Remove package.json / package-lock.json. The only dependency was claude-flow, which is dev tooling the game never loads. It brought in 49 known vulnerabilities (2 critical, 28 high), and Cloudflare Pages can auto-install dependencies from a lockfile. With these files gone the site ships no npm dependencies.
Self-host the Outfit font. The latin + latin-ext variable WOFF2 files (SIL OFL, license in fonts/OFL.txt) now live in fonts/, declared with @font-face in style.css, and index.html preloads the latin file. This replaces the Google Fonts <link>.
Tighten the CSP in _headers: style-src 'self' 'unsafe-inline'; font-src 'self'. No third-party origins are left.
Service worker: precaches both font files and bumps CACHE_NAME to tortugotchi-v18.
⚠️ Also includes fadf1cc
This branch also contains fadf1cc "Suspend gameplay when unfocused and fix playmate voice mismatches". It existed only locally, because both Gitea and the GitHub mirror were still at 185845f. Merging this PR therefore deploys that gameplay change to production too.
Test plan
Served locally with the _headers CSP applied and loaded in Chrome:
Closes #1
## Summary
- **Remove `package.json` / `package-lock.json`.** The only dependency was `claude-flow`, which is dev tooling the game never loads. It brought in 49 known vulnerabilities (2 critical, 28 high), and Cloudflare Pages can auto-install dependencies from a lockfile. With these files gone the site ships no npm dependencies.
- **Self-host the Outfit font.** The latin + latin-ext variable WOFF2 files (SIL OFL, license in `fonts/OFL.txt`) now live in `fonts/`, declared with `@font-face` in `style.css`, and `index.html` preloads the latin file. This replaces the Google Fonts `<link>`.
- **Tighten the CSP** in `_headers`: `style-src 'self' 'unsafe-inline'; font-src 'self'`. No third-party origins are left.
- **Service worker:** precaches both font files and bumps `CACHE_NAME` to `tortugotchi-v18`.
## ⚠️ Also includes `fadf1cc`
This branch also contains **`fadf1cc` "Suspend gameplay when unfocused and fix playmate voice mismatches"**. It existed only locally, because both Gitea and the GitHub mirror were still at `185845f`. Merging this PR therefore deploys that gameplay change to production too.
## Test plan
- [x] Served locally with the `_headers` CSP applied and loaded in Chrome:
- [x] Outfit loads (`document.fonts.check('600 16px Outfit')` → true)
- [x] Zero requests to `fonts.googleapis.com` / `fonts.gstatic.com`
- [x] No CSP violations in the console
- [x] SW cache `tortugotchi-v18` contains both font files
- [ ] Visual check of the start screen and ocean screen typography (the screenshot tool timed out, so this hasn't been checked by eye)
- [ ] After deploy: confirm the live CSP header and that returning users pick up v18
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Pause the ocean decay/aging/hazard loops and ambient audio whenever the tab is
hidden or the window loses focus, and resume untouched on return. Remove the
offline catch-up decay so a turtle left alone freezes instead of dying, letting
turtles live and grow over a long real-world span.
Gate the playmate greeting/farewell voice clips (letsPlay/swimSafe) to the
green species whose text they match; loggerhead and leatherback play silently.
Also keep glub out of the ambient loop while a voice line plays. Bump SW to v17.
- Remove package.json / package-lock.json. The only dependency was
claude-flow (dev tooling, never loaded by the game), which pulled in
49 known vulnerabilities (2 critical, 28 high) and could be installed
by the Cloudflare Pages build.
- Self-host the Outfit variable font (latin + latin-ext woff2, SIL OFL)
in fonts/ instead of loading it from Google Fonts. This removes the
last third-party origins from the CSP (style-src / font-src are now
'self' only), stops sending visitor IPs to Google, and makes the font
work offline.
- Precache the font files in the service worker and bump CACHE_NAME to
tortugotchi-v18.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #1
Summary
package.json/package-lock.json. The only dependency wasclaude-flow, which is dev tooling the game never loads. It brought in 49 known vulnerabilities (2 critical, 28 high), and Cloudflare Pages can auto-install dependencies from a lockfile. With these files gone the site ships no npm dependencies.fonts/OFL.txt) now live infonts/, declared with@font-faceinstyle.css, andindex.htmlpreloads the latin file. This replaces the Google Fonts<link>._headers:style-src 'self' 'unsafe-inline'; font-src 'self'. No third-party origins are left.CACHE_NAMEtotortugotchi-v18.⚠️ Also includes
fadf1ccThis branch also contains
fadf1cc"Suspend gameplay when unfocused and fix playmate voice mismatches". It existed only locally, because both Gitea and the GitHub mirror were still at185845f. Merging this PR therefore deploys that gameplay change to production too.Test plan
_headersCSP applied and loaded in Chrome:document.fonts.check('600 16px Outfit')→ true)fonts.googleapis.com/fonts.gstatic.comtortugotchi-v18contains both font files🤖 Generated with Claude Code