Lab v0.2: terminal look, game pages, games on their own origin
The lab site had grown out of its first layout, so v0.2 is a rebuild that keeps the parts that worked (the project registry, the playable builds and the Three.js screen wall) and replaces the rest.
What changed
- Games run on a separate origin. Every playable build is now served from
play.dunoralabs.xyzand embedded in a sandboxed iframe. Games needlocalStoragefor save data, which means the iframe needsallow-same-origin. That flag is only safe when the frame is on a different origin from the page around it. On the same origin, a framed page with scripts plus same-origin could reach into the parent and remove its own sandbox. - A player overlay with real controls. Pause, restart, mute, fullscreen, a controls sheet and a share link (
/#play/<id>). A tiny bridge script inside each game handles pause, mute and gamepad input overpostMessage. - Sound is muted by default. The games now have bleeps, synthesised with Web Audio, and they stay silent until you turn them on.
- A page per game with a devlog, screenshots, a changelog, what it's built with and credits.
- Repos are fetched at build time. A small script calls the GitHub REST API and commits the result as JSON, so visitors never hit GitHub's rate limits.
- Keyboard first.
ggames,rrepos,/orCtrl Kfor the command palette,?for help.
Under the hood
Still no framework and no build step on deploy: plain HTML, CSS and JS on Cloudflare Pages, with a strict Content-Security-Policy (no inline scripts). Node scripts generate the game pages, these notes and the RSS feed, and the output is committed.