Hands: computer opponent, fighting styles, Fight Night mechanics, physics knockouts, gore and a broadcast presentation

README.md

@@ -473,8 +473,12 @@ Keyboard controls use physical key positions (`KeyboardEvent.code`):
 | Slip left / slip right | `Z` / `X` |
 | Weave / pull | `C` / `V` |
 | Clinch / switch stance | `B` / `N` |
-| Low blow / headbutt | `1` / `2` |
+| Taunt | `M` |
+| Low blow / headbutt (deliberate fouls) | `Shift+1` / `Shift+2` |
 | Private get-up rhythm | `Left Arrow` / `Right Arrow` |
+| Corner instruction, between rounds | `1` close the cut · `2` bring down the swelling · `3` catch your breath |
+| Style, in the pick before the bout | Arrow keys choose, `Enter` settles; `1`–`5` settle on that card at once |
+| Camera | `K` cycles broadcast, close and over the shoulder |
 
 Standard-controller controls are:
 
@@ -490,6 +494,8 @@ Standard-controller controls are:
 | Clinch / switch stance | Left-stick press / right-stick press |
 | Low blow / headbutt | View/Back / Menu/Start |
 | Private get-up rhythm | While down, press D-pad left / right; it registers immediately rather than waiting for release |
+| Corner instruction, between rounds | Left (`X`/Square) close the cut · top (`Y`/Triangle) bring down the swelling · right (`B`/Circle) catch your breath |
+| Style, in the pick before the bout | D-pad or left stick choose; bottom (`A`/Cross) settles |
 
 The right stick also performs one punch after a center→peak→center gesture. Left/right direction selects the hand. Using the absolute angle from horizontal: **0–22.5° hook**, **22.5–45° jab**, **45–70° straight**, and **70–90° uppercut**. The gesture fires once only after returning to center; trigger modifiers are captured at gesture start. Face/D-pad punches are the accessibility alternative when stick gestures are impractical.
 
@@ -561,7 +567,7 @@ For a long-running deployment, run the command under your process manager of cho
 2. On the application's **OAuth2** page, add `https://127.0.0.1` under **Redirects** and save it. Discord requires a Redirect URI for Activity authorization even though the Embedded App SDK handles returning to the Activity; this placeholder is the value specified by Discord's Activity guide.
 3. Configure Activity OAuth for exactly `identify` and `guilds.members.read`. Install the guild app with both `bot` and `applications.commands` scopes, and keep **Server Members Intent** enabled. Message Content Intent remains needed by other IntelStream features.
 4. Verify `DISCORD_GUILD_ID`, the authenticated application/client ID, and `DISCORD_CLIENT_SECRET`. Store the client secret and bot token only in the server environment. Never put either secret—or OAuth codes, access tokens, or game tickets—in a URL, Vite variable, browser/local storage, analytics, or logs.
-5. Run the Python listener on `127.0.0.1:HANDS_PORT`. Put a public TLS reverse proxy on the mapped origin and proxy `/`, `/api/hands/*`, and WebSocket upgrades to that listener. Preserve HTTPS/WSS, Host, and upgrade headers; do not expose the plaintext loopback port publicly. Hands applies global and per-client request/concurrency ceilings using the direct peer address. If the proxy supplies `X-Forwarded-For`, set `HANDS_TRUSTED_PROXY_CIDRS` to only the exact proxy network(s) that connect to Hands (for example `127.0.0.1/32,::1/128` for a loopback proxy), configure the proxy to overwrite or append the real client address, and prevent clients from bypassing that proxy. Forwarded headers from any unlisted peer are ignored; never configure an all-addresses CIDR.
+5. Run the Python listener on `127.0.0.1:HANDS_PORT`. Put a public TLS reverse proxy on the mapped origin and proxy `/`, `/api/hands/*`, and WebSocket upgrades to that listener. Preserve HTTPS/WSS, Host, and upgrade headers; do not expose the plaintext loopback port publicly. Hands applies global and per-client request/concurrency ceilings keyed on the peer address; because Discord's Activity proxy hides players' addresses, the sign-in ceilings are also scoped to the Activity instance, so one voice channel cannot crowd out another. If the proxy supplies `X-Forwarded-For`, set `HANDS_TRUSTED_PROXY_CIDRS` to only the exact proxy network(s) that connect to Hands (for example `127.0.0.1/32,::1/128` for a loopback proxy), configure the proxy to overwrite or append the real client address, and prevent clients from bypassing that proxy. Forwarded headers from any unlisted peer are ignored; never configure an all-addresses CIDR.
 6. Start `uv run intelstream` and confirm startup configures one guild-only global `hands` Entry Point with Discord handler `DISCORD_LAUNCH_ACTIVITY`. Confirm the public `/healthz`, open Discord's App Launcher, search for BunkerIntel, and launch it. Have a second distinct guild member select **Play now** on Discord's channel message, then have a third member join and confirm they see **SPECTATING · READ ONLY** with no gameplay input. Confirm only the first two seats affect the match and ELO. A single process owns in-memory OAuth state, rooms, spectators, and reconnect tickets; do not horizontally scale Hands without shared authoritative state/routing.
 7. Complete the violent-content/age-rating/disclosure and originality reviews described above before public distribution.
 
@@ -625,7 +631,7 @@ HANDS_DEV_BACKEND=http://127.0.0.1:8091 npm --prefix web/hands run dev -- --port
 
 Open `http://localhost:5174/?e2e=1&instance_id=<any id>&player=<name>` in two browser windows (different names) to fight. The `e2e` switch only exists in Vite development builds; the development server authenticates anyone who can reach its port, so never expose it.
 
-`scripts/hands_e2e_scenarios.js` automates this with Playwright: `ko` (power punches until a knockdown, private get-up rhythm, stoppage), `reconnect` (one client drops offline mid-round and resumes), `rest` (two rounds with the corner rest), `spectator` (a third client joins read-only), `touch` (one player on an emulated phone), `mash` (hundreds of key presses per second) `latency` (a TCP proxy delays every frame 110 ms each way, and the clients report their measured input acknowledgement latency, which the fighter HUD also shows) `soak` (a full three-round bout sampling heap size, latency and render scale every twenty seconds) `background` (one player's page is frozen through the DevTools lifecycle state for eight seconds, as a backgrounded phone app would be, then resumed) `rematch` (both players use the Rematch button after the result and fight a second bout in the same instance) `rematchloop` (four bouts back to back while sampling heap size and GPU object counts for leaks) `clinch` (both players close in and one ties up; the harness reads the fighters' separation from the client state through the engine's draw-in, the hold and the referee break) and `response` (key press to first rendered frame for the player's own punch and step, when the opponent sees them, and whether the predicted punch ever jumps back, behind a delay proxy set with `E2E_DELAY_MS`, 60 ms each way by default). It spawns the development server itself and prints the clients' status text plus any client or server errors. The default software renderer keeps runs reproducible on machines without a GPU; set `E2E_GPU=1` to render on the machine's GPU for real frame pacing, input latency and screenshots.
+`scripts/hands_e2e_scenarios.js` automates this with Playwright: `ko` (power punches until a knockdown, private get-up rhythm, stoppage), `reconnect` (one client's link goes silent mid-round through a TCP proxy, with no close in either direction as a lost network has none; it times how long the room takes to pause the other player, then restores the link and checks both resume), `rest` (two rounds with the corner rest), `spectator` (a third client joins read-only), `touch` (one player on an emulated phone), `mash` (hundreds of key presses per second) `latency` (a TCP proxy delays every frame 110 ms each way, and the clients report their measured input acknowledgement latency, which the fighter HUD also shows) `soak` (a full three-round bout sampling heap size, latency and render scale every twenty seconds) `background` (one player's page is frozen through the DevTools lifecycle state for eight seconds, as a backgrounded phone app would be, then resumed) `rematch` (both players use the Rematch button after the result and fight a second bout in the same instance) `rematchloop` (four bouts back to back while sampling heap size and GPU object counts for leaks) `clinch` (both players close in and one ties up; the harness reads the fighters' separation from the client state through the engine's draw-in, the hold and the referee break) and `response` (key press to first rendered frame for the player's own punch and step, when the opponent sees them, and whether the predicted punch ever jumps back, behind a delay proxy set with `E2E_DELAY_MS`, 60 ms each way by default). It spawns the development server itself and prints the clients' status text plus any client or server errors. The default software renderer keeps runs reproducible on machines without a GPU; set `E2E_GPU=1` to render on the machine's GPU for real frame pacing, input latency and screenshots.
 
 `HANDS_DEV_BACKEND` is a Node/Vite development-process setting, not a browser `VITE_*` value and not a production origin. Real OAuth still needs a valid Activity instance; the fixture is only recorded presentation data. Keep `HANDS_DEV_MODE=false` in production.
 

scripts/check_hands_wheel.py

@@ -28,7 +28,8 @@
     re.IGNORECASE,
 )
 # These are the complete external URL literals carried by reviewed client code.
-# They are pinned SDK metadata or model attribution, not Hands runtime targets.
+# Apart from Discord's avatar host they are pinned SDK metadata or model attribution,
+# not Hands runtime targets.
 REVIEWED_EXTERNAL_URL_LITERALS = {
     "https://github.com/uuidjs/uuid#getrandomvalues-not-supported",
     "https://discord.com",
@@ -40,6 +41,8 @@
     "https://staging.discord.co",
     "http://localhost:3333",
     "https://pax.discord.com",
+    # Discord's image host, for the players' own avatars (image requests only).
+    "https://cdn.discordapp.com/avatars/",
     # Texel Boxer source and CC BY 4.0 license attribution shown in-app.
     "https://sketchfab.com/3d-models/boxer-84767168720948b38728ff78ee6f6090",
     "https://creativecommons.org/licenses/by/4.0/",