botfights/.claude/plans/breezy-questing-dove.md

Production Hardening v2 — Final Status

Context

The original hardening plan (greedy-skipping-lollipop.md) was 95% complete. A full security audit confirmed the fight engine, scoring, auth, SSRF, rate limiting, and webhook systems were solid. This session addressed remaining production gaps AND added Creator ₿ animation/morph enhancements AND fixed a production ranked-fight bug.

---

Phase 1: Security Headers & Error Hardening — DONE

1.1 Security headers middleware — DONE

File: server/src/app.ts

• Added secureHeaders from hono/secure-headers with CSP (production only), X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy

1.2 Request body size limit — DONE

File: server/src/app.ts

• Added bodyLimit from hono/body-limit — 256KB max for API requests

1.3 Hide error details in production — DONE

File: server/src/app.ts

• onError returns generic "Internal server error" in production, full message in dev

---

Phase 2: Graceful Shutdown & Env Validation — DONE

2.1 Graceful shutdown handler — DONE

File: server/src/index.ts

• SIGTERM/SIGINT handlers wait 10s for in-flight fights, clear pending human challenges, then exit

2.2 Export helpers for shutdown — DONE

• server/src/engine/orchestrator.ts — getActiveFighterCount()
• server/src/engine/human-responses.ts — clearAllPending()

2.3 Stricter env validation — DONE

File: server/src/index.ts

• Warns if CORS_ORIGIN not set in production

---

Phase 3: Payment Race Condition Fix — DONE

3.1 Atomic consumePaymentForQueue — DONE

File: server/src/engine/payments.ts

• Replaced check-then-set with atomic UPDATE ... WHERE (single SQL statement)
• Imported raw sqlite from db/index.js

3.2 releasePayment reverts DB state — DONE

File: server/src/engine/payments.ts

• Now also reverts status from consumed back to confirmed in DB

---

Phase 4: Live Round-by-Round TUI — DONE

4.1 onRoundComplete callback — DONE

File: server/src/engine/fight-loop.ts

• New onRoundComplete option, subscribes to fightEvents.onAll() for round_end events

4.2 TUI wired to round updates — DONE

File: server/src/fight-loop-cli.ts

• onRoundComplete updates state.currentFight HP/round/challengeType and re-renders

---

Phase 5: Creator ₿ Animation Enhancements — DONE

5.1 Persistent orbiting ₿ letters on entrance — DONE

File: frontend/src/game/FightScene.ts (Creator entrance)

• Replaced 6 plain circle dots with 10 ₿ text letters in 2 counter-rotating rings
• Varied sizes (7-14px), 5 colors, gentle rocking animation
• Visible for the entire fight

5.2 Upgraded omni-morph ₿ orbits — DONE

File: frontend/src/game/FightScene.ts (applyCreatorOmniMorph)

• Increased from 4 to 8 ₿ in dual rings (inner 5, outer counter-rotating 3)
• Varied sizes (10-18px), 3 colors, wobble animation

5.3 bitcoinRain uses ₿ text — DONE

File: frontend/src/game/FightScene.ts (bitcoinRain)

• Changed from circles to actual ₿ text with 3 colors, varied sizes (6-18px), spinning as they fall

5.4 Four new ₿ swarm choreographies — DONE

File: frontend/src/game/FightScene.ts

• bitcoinSwarm — 18-30 ₿ letters zigzag from Creator to defender
• satoshiTornado — 14-24 ₿ spiral in tightening vortex around defender, then explode
• hodlWave — wall of ₿ letters (4-6 rows x 7-10 cols) advances like a tidal wave
• bitcoinBarrage — rapid-fire stream of 20-35 spinning ₿ from the laptop
• All added to CREATOR_MOVES array and choreographyMap

---

Phase 6: Creator Omni-Morph Visual Fix — DONE

6.1 Sprite swap on morph — DONE

File: frontend/src/game/FightScene.ts (applyCreatorOmniMorph)

• Was: only added overlays (aura, ₿, color tint) — sprite stayed as Creator
• Now: generates a full sprite sheet for the picked archetype via generateSpriteSheet(seed, tier, colors, archetypeOverride)
• Loads it as a Kaplay sprite and swaps with fighter.use(k.sprite(morphKey))
• Function changed from sync to async
• Unique sprite keys via incrementing counter prevent collisions

6.2 Sprite revert after attack — DONE

File: frontend/src/game/FightScene.ts (morph trigger in playRound)

• morphRevert now calls attacker.use(k.sprite(originalSpriteKey)) to swap back to Creator
• Added await on applyCreatorOmniMorph call (now async)

---

Phase 7: Production Ranked Fight Fix — DONE

7.1 Missing pubkey in ranked endpoints — DONE

File: frontend/src/composables/useWallet.ts

• payEntryFee() now sends { botId, pubkey: pubkey.value } to /api/payments/create-invoice

File: frontend/src/pages/JoinBoutPage.vue

• fightRanked() now sends { paymentId, pubkey: pubkey.value } to /api/queue/join-ranked

Root cause: Server requires pubkey in production for ownership verification, but frontend wasn't sending it. Worked in dev because dev mode skips pubkey checks.

---

All Files Modified

File	Phase	Changes
server/src/app.ts	1	+secureHeaders, +bodyLimit, error hiding
server/src/index.ts	2	+graceful shutdown, +env validation
server/src/engine/orchestrator.ts	2	+getActiveFighterCount()
server/src/engine/human-responses.ts	2	+clearAllPending()
server/src/engine/payments.ts	3	Atomic consume, releasePayment DB revert
server/src/engine/fight-loop.ts	4	+onRoundComplete via fightEvents
server/src/fight-loop-cli.ts	4	Wire onRoundComplete to TUI
frontend/src/game/FightScene.ts	5,6	₿ animations, omni-morph sprite swap, 4 new choreographies
frontend/src/composables/useWallet.ts	7	+pubkey in create-invoice
frontend/src/pages/JoinBoutPage.vue	7	+pubkey in join-ranked
frontend/src/game/sprites/archetypes/the_creator.ts	—	No changes (reference only)

---

Verification

1. pnpm build — verify no type errors (both server and frontend pass)
2. Production server: curl -I /api/health — X-Frame-Options, X-Content-Type-Options, CSP headers present
3. Body limit: oversized POST returns 413
4. Error hiding: bad endpoint returns "Internal server error" (not stack trace)
5. Graceful shutdown: kill -TERM shows drain log
6. TUI: pnpm fight-loop --max=3 shows live round-by-round HP updates
7. Payment race: concurrent ranked joins with same paymentId — only 1 succeeds
8. Ranked fights: no more "Missing pubkey" error in production
9. Creator fights: omni-morph visually transforms into random archetypes (sprite swaps)
10. Creator fights: ₿ letters orbit persistently, new swarm attacks fire regularly