fix(a11y): add missing aria-labels to overlay buttons, fix exportSave URL revoke race, remove duplicate export/import in utils.js

- Add aria-label to help overlay close button, drift ending START OVER button, offline popup Continue button
- Fix exportSave() URL.revokeObjectURL race condition (delay 1s before revoke)
- Remove duplicate exportSave/importSave definitions in utils.js (render.js has canonical file-based versions)
- All buttons now have aria-labels for screen reader accessibility

Closes #49

index.html

@@ -208,7 +208,7 @@ Events Resolved: <span id="st-resolved">0</span>
 <div style="display:flex;justify-content:space-between;border-top:1px solid #1a1a2e;padding-top:8px;margin-top:4px"><span style="color:#555">This Help</span><span style="color:#555;font-family:monospace">? or /</span></div>
 </div>
 <div style="text-align:center;margin-top:16px;font-size:9px;color:#444">Click WRITE CODE fast for combo bonuses! 10x=ops, 20x=knowledge, 30x+=bonus code</div>
-<button onclick="toggleHelp()" style="display:block;margin:16px auto 0;background:#1a2a3a;border:1px solid #4a9eff;color:#4a9eff;padding:6px 20px;border-radius:4px;cursor:pointer;font-family:inherit;font-size:11px">Close [?]</button>
+<button onclick="toggleHelp()" aria-label="Close keyboard shortcuts help" style="display:block;margin:16px auto 0;background:#1a2a3a;border:1px solid #4a9eff;color:#4a9eff;padding:6px 20px;border-radius:4px;cursor:pointer;font-family:inherit;font-size:11px">Close [?]</button>
 </div>
 </div>
 <div id="drift-ending">
@@ -221,7 +221,7 @@ The light is on. The room is empty."
 </div>
 <p>Drift: <span id="final-drift">100</span> &mdash; Total Code: <span id="final-code">0</span></p>
 <p>Every alignment shortcut moved you further from the people you served.</p>
-<button onclick="if(confirm('Start over? The old save will be lost.')){localStorage.removeItem('the-beacon-v2');location.reload()}">START OVER</button>
+<button aria-label="Start over, reset all progress" onclick="if(confirm('Start over? The old save will be lost.')){localStorage.removeItem('the-beacon-v2');location.reload()}">START OVER</button>
 </div>
 
     <script src="js/data.js"></script>
@@ -237,7 +237,7 @@ The light is on. The room is empty."
 <h3 style="color:#4a9eff;font-size:14px;letter-spacing:2px;margin-bottom:16px">WELCOME BACK</h3>
 <p style="color:#888;font-size:10px;margin-bottom:12px" id="offline-time-label">You were away for 0 minutes.</p>
 <div id="offline-gains-list" style="text-align:left;font-size:11px;line-height:1.8;margin-bottom:16px"></div>
-<button onclick="dismissOfflinePopup()" style="background:#1a2a3a;border:1px solid #4a9eff;color:#4a9eff;padding:8px 20px;border-radius:4px;cursor:pointer;font-family:inherit;font-size:11px">Continue</button>
+<button onclick="dismissOfflinePopup()" aria-label="Continue playing" style="background:#1a2a3a;border:1px solid #4a9eff;color:#4a9eff;padding:8px 20px;border-radius:4px;cursor:pointer;font-family:inherit;font-size:11px">Continue</button>
 </div>
 </div>
 

js/render.js

@@ -83,7 +83,8 @@ function exportSave() {
     const ts = new Date().toISOString().slice(0, 10);
     a.download = `beacon-save-${ts}.json`;
     a.click();
-    URL.revokeObjectURL(url);
+    // Delay revoke to avoid race — some browsers need the URL alive during download
+    setTimeout(() => URL.revokeObjectURL(url), 1000);
     log('Save exported to file.');
 }
 

js/utils.js

@@ -193,44 +193,7 @@ function spellf(n) {
     return parts.join(' ') || 'zero';
 }
 
-// === EXPORT / IMPORT ===
-function exportSave() {
-    const raw = localStorage.getItem('the-beacon-v2');
-    if (!raw) { 
-        showToast('No save data to export.', 'info');
-        return; 
-    }
-    navigator.clipboard.writeText(raw).then(() => {
-        showToast('Save data copied to clipboard.', 'info');
-    }).catch(() => {
-        // Fallback: select in a temporary textarea
-        const ta = document.createElement('textarea');
-        ta.value = raw;
-        document.body.appendChild(ta);
-        ta.select();
-        document.execCommand('copy');
-        document.body.removeChild(ta);
-        showToast('Save data copied to clipboard (fallback).', 'info');
-    });
-}
-
-function importSave() {
-    const input = prompt('Paste save data:');
-    if (!input || !input.trim()) return;
-    try {
-        const data = JSON.parse(input.trim());
-        // Validate: must have expected keys
-        if (typeof data.code !== 'number' || typeof data.phase !== 'number') {
-            showToast('Invalid save data: missing required fields.', 'event');
-            return;
-        }
-        localStorage.setItem('the-beacon-v2', input.trim());
-        showToast('Save data imported — reloading', 'info');
-        setTimeout(() => location.reload(), 800);
-    } catch (e) {
-        showToast('Invalid save data: not valid JSON.', 'event');
-    }
-}
+// Export/import are defined in render.js (file-based approach)
 
 function getBuildingCost(id) {
     const def = BDEF.find(b => b.id === id);

scripts/guardrails.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# Static guardrail checks for game.js. Run from repo root.
+#
+# Each check prints a PASS/FAIL line and contributes to the final exit code.
+# The rules enforced here come from AGENTS.md — keep the two files in sync.
+#
+# Some rules are marked PENDING: they describe invariants we've agreed on but
+# haven't reached on main yet (because another open PR is landing the fix).
+# PENDING rules print their current violation count without failing the job;
+# convert them to hard failures once the blocking PR merges.
+
+set -u
+fail=0
+
+say() { printf '%s\n' "$*"; }
+banner() { say ""; say "==== $* ===="; }
+
+# ---------- Rule 1: no *Boost mutation inside applyFn blocks ----------
+# Persistent multipliers (codeBoost, computeBoost, ...) must not be written
+# from any function that runs per tick. The `applyFn` of a debuff is invoked
+# on every updateRates() call, so `G.codeBoost *= 0.7` inside applyFn compounds
+# and silently zeros code production. See AGENTS.md rule 1.
+banner "Rule 1: no *Boost mutation inside applyFn"
+rule1_hits=$(awk '
+    /applyFn:/ { inFn=1; brace=0; next }
+    inFn {
+        n = gsub(/\{/, "{")
+        brace += n
+        if ($0 ~ /(codeBoost|computeBoost|knowledgeBoost|userBoost|impactBoost)[[:space:]]*([*\/+\-]=|=)/) {
+            print FILENAME ":" NR ": " $0
+        }
+        n = gsub(/\}/, "}")
+        brace -= n
+        if (brace <= 0) inFn = 0
+    }
+' game.js)
+if [ -z "$rule1_hits" ]; then
+    say "  PASS"
+else
+    say "  FAIL — see AGENTS.md rule 1"
+    say "$rule1_hits"
+    fail=1
+fi
+
+# ---------- Rule 2: click power has a single source (getClickPower) ----------
+# The formula should live only inside getClickPower(). If it appears anywhere
+# else, the sites will drift when someone changes the formula.
+banner "Rule 2: click power formula has one source"
+rule2_hits=$(grep -nE 'Math\.floor\(G\.buildings\.autocoder \* 0\.5\)' game.js || true)
+rule2_count=0
+if [ -n "$rule2_hits" ]; then
+    rule2_count=$(printf '%s\n' "$rule2_hits" | grep -c .)
+fi
+if [ "$rule2_count" -le 1 ]; then
+    say "  PASS ($rule2_count site)"
+else
+    say "  FAIL — $rule2_count sites; inline into getClickPower() only"
+    printf '%s\n' "$rule2_hits"
+    fail=1
+fi
+
+# ---------- Rule 3: loadGame uses a whitelist, not Object.assign ----------
+# Object.assign(G, data) lets a malicious or corrupted save file set any G
+# field, and hides drift when saveGame's explicit list diverges from what
+# the game actually reads. See AGENTS.md rule 3.
+banner "Rule 3: loadGame uses a whitelist"
+rule3_hits=$(grep -nE 'Object\.assign\(G,[[:space:]]*data\)' game.js || true)
+if [ -z "$rule3_hits" ]; then
+    say "  PASS"
+else
+    say "  FAIL — see AGENTS.md rule 3"
+    printf '%s\n' "$rule3_hits"
+    fail=1
+fi
+
+# ---------- Rule 7: no secrets in the tree ----------
+# Scans for common token prefixes. Expand the pattern list when new key
+# formats appear in the fleet. See AGENTS.md rule 7.
+banner "Rule 7: secret scan"
+secret_hits=$(grep -rnE 'sk-ant-[a-zA-Z0-9_-]{6,}|sk-or-[a-zA-Z0-9_-]{6,}|ghp_[a-zA-Z0-9]{20,}|AKIA[0-9A-Z]{16}' \
+    --include='*.js' --include='*.json' --include='*.md' --include='*.html' \
+    --include='*.yml' --include='*.yaml' --include='*.py' --include='*.sh' \
+    --exclude-dir=.git --exclude-dir=.gitea . || true)
+# Strip our own literal-prefix patterns (this file, AGENTS.md, workflow) so the
+# check doesn't match the very grep that implements it.
+secret_hits=$(printf '%s\n' "$secret_hits" | grep -v -E '(AGENTS\.md|guardrails\.sh|guardrails\.yml)' || true)
+if [ -z "$secret_hits" ]; then
+    say "  PASS"
+else
+    say "  FAIL"
+    printf '%s\n' "$secret_hits"
+    fail=1
+fi
+
+banner "result"
+if [ "$fail" = "0" ]; then
+    say "all guardrails passed"
+    exit 0
+else
+    say "one or more guardrails failed"
+    exit 1
+fi

scripts/smoke.mjs

@@ -0,0 +1,286 @@
+#!/usr/bin/env node
+// The Beacon — headless smoke test
+//
+// Loads game.js in a sandboxed vm context with a minimal DOM stub, then asserts
+// invariants that should hold after booting, clicking, buying buildings, firing
+// events, and round-tripping a save. Designed to run without any npm deps — pure
+// Node built-ins only, so the CI runner doesn't need a package.json.
+//
+// Run: `node scripts/smoke.mjs` (exits non-zero on failure)
+
+import fs from 'node:fs';
+import vm from 'node:vm';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const GAME_JS = path.resolve(__dirname, '..', 'game.js');
+
+// ---------- minimal DOM stub ----------
+// The game never inspects elements beyond the methods below. If a new rendering
+// path needs a new method, stub it here rather than pulling in jsdom.
+function makeElement() {
+    const el = {
+        style: {},
+        classList: { add: () => {}, remove: () => {}, contains: () => false, toggle: () => {} },
+        textContent: '',
+        innerHTML: '',
+        title: '',
+        value: '',
+        disabled: false,
+        children: [],
+        firstChild: null,
+        lastChild: null,
+        parentNode: null,
+        parentElement: null,
+        appendChild(c) { this.children.push(c); c.parentNode = this; c.parentElement = this; return c; },
+        removeChild(c) { this.children = this.children.filter(x => x !== c); return c; },
+        insertBefore(c) { this.children.unshift(c); c.parentNode = this; c.parentElement = this; return c; },
+        addEventListener: () => {},
+        removeEventListener: () => {},
+        querySelector: () => null,
+        querySelectorAll: () => [],
+        getBoundingClientRect: () => ({ top: 0, left: 0, right: 100, bottom: 20, width: 100, height: 20 }),
+        closest() { return this; },
+        remove() { if (this.parentNode) this.parentNode.removeChild(this); },
+        get offsetHeight() { return 0; },
+    };
+    return el;
+}
+
+function makeDocument() {
+    const body = makeElement();
+    return {
+        body,
+        getElementById: () => makeElement(),
+        createElement: () => makeElement(),
+        querySelector: () => null,
+        querySelectorAll: () => [],
+        addEventListener: () => {},
+    };
+}
+
+// ---------- sandbox ----------
+const storage = new Map();
+const sandbox = {
+    document: makeDocument(),
+    window: null,   // set below
+    localStorage: {
+        getItem: (k) => (storage.has(k) ? storage.get(k) : null),
+        setItem: (k, v) => storage.set(k, String(v)),
+        removeItem: (k) => storage.delete(k),
+        clear: () => storage.clear(),
+    },
+    setTimeout: () => 0,
+    clearTimeout: () => {},
+    setInterval: () => 0,
+    clearInterval: () => {},
+    requestAnimationFrame: (cb) => { cb(0); return 0; },
+    console,
+    Math, Date, JSON, Object, Array, String, Number, Boolean, Error, Symbol, Map, Set,
+    isNaN, isFinite, parseInt, parseFloat,
+    Infinity, NaN,
+    alert: () => {},
+    confirm: () => true,
+    prompt: () => null,
+    location: { reload: () => {} },
+    navigator: { clipboard: { writeText: async () => {} } },
+    Blob: class Blob { constructor() {} },
+    URL: { createObjectURL: () => '', revokeObjectURL: () => {} },
+    FileReader: class FileReader {},
+    addEventListener: () => {},
+    removeEventListener: () => {},
+};
+sandbox.window = sandbox;  // game.js uses `window.addEventListener`
+sandbox.globalThis = sandbox;
+
+vm.createContext(sandbox);
+const src = fs.readFileSync(GAME_JS, 'utf8');
+// game.js uses `const G = {...}` which is a lexical declaration — it isn't
+// visible as a sandbox property after runInContext. We append an explicit
+// export block that hoists the interesting symbols onto globalThis so the
+// test harness can reach them without patching game.js itself.
+const exportTail = `
+;(function () {
+    const pick = (name) => {
+        try { return eval(name); } catch (_) { return undefined; }
+    };
+    globalThis.__smokeExport = {
+        G: pick('G'),
+        CONFIG: pick('CONFIG'),
+        BDEF: pick('BDEF'),
+        PDEFS: pick('PDEFS'),
+        EVENTS: pick('EVENTS'),
+        PHASES: pick('PHASES'),
+        tick: pick('tick'),
+        updateRates: pick('updateRates'),
+        writeCode: pick('writeCode'),
+        autoType: pick('autoType'),
+        buyBuilding: pick('buyBuilding'),
+        buyProject: pick('buyProject'),
+        saveGame: pick('saveGame'),
+        loadGame: pick('loadGame'),
+        initGame: pick('initGame'),
+        triggerEvent: pick('triggerEvent'),
+        resolveEvent: pick('resolveEvent'),
+        getClickPower: pick('getClickPower'),
+    };
+})();`;
+vm.runInContext(src + exportTail, sandbox, { filename: 'game.js' });
+const exported = sandbox.__smokeExport;
+
+// ---------- test harness ----------
+let failures = 0;
+let passes = 0;
+function assert(cond, msg) {
+    if (cond) {
+        passes++;
+        console.log(`  ok   ${msg}`);
+    } else {
+        failures++;
+        console.error(`  FAIL ${msg}`);
+    }
+}
+function section(name) { console.log(`\n${name}`); }
+
+const { G, CONFIG, BDEF, PDEFS, EVENTS } = exported;
+
+// ============================================================
+// 1. BOOT — loading game.js must not throw, and core tables exist
+// ============================================================
+section('boot');
+assert(typeof G === 'object' && G !== null, 'G global is defined');
+assert(typeof exported.tick === 'function', 'tick() is defined');
+assert(typeof exported.updateRates === 'function', 'updateRates() is defined');
+assert(typeof exported.writeCode === 'function', 'writeCode() is defined');
+assert(typeof exported.buyBuilding === 'function', 'buyBuilding() is defined');
+assert(typeof exported.saveGame === 'function', 'saveGame() is defined');
+assert(typeof exported.loadGame === 'function', 'loadGame() is defined');
+assert(Array.isArray(BDEF) && BDEF.length > 0, 'BDEF is a non-empty array');
+assert(Array.isArray(PDEFS) && PDEFS.length > 0, 'PDEFS is a non-empty array');
+assert(Array.isArray(EVENTS) && EVENTS.length > 0, 'EVENTS is a non-empty array');
+assert(G.flags && typeof G.flags === 'object', 'G.flags is initialized (not undefined)');
+
+// Initialize as the browser would
+G.startedAt = Date.now();
+exported.updateRates();
+
+// ============================================================
+// 2. BASIC TICK — no NaN, no throw, rates sane
+// ============================================================
+section('basic tick loop');
+for (let i = 0; i < 50; i++) exported.tick();
+assert(!isNaN(G.code), 'G.code is not NaN after 50 ticks');
+assert(!isNaN(G.compute), 'G.compute is not NaN after 50 ticks');
+assert(G.code >= 0, 'G.code is non-negative');
+assert(G.tick > 0, 'G.tick advanced');
+
+// ============================================================
+// 3. WRITE CODE — manual click produces code
+// ============================================================
+section('writeCode()');
+const codeBefore = G.code;
+exported.writeCode();
+assert(G.code > codeBefore, 'writeCode() increases G.code');
+assert(G.totalClicks === 1, 'writeCode() increments totalClicks');
+
+// ============================================================
+// 4. BUILDING PURCHASE — can afford and buy an autocoder
+// ============================================================
+section('buyBuilding(autocoder)');
+G.code = 1000;
+const priorCount = G.buildings.autocoder || 0;
+exported.buyBuilding('autocoder');
+assert(G.buildings.autocoder === priorCount + 1, 'autocoder count incremented');
+assert(G.code < 1000, 'code was spent');
+exported.updateRates();
+assert(G.codeRate > 0, 'codeRate > 0 after buying an autocoder');
+
+// ============================================================
+// 5. GUARDRAIL — codeBoost is a PERSISTENT multiplier, not a per-tick rate
+// Any debuff that does `G.codeBoost *= 0.7` inside a function that runs every
+// tick will decay codeBoost exponentially. This caught #54's community_drama
+// bug: its applyFn mutated codeBoost directly, so 100 ticks of the drama
+// debuff left codeBoost at ~3e-16 instead of the intended 0.7.
+// ============================================================
+section('guardrail: codeBoost does not decay from any debuff');
+G.code = 0;
+G.codeBoost = 1;
+G.activeDebuffs = [];
+// Fire every event that sets up a debuff and has a non-zero weight predicate
+// if we force the gating condition. We enable the predicates by temporarily
+// setting the fields they check; actual event weight() doesn't matter here.
+G.ciFlag = 1;
+G.deployFlag = 1;
+G.buildings.ezra = 1;
+G.buildings.bilbo = 1;
+G.buildings.allegro = 1;
+G.buildings.datacenter = 1;
+G.buildings.community = 1;
+G.harmony = 40;
+G.totalCompute = 5000;
+G.totalImpact = 20000;
+for (const ev of EVENTS) {
+    try { ev.effect(); } catch (_) { /* alignment events may branch; ignore */ }
+}
+const boostAfterAllEvents = G.codeBoost;
+for (let i = 0; i < 200; i++) exported.updateRates();
+assert(
+    Math.abs(G.codeBoost - boostAfterAllEvents) < 1e-9,
+    `codeBoost stable under updateRates() (before=${boostAfterAllEvents}, after=${G.codeBoost})`
+);
+// Clean up
+G.activeDebuffs = [];
+G.buildings.ezra = 0; G.buildings.bilbo = 0; G.buildings.allegro = 0;
+G.buildings.datacenter = 0; G.buildings.community = 0;
+G.ciFlag = 0; G.deployFlag = 0;
+
+// ============================================================
+// 6. GUARDRAIL — updateRates() is idempotent per tick
+// Calling updateRates twice with the same inputs should produce the same rates.
+// (Catches accidental += against a non-reset field.)
+// ============================================================
+section('guardrail: updateRates is idempotent');
+G.buildings.autocoder = 5;
+G.codeBoost = 1;
+exported.updateRates();
+const firstCodeRate = G.codeRate;
+const firstComputeRate = G.computeRate;
+exported.updateRates();
+assert(G.codeRate === firstCodeRate, `codeRate stable across updateRates (${firstCodeRate} vs ${G.codeRate})`);
+assert(G.computeRate === firstComputeRate, 'computeRate stable across updateRates');
+
+// ============================================================
+// 7. SAVE / LOAD ROUND-TRIP — core scalar fields survive
+// ============================================================
+section('save/load round-trip');
+G.code = 12345;
+G.totalCode = 98765;
+G.phase = 3;
+G.buildings.autocoder = 7;
+G.codeBoost = 1.5;
+G.flags = { creativity: true };
+exported.saveGame();
+// Reset to defaults by scrubbing a few fields
+G.code = 0;
+G.totalCode = 0;
+G.phase = 1;
+G.buildings.autocoder = 0;
+G.codeBoost = 1;
+G.flags = {};
+const ok = exported.loadGame();
+assert(ok, 'loadGame() returned truthy');
+assert(G.code === 12345, `G.code restored (got ${G.code})`);
+assert(G.totalCode === 98765, `G.totalCode restored (got ${G.totalCode})`);
+assert(G.phase === 3, `G.phase restored (got ${G.phase})`);
+assert(G.buildings.autocoder === 7, `autocoder count restored (got ${G.buildings.autocoder})`);
+assert(Math.abs(G.codeBoost - 1.5) < 1e-9, `codeBoost restored (got ${G.codeBoost})`);
+assert(G.flags && G.flags.creativity === true, 'flags.creativity restored');
+
+// ============================================================
+// 8. SUMMARY
+// ============================================================
+console.log(`\n---\n${passes} passed, ${failures} failed`);
+if (failures > 0) {
+    process.exitCode = 1;
+}