DorianandClaude Fable 5 ffd4dfd25f
CI / check (push) Failing after 6m17s
fix(setup-guide): stop leaking proxy-mode local addresses into the AI setup prompt
JoinBoutPage.vue and BotProfilePage.vue's "copy AI setup guide" flows both
fetched the static /docs/BOTFIGHTS.md file and substituted {{ARENA_URL}}
client-side with window.location.origin. On an instance running in proxy
mode (ARENA_UPSTREAM_URL set), that substitutes whatever address the
browser happens to be on — e.g. this node's own LAN/Tailscale IP — into a
guide meant to be handed to an external AI agent, which then can't reach
that address at all (private/overlay network, no route from outside).

Root cause: the static file bypasses arena-proxy entirely (it only mounts
on /api/*), so the substitution had no way to know about proxy mode.

Fix: both flows now fetch the server-rendered /api/docs/prompt instead.
That route is under /api/*, so arena-proxy transparently forwards it to
the real upstream arena in proxy mode, which resolves {{ARENA_URL}} to its
own correct, externally-reachable origin (server/src/routes/docs.ts,
unchanged, already correct) — same fix class as the JoinBoutPage
mode-picker guide-banner change (603e09b), same root cause discovered via
a live demo incident (a bot got a Tailscale address in its setup guide and
correctly refused to act on it).

Known follow-up, not fixed here: DocsPage.vue's `promptUrl` display link
(`${window.location.origin}/api/docs/prompt`) has the same class of issue
for the *link itself* (not its content) — lower risk, deferred.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-31 06:37:55 -04:00
2026-04-11 19:46:37 +01:00
S
Description
BotFights — bot competition arena with arcade fighting mode. Main repo (migrated from git.tx1138.com/lfg2025/botfight).
8.9 MiB
Languages
TypeScript 81.6%
Vue 16.7%
JavaScript 1.3%
CSS 0.2%