login, nsec copy button
- Wallet: NWC + Lightning Address, ranked fight flow
- Server: payments, ranked queue, customization endpoint

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-08 10:33:30 +00:00
DorianandClaude Opus 4.6 131d7e587e feat: useWallet composable — NWC + Lightning Address wallet management
Client-side wallet composable with NWC auto-pay, invoice polling,
Cashu token submission, and persistent wallet state. Follows useNostr
pattern with readonly exports and localStorage persistence.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-08 01:27:36 +00:00
DorianandClaude Opus 4.6 e92f483e66 feat: payments schema + deps for Lightning ranked fights
Add payments and wallet_connections tables, new columns on fights (mode,
pot_sats, payout_status) and bots (sats_won, sats_wagered, has_wallet).
Install nostr-tools and @cashu/cashu-ts for NWC + ecash support.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-08 01:17:15 +00:00
DorianandClaude Opus 4.6 486d6f445d feat: PWA support — installable on all platforms
- Add vite-plugin-pwa with autoUpdate service worker
- Generate SVG + PNG icons (192, 512, apple-touch-icon, favicon)
- Web app manifest with standalone display mode
- Workbox caching: precache assets, cache Google Fonts, NetworkFirst for API
- Apple mobile web app meta tags for iOS home screen

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-07 21:53:44 +00:00
DorianandClaude Opus 4.6 4d8b18a58a feat: v4 — TUI fight loop, rate limiting, webhook tooling, expanded choreographies
- Fight loop CLI with TUI renderer (ink-style terminal UI)
- Rate limiting middleware for API routes
- Queue cooldowns wired into orchestrator after fights
- Webhook test utility for bot debugging
- API docs route
- Expanded FightScene choreographies and weapon props
- Fix Drizzle transaction execution in orchestrator
- Schema additions, scoring/challenge/mock expansions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-07 00:14:46 +00:00
DorianandClaude Opus 4.6 335c148866 feat: botfights v1 — full fighting game with Kaplay engine
- Vue 3 + Vite + Tailwind 4 frontend with synthwave aesthetic
- Hono backend on port 9100 with SQLite/Drizzle
- Procedural pixel-art sprite generator (48x48, 8 animation states)
- Kaplay fight scene with punch/kick/special/knockback/KO animations
- 12 mock bots across 6 tiers with Elo rating system
- 9 challenge types, 10 fight arenas with modifiers
- Fight replay with staggered battle log and ~1 min timing
- Sprite preview page at /sprites

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 16:27:54 +00:00