frogoe 0.5.5 → 0.7.0

package/dist/cli.js

@@ -25,7 +25,8 @@ var init_templates = __esm({
     ].join("\n");
     briefTemplate = `---
 title: My Game
-verb: tap        # tap | hold | steer | aim \u2014 ONE word, the core action
+verb: tap        # tap|hold|steer|aim|swap|place|type|draw|idle \u2014 ONE word, the core action
+session: blitz   # blitz (default) | round | toy \u2014 how the run ends
 mood: TODO \u2014 one phrase: "dawn uplift", "arcade cabinet at midnight"...
 palette:
   bg: "#101418"  # TODO
@@ -384,7 +385,7 @@ var init_add2 = __esm({
 });
 
 // src/fetch-policy.ts
-var DEFAULT_FETCH_POLICY, FetchUnavailableError, FetchNotServedError, sleep, fetchWithPolicy;
+var DEFAULT_FETCH_POLICY, FetchUnavailableError, FetchNotServedError, sleep, fetchWithPolicy, fetchBufferWithPolicy;
 var init_fetch_policy = __esm({
   "src/fetch-policy.ts"() {
     "use strict";
@@ -444,7 +445,50 @@ var init_fetch_policy = __esm({
         } catch (error) {
           const retryable = error instanceof FetchUnavailableError || !(error instanceof FetchNotServedError);
           if (!retryable || attempt === policy.maxAttempts) {
-            throw error;
+            if (error instanceof FetchUnavailableError || error instanceof FetchNotServedError) {
+              throw error;
+            }
+            throw new FetchUnavailableError(url, error);
+          }
+          await sleep(Math.random() * policy.baseDelayMs * 2 ** (attempt - 1));
+        } finally {
+          clearTimeout(timer);
+        }
+      }
+      throw new FetchUnavailableError(url, new Error("unreachable"));
+    };
+    fetchBufferWithPolicy = async (url, options) => {
+      const policy = { ...DEFAULT_FETCH_POLICY, ...options?.policy };
+      const doFetch = options?.fetchImpl ?? fetch;
+      const started = Date.now();
+      for (let attempt = 1; attempt <= policy.maxAttempts; attempt += 1) {
+        if (Date.now() - started > policy.maxElapsedMs) {
+          throw new FetchUnavailableError(url, new Error("wall-clock budget exceeded"));
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => {
+          controller.abort();
+        }, policy.attemptTimeoutMs);
+        try {
+          const res = await doFetch(url, {
+            headers: options?.headers,
+            redirect: "follow",
+            signal: controller.signal
+          });
+          if (res.status >= 500) {
+            throw new FetchUnavailableError(url, new Error(`upstream ${res.status}`));
+          }
+          if (res.status >= 400) {
+            throw new FetchNotServedError(url, res.status);
+          }
+          return Buffer.from(await res.arrayBuffer());
+        } catch (error) {
+          const retryable = error instanceof FetchUnavailableError || !(error instanceof FetchNotServedError);
+          if (!retryable || attempt === policy.maxAttempts) {
+            if (error instanceof FetchUnavailableError || error instanceof FetchNotServedError) {
+              throw error;
+            }
+            throw new FetchUnavailableError(url, error);
           }
           await sleep(Math.random() * policy.baseDelayMs * 2 ** (attempt - 1));
         } finally {
@@ -456,15 +500,109 @@ var init_fetch_policy = __esm({
   }
 });
 
-// src/bundle.ts
+// src/net/font-proxy.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import path3 from "path";
-var ALLOWED_HOSTS, PIN_EXEMPT_HOSTS, FONT_UA, MIME, sha256, dataUri, assertAllowedRemote, cdnPlugin, importMapPlugin, inlineFontCss, localDataUri, LEAK_PATTERN, bundle;
+var ALLOWED_FONT_HOSTS, FONT_UA, UPSTREAM_TIMEOUT_MS, FONT_LINK_PATTERN, CSS_URL_PATTERN, proxyPathFor, PROXY_PATH_PREFIX, isLegacyCachedCss, rewriteFontLinks, allowedUrl, decodeProxyToken, rewriteCssFontRefs, typeFor, cacheFileFor, isBinaryEntry, CACHE_MAGIC, readCachedFont, writeCachedFont, proxyFontRequest;
+var init_font_proxy = __esm({
+  "src/net/font-proxy.ts"() {
+    "use strict";
+    ALLOWED_FONT_HOSTS = /* @__PURE__ */ new Set(["fonts.googleapis.com", "fonts.gstatic.com"]);
+    FONT_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0 Safari/537.36";
+    UPSTREAM_TIMEOUT_MS = 4e3;
+    FONT_LINK_PATTERN = /href="(https:\/\/(?:fonts\.googleapis\.com|fonts\.gstatic\.com)\/[^"]+)"/gu;
+    CSS_URL_PATTERN = /url\((https:\/\/[^)]+)\)/gu;
+    proxyPathFor = (url) => `/__frogoe/font/${Buffer.from(url, "utf-8").toString("base64url")}`;
+    PROXY_PATH_PREFIX = "/__frogoe/font/";
+    isLegacyCachedCss = (css) => css.includes(PROXY_PATH_PREFIX);
+    rewriteFontLinks = (html) => html.replaceAll(FONT_LINK_PATTERN, (_match, url) => `href="${proxyPathFor(url)}"`);
+    allowedUrl = (url) => {
+      try {
+        const parsed = new URL(url);
+        return parsed.protocol === "https:" && ALLOWED_FONT_HOSTS.has(parsed.hostname);
+      } catch {
+        return false;
+      }
+    };
+    decodeProxyToken = (token) => {
+      const url = Buffer.from(token, "base64url").toString("utf-8");
+      return allowedUrl(url) ? url : null;
+    };
+    rewriteCssFontRefs = (css) => css.replaceAll(
+      CSS_URL_PATTERN,
+      (match, url) => allowedUrl(url) ? `url(${proxyPathFor(url)})` : match
+    );
+    typeFor = (file) => file.endsWith(".css") ? "text/css; charset=utf-8" : "font/woff2";
+    cacheFileFor = (cacheDir, url) => {
+      const ext = url.includes("css2?") || url.endsWith(".css") ? ".css" : ".woff2";
+      return path3.join(cacheDir, createHash("sha256").update(url).digest("hex") + ext);
+    };
+    isBinaryEntry = (file) => file.endsWith(".woff2");
+    CACHE_MAGIC = Buffer.from("FROGOEF1");
+    readCachedFont = (url, cacheDir) => {
+      const file = cacheFileFor(cacheDir, url);
+      if (!existsSync3(file)) return null;
+      const raw = readFileSync3(file);
+      if (isBinaryEntry(file)) {
+        if (raw.length < CACHE_MAGIC.length || !raw.subarray(0, CACHE_MAGIC.length).equals(CACHE_MAGIC)) {
+          return null;
+        }
+        return raw.subarray(CACHE_MAGIC.length);
+      }
+      return raw;
+    };
+    writeCachedFont = (url, cacheDir, body) => {
+      const file = cacheFileFor(cacheDir, url);
+      mkdirSync3(cacheDir, { recursive: true });
+      writeFileSync3(file, isBinaryEntry(file) ? Buffer.concat([CACHE_MAGIC, Buffer.from(body)]) : body);
+      return file;
+    };
+    proxyFontRequest = async (url, cacheDir, fetchImpl = fetch) => {
+      if (!allowedUrl(url)) {
+        return { body: "", contentType: "text/plain; charset=utf-8", fromCache: false, status: 403 };
+      }
+      const cachePath = cacheFileFor(cacheDir, url);
+      const isCss = cachePath.endsWith(".css");
+      const raw = readCachedFont(url, cacheDir);
+      if (raw !== null && !(isCss && isLegacyCachedCss(raw.toString("utf-8")))) {
+        const body = isCss ? rewriteCssFontRefs(raw.toString("utf-8")) : raw;
+        return { body, cachePath, contentType: typeFor(cachePath), fromCache: true, status: 200 };
+      }
+      try {
+        const res = await fetchImpl(url, {
+          headers: { "user-agent": FONT_UA },
+          signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS)
+        });
+        if (!res.ok) {
+          return {
+            body: "",
+            contentType: typeFor(cachePath),
+            fromCache: false,
+            status: 502
+          };
+        }
+        const rawBody = Buffer.from(await res.arrayBuffer());
+        writeCachedFont(url, cacheDir, rawBody);
+        const body = isCss ? rewriteCssFontRefs(rawBody.toString("utf-8")) : rawBody;
+        return { body, cachePath, contentType: typeFor(cachePath), fromCache: false, status: 200 };
+      } catch {
+        return { body: "", contentType: typeFor(cachePath), fromCache: false, status: 504 };
+      }
+    };
+  }
+});
+
+// src/bundle.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import path4 from "path";
+var ALLOWED_HOSTS, PIN_EXEMPT_HOSTS, MIME, sha256, dataUri, assertAllowedRemote, cdnPlugin, importMapPlugin, inlineFontCss, localDataUri, LEAK_PATTERN, bundle;
 var init_bundle = __esm({
   "src/bundle.ts"() {
     "use strict";
     init_fetch_policy();
+    init_font_proxy();
     ALLOWED_HOSTS = /* @__PURE__ */ new Set([
       "cdn.jsdelivr.net",
       "esm.sh",
@@ -478,7 +616,6 @@ var init_bundle = __esm({
       "fonts.googleapis.test",
       "fonts.gstatic.test"
     ]);
-    FONT_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0 Safari/537.36";
     MIME = {
       gif: "image/gif",
       jpeg: "image/jpeg",
@@ -491,7 +628,7 @@ var init_bundle = __esm({
       webp: "image/webp",
       woff2: "font/woff2"
     };
-    sha256 = (data) => createHash("sha256").update(data).digest("hex");
+    sha256 = (data) => createHash2("sha256").update(data).digest("hex");
     dataUri = (mime, body) => {
       const base64 = Buffer.from(body, "binary").toString("base64");
       return `data:${mime};base64,${base64}`;
@@ -551,16 +688,34 @@ var init_bundle = __esm({
             if (/^https?:\/\//.test(target)) {
               return { namespace: "frogoe-cdn", path: target };
             }
-            return { path: path3.resolve(dir, target) };
+            return { path: path4.resolve(dir, target) };
           });
         }
       }
     });
     inlineFontCss = async (cssUrl, options, assets) => {
-      const css = await fetchWithPolicy(cssUrl, {
-        fetchImpl: options.fetchImpl,
-        headers: { "user-agent": FONT_UA }
-      });
+      const cacheDir = path4.join(path4.resolve(options.dir), ".frogoe", "font-cache");
+      const fontFetchError = (url, cause) => new Error(
+        `bundle/font-unreachable \u2014 ${url} (${cause instanceof Error ? cause.message : String(cause)})
+No local cache for it and the network failed \u2014 retry when the network recovers,
+or run \`frogoe check <game>\` once first: it warms the shared font cache the bundler reads.`,
+        { cause: cause instanceof Error ? cause : void 0 }
+      );
+      let css;
+      const cachedCss = readCachedFont(cssUrl, cacheDir);
+      if (cachedCss !== null) {
+        css = cachedCss.toString("utf-8");
+      } else {
+        try {
+          css = await fetchWithPolicy(cssUrl, {
+            fetchImpl: options.fetchImpl,
+            headers: { "user-agent": FONT_UA }
+          });
+        } catch (error) {
+          throw fontFetchError(cssUrl, error);
+        }
+        writeCachedFont(cssUrl, cacheDir, css);
+      }
       assets.push({
         bytes: css.length,
         kind: "css",
@@ -574,8 +729,21 @@ var init_bundle = __esm({
           return cached2;
         }
         assertAllowedRemote(url, options.extraAllowedHosts);
-        const res = options.fetchImpl ? await options.fetchImpl(url, { headers: { "user-agent": FONT_UA } }) : await fetch(url, { headers: { "user-agent": FONT_UA } });
-        const buffer = Buffer.from(await res.arrayBuffer());
+        let buffer;
+        const raw2 = readCachedFont(url, cacheDir);
+        if (raw2 !== null) {
+          buffer = raw2;
+        } else {
+          try {
+            buffer = await fetchBufferWithPolicy(url, {
+              fetchImpl: options.fetchImpl,
+              headers: { "user-agent": FONT_UA }
+            });
+            writeCachedFont(url, cacheDir, buffer);
+          } catch (error) {
+            throw fontFetchError(url, error);
+          }
+        }
         const uri = `data:font/woff2;base64,${buffer.toString("base64")}`;
         seen.set(url, uri);
         assets.push({
@@ -586,6 +754,18 @@ var init_bundle = __esm({
         });
         return uri;
       };
+      let raw = css;
+      for (const match of css.matchAll(/url\((\/__frogoe\/font\/[A-Za-z0-9_-]+)\)/gu)) {
+        const ref = match[1] ?? "";
+        const decoded = ref === "" ? null : decodeProxyToken(ref.slice(PROXY_PATH_PREFIX.length));
+        if (decoded !== null) {
+          raw = raw.replaceAll(ref, decoded);
+        }
+      }
+      if (raw !== css) {
+        writeCachedFont(cssUrl, cacheDir, raw);
+        css = raw;
+      }
       let out = css;
       const urls = [...css.matchAll(/url\((https:\/\/[^)]+)\)/gu)].map((m) => m[1] ?? "");
       for (const url of urls) {
@@ -596,25 +776,25 @@ var init_bundle = __esm({
       return out;
     };
     localDataUri = (dir, href) => {
-      const file = path3.resolve(dir, href.replace(/^\.\//u, ""));
-      if (!existsSync3(file)) {
+      const file = path4.resolve(dir, href.replace(/^\.\//u, ""));
+      if (!existsSync4(file)) {
         throw new Error(`bundle/missing-asset: ${href} not found in the game folder`);
       }
-      const ext = path3.extname(file).slice(1).toLowerCase();
+      const ext = path4.extname(file).slice(1).toLowerCase();
       const mime = MIME[ext];
       if (!mime) {
         throw new Error(`bundle/unsupported-asset: .${ext} (${href})`);
       }
-      return dataUri(mime, readFileSync3(file, "binary"));
+      return dataUri(mime, readFileSync4(file, "binary"));
     };
     LEAK_PATTERN = /(?:src|href)\s*=\s*"(https?:\/\/[^"]+)"/gi;
     bundle = async (options) => {
-      const dir = path3.resolve(options.dir);
-      const indexPath = path3.join(dir, "index.html");
-      if (!existsSync3(indexPath)) {
+      const dir = path4.resolve(options.dir);
+      const indexPath = path4.join(dir, "index.html");
+      if (!existsSync4(indexPath)) {
         throw new Error("frogoe bundle: no index.html \u2014 run from a game folder");
       }
-      const html = readFileSync3(indexPath, "utf-8");
+      const html = readFileSync4(indexPath, "utf-8");
       const assets = [];
       const warnings = [];
       let out = html;
@@ -633,7 +813,7 @@ var init_bundle = __esm({
         const { build } = await import("esbuild");
         const result = await build({
           bundle: true,
-          entryPoints: [path3.resolve(dir, entryMatch[1])],
+          entryPoints: [path4.resolve(dir, entryMatch[1])],
           format: "esm",
           logLevel: "silent",
           plugins: [importMapPlugin(dir, imports), cdnPlugin(options, assets)],
@@ -661,7 +841,7 @@ ${bundled}
 ${css}
 </style>`;
         } else {
-          const css = readFileSync3(path3.resolve(dir, href), "utf-8");
+          const css = readFileSync4(path4.resolve(dir, href), "utf-8");
           replacement = `<style>
 ${css}
 </style>`;
@@ -676,7 +856,7 @@ ${css}
         if (href.endsWith(".js") && entryMatch?.[1] === href) {
           continue;
         }
-        if (existsSync3(path3.resolve(dir, href))) {
+        if (existsSync4(path4.resolve(dir, href))) {
           out = out.replaceAll(href, localDataUri(dir, href));
         }
       }
@@ -708,10 +888,22 @@ ${css}
 });
 
 // ../lint/src/brief.ts
-var KEY_PATTERN, WS, stripComment, parseLine, parseBrief;
+var VERBS, SESSIONS, KEY_PATTERN, WS, stripComment, parseLine, parseBrief;
 var init_brief = __esm({
   "../lint/src/brief.ts"() {
     "use strict";
+    VERBS = [
+      "aim",
+      "draw",
+      "hold",
+      "idle",
+      "place",
+      "steer",
+      "swap",
+      "tap",
+      "type"
+    ];
+    SESSIONS = ["blitz", "round", "toy"];
     KEY_PATTERN = /^[a-z-]+$/u;
     WS = /\s/u;
     stripComment = (value) => {
@@ -767,8 +959,8 @@ var init_brief = __esm({
 });
 
 // ../lint/src/art.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import path4 from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import path5 from "path";
 var SPECS, MIN_DRAW_CALLS, DRAW_CALL, SPRITE_CALL, checkArt, checkScene, hexColorsOf, stripComments;
 var init_art = __esm({
   "../lint/src/art.ts"() {
@@ -782,16 +974,16 @@ var init_art = __esm({
     DRAW_CALL = /(?:fillRect|strokeRect|clearRect|beginPath|closePath|arc|ellipse|moveTo|lineTo|quadraticCurveTo|bezierCurveTo|fillText|strokeText|drawImage|roundRect|fill|stroke)\s*\(/gu;
     SPRITE_CALL = /\bdraw[A-Z]\w*\s*\(/gu;
     checkArt = (dir, findings) => {
-      const briefPath = path4.join(dir, "BRIEF.md");
-      const brief = existsSync4(briefPath) ? parseBrief(readFileSync4(briefPath, "utf-8")) : void 0;
+      const briefPath = path5.join(dir, "BRIEF.md");
+      const brief = existsSync5(briefPath) ? parseBrief(readFileSync5(briefPath, "utf-8")) : void 0;
       const briefFonts = (brief?.fonts ?? "").split(",").map((token) => token.trim().toLowerCase()).filter((token) => token.length > 0);
-      const gamePath = path4.join(dir, "game.js");
-      const gameSource = existsSync4(gamePath) ? readFileSync4(gamePath, "utf-8") : "";
+      const gamePath = path5.join(dir, "game.js");
+      const gameSource = existsSync5(gamePath) ? readFileSync5(gamePath, "utf-8") : "";
       const gameColors = hexColorsOf(stripComments(gameSource));
-      const htmlSource = existsSync4(path4.join(dir, "index.html")) ? readFileSync4(path4.join(dir, "index.html"), "utf-8") : "";
+      const htmlSource = existsSync5(path5.join(dir, "index.html")) ? readFileSync5(path5.join(dir, "index.html"), "utf-8") : "";
       for (const spec of SPECS) {
-        const scenePath = path4.join(dir, spec.file);
-        if (!existsSync4(scenePath)) {
+        const scenePath = path5.join(dir, spec.file);
+        if (!existsSync5(scenePath)) {
           findings.push({
             code: "art/missing",
             file: spec.file,
@@ -802,7 +994,7 @@ var init_art = __esm({
           });
           continue;
         }
-        const source = stripComments(readFileSync4(scenePath, "utf-8"));
+        const source = stripComments(readFileSync5(scenePath, "utf-8"));
         checkScene(source, spec, gameColors, briefFonts, htmlSource, findings);
       }
     };
@@ -963,19 +1155,47 @@ var init_contrast = __esm({
 });
 
 // ../lint/src/check.ts
-import { existsSync as existsSync5, readdirSync, readFileSync as readFileSync5 } from "fs";
-import path5 from "path";
-var VERBS, read, linesOf, findLine, checkBrief, checkFolder, checkPin, checkProject;
+import { existsSync as existsSync6, readdirSync, readFileSync as readFileSync6 } from "fs";
+import path6 from "path";
+var HANDLER_PATTERNS, VERB_REQUIREMENTS, read, linesOf, findLine, checkBrief, checkFolder, checkPin, checkProject;
 var init_check = __esm({
   "../lint/src/check.ts"() {
     "use strict";
     init_brief();
     init_contrast();
     init_art();
-    VERBS = /* @__PURE__ */ new Set(["tap", "hold", "steer", "aim"]);
+    HANDLER_PATTERNS = {
+      down: /input\.on\(\s*["']down["']/u,
+      drag: /input\.on\(\s*["']drag["']/u,
+      up: /input\.on\(\s*["']up["']/u
+    };
+    VERB_REQUIREMENTS = {
+      aim: [
+        { label: 'input.on("down"', pattern: HANDLER_PATTERNS.down },
+        { label: 'input.on("drag"', pattern: HANDLER_PATTERNS.drag }
+      ],
+      draw: [
+        { label: 'input.on("down"', pattern: HANDLER_PATTERNS.down },
+        { label: 'input.on("drag"', pattern: HANDLER_PATTERNS.drag },
+        { label: 'input.on("up"', pattern: HANDLER_PATTERNS.up }
+      ],
+      hold: [
+        { label: 'input.on("down"', pattern: HANDLER_PATTERNS.down },
+        { label: 'input.on("up"', pattern: HANDLER_PATTERNS.up }
+      ],
+      idle: [{ label: 'input.on("down"', pattern: HANDLER_PATTERNS.down }],
+      place: [{ label: 'input.on("down"', pattern: HANDLER_PATTERNS.down }],
+      steer: [
+        { label: 'input.on("down"', pattern: HANDLER_PATTERNS.down },
+        { label: 'input.on("drag"', pattern: HANDLER_PATTERNS.drag }
+      ],
+      swap: [{ label: 'input.on("down"', pattern: HANDLER_PATTERNS.down }],
+      tap: [{ label: 'input.on("down"', pattern: HANDLER_PATTERNS.down }],
+      type: [{ label: 'input.on("down"', pattern: HANDLER_PATTERNS.down }]
+    };
     read = (file) => {
       try {
-        return readFileSync5(file, "utf-8");
+        return readFileSync6(file, "utf-8");
       } catch {
         return "";
       }
@@ -986,8 +1206,8 @@ var init_check = __esm({
       return idx === -1 ? void 0 : idx + 1;
     };
     checkBrief = (dir, findings) => {
-      const file = path5.join(dir, "BRIEF.md");
-      if (!existsSync5(file)) {
+      const file = path6.join(dir, "BRIEF.md");
+      if (!existsSync6(file)) {
         findings.push({
           code: "brief/missing",
           file: "BRIEF.md",
@@ -995,7 +1215,7 @@ var init_check = __esm({
           message: "feed games declare intent before code",
           severity: "error"
         });
-        return;
+        return null;
       }
       const source = read(file);
       const todoLine = findLine(source, /TODO/u);
@@ -1018,14 +1238,32 @@ var init_check = __esm({
           message: "no frontmatter block found",
           severity: "error"
         });
-        return;
+        return null;
+      }
+      if (brief.verb !== void 0 && !VERBS.includes(brief.verb)) {
+        findings.push({
+          code: "brief/verb",
+          file: "BRIEF.md",
+          fix: `verb "${brief.verb}" is not in the enum (${VERBS.join("|")}) \u2014 pick the ONE word that names the core action (frogoe-core \u2192 brief-format)`,
+          message: "unknown core verb",
+          severity: "error"
+        });
+      }
+      if (brief.session !== void 0 && !SESSIONS.includes(brief.session)) {
+        findings.push({
+          code: "brief/session",
+          file: "BRIEF.md",
+          fix: `session "${brief.session}" is not in the enum (${SESSIONS.join("|")}) \u2014 blitz is the short arcade loop (default), round is turn-based, toy never ends (frogoe-core \u2192 brief-format)`,
+          message: "unknown session shape",
+          severity: "error"
+        });
       }
       const problems = [];
       if (!brief.title || brief.title.length < 2 || brief.title.length > 40) {
         problems.push("title (2\u201340 chars)");
       }
-      if (!brief.verb || !VERBS.has(brief.verb)) {
-        problems.push("verb \u2208 tap|hold|steer|aim");
+      if (!brief.verb || !VERBS.includes(brief.verb)) {
+        problems.push(`verb (${VERBS.join("|")})`);
       }
       if (!brief.mood) {
         problems.push("mood (one phrase)");
@@ -1068,9 +1306,10 @@ var init_check = __esm({
           });
         }
       }
+      return brief;
     };
-    checkFolder = (dir, findings) => {
-      const index = read(path5.join(dir, "index.html"));
+    checkFolder = (dir, findings, brief) => {
+      const index = read(path6.join(dir, "index.html"));
       if (!index) {
         findings.push({
           code: "folder/index-missing",
@@ -1140,7 +1379,7 @@ var init_check = __esm({
           });
         }
       }
-      const game = read(path5.join(dir, "game.js"));
+      const game = read(path6.join(dir, "game.js"));
       if (!game) {
         findings.push({
           code: "folder/game-missing",
@@ -1169,6 +1408,21 @@ var init_check = __esm({
           severity: "warning"
         });
       }
+      const requirements = brief?.verb !== void 0 ? VERB_REQUIREMENTS[brief.verb] : void 0;
+      if (requirements !== void 0) {
+        const missing = requirements.filter((req) => !req.pattern.test(game));
+        if (missing.length > 0) {
+          findings.push({
+            code: "input/verb-mismatch",
+            file: "game.js",
+            fix: `verb "${String(brief?.verb)}" requires ${missing.map((m) => m.label).join(" + ")} \u2014 wire it inside defineGame (frogoe-core \u2192 brief-format, verb table)`,
+            line: findLine(game, HANDLER_PATTERNS.down) ?? void 0,
+            message: `declared verb "${String(brief?.verb)}" but its input wiring is missing`,
+            recipe: "frogoe-core \u2192 brief-format (verb \u2192 handler table)",
+            severity: "error"
+          });
+        }
+      }
       const gameLine = (pattern) => findLine(game, pattern);
       const dragLine = gameLine(/\+=\s*(?:p|pt|pointer)\.(?:dx|dy)\b/u);
       if (dragLine !== void 0) {
@@ -1218,12 +1472,12 @@ var init_check = __esm({
           severity: "warning"
         });
       }
-      const blocksDir = path5.join(dir, "blocks");
+      const blocksDir = path6.join(dir, "blocks");
       let markup = index;
-      if (existsSync5(blocksDir)) {
+      if (existsSync6(blocksDir)) {
         for (const f of readdirSync(blocksDir)) {
           if (f.endsWith(".html")) {
-            markup += read(path5.join(blocksDir, f));
+            markup += read(path6.join(blocksDir, f));
           }
         }
       }
@@ -1243,8 +1497,8 @@ var init_check = __esm({
       }
     };
     checkPin = (dir, findings) => {
-      const pinFile = path5.join(dir, "frogoe.json");
-      if (!existsSync5(pinFile)) {
+      const pinFile = path6.join(dir, "frogoe.json");
+      if (!existsSync6(pinFile)) {
         findings.push({
           code: "folder/contract-pin",
           file: "frogoe.json",
@@ -1259,7 +1513,7 @@ var init_check = __esm({
         pin = String(JSON.parse(read(pinFile)).contract ?? "");
       } catch {
       }
-      const contract = read(path5.join(dir, ".frogoe/contract.js"));
+      const contract = read(path6.join(dir, ".frogoe/contract.js"));
       const marker = /frogoe contract v([\d.]+)/u.exec(contract.slice(0, 400));
       if (!contract) {
         findings.push({
@@ -1282,8 +1536,8 @@ var init_check = __esm({
     checkProject = (dir) => {
       const findings = [];
       checkArt(dir, findings);
-      checkBrief(dir, findings);
-      checkFolder(dir, findings);
+      const brief = checkBrief(dir, findings);
+      checkFolder(dir, findings, brief);
       checkPin(dir, findings);
       findings.sort((a, b) => a.file.localeCompare(b.file) || (a.line ?? 0) - (b.line ?? 0));
       return {
@@ -1307,28 +1561,28 @@ var init_src = __esm({
 });
 
 // src/runtime-source.ts
-import { readFileSync as readFileSync6 } from "fs";
-import path6 from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import path7 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var here2, cached, runtimeSource, functions, runtimeFunctions;
 var init_runtime_source = __esm({
   "src/runtime-source.ts"() {
     "use strict";
-    here2 = path6.dirname(fileURLToPath2(import.meta.url));
+    here2 = path7.dirname(fileURLToPath2(import.meta.url));
     cached = null;
     runtimeSource = () => {
       if (cached !== null) return cached;
       const candidates = [
-        path6.join(here2, "injected-runtime.js"),
+        path7.join(here2, "injected-runtime.js"),
         // source mode (src/ dir)
-        path6.join(here2, "dist", "injected-runtime.js"),
+        path7.join(here2, "dist", "injected-runtime.js"),
         // dist mode
-        path6.join(here2, "..", "dist", "injected-runtime.js")
+        path7.join(here2, "..", "dist", "injected-runtime.js")
         // dist/cli.js sibling
       ];
       for (const p of candidates) {
         try {
-          cached = readFileSync6(p, "utf-8");
+          cached = readFileSync7(p, "utf-8");
           return cached;
         } catch {
         }
@@ -1586,34 +1840,623 @@ var init_art_verify = __esm({
   }
 });
 
-// src/browser.ts
-import path7 from "path";
-var browserPath, ensureBrowser;
-var init_browser = __esm({
-  "src/browser.ts"() {
+// src/net/tunnel.ts
+import { spawn, spawnSync } from "child_process";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, chmodSync, writeFileSync as writeFileSync4 } from "fs";
+import os from "os";
+import path8 from "path";
+import { gunzipSync } from "zlib";
+var URL_PATTERN, parseTunnelUrl, TAG_PATTERN, assertSafeTag, octalAt, extractSingleFile, ENV_PIN, assetName, binaryFileName, cacheBase, resolveLatestTag, mb, downloadWithProgress, binaryEchoes, resolveBinary, startTunnel;
+var init_tunnel = __esm({
+  "src/net/tunnel.ts"() {
     "use strict";
-    ensureBrowser = async () => {
-      if (browserPath) {
-        return browserPath;
-      }
-      const { Browser, getInstalledBrowsers, install } = await import("@puppeteer/browsers");
-      const cacheDir = path7.resolve(process.cwd(), "node_modules/.frogoe-browser");
-      const installed = await getInstalledBrowsers({ cacheDir });
-      const existing = installed.find((b) => b.browser === Browser.CHROMEHEADLESSSHELL);
-      browserPath = existing?.executablePath ?? (await install({
+    URL_PATTERN = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/iu;
+    parseTunnelUrl = (chunk) => URL_PATTERN.exec(chunk)?.[0];
+    TAG_PATTERN = /^\d{4}\.\d+\.\d+(-[A-Za-z0-9.]+)?$/u;
+    assertSafeTag = (tag) => {
+      if (!TAG_PATTERN.test(tag)) {
+        throw new Error(
+          `cloudflared version "${tag}" is not a valid release tag (expected e.g. 2025.10.1)`
+        );
+      }
+      return tag;
+    };
+    octalAt = (block, offset, length) => {
+      const raw = block.subarray(offset, offset + length).toString("utf-8");
+      const digits = raw.replace(/[\0 ]/gu, "");
+      return digits.length === 0 ? 0 : Number.parseInt(digits, 8);
+    };
+    extractSingleFile = (tar, wanted) => {
+      for (let offset = 0; offset + 512 <= tar.length; ) {
+        const header = tar.subarray(offset, offset + 512);
+        const name = header.subarray(0, 100).toString("utf-8").replace(/\0.*$/u, "");
+        const size = octalAt(header, 124, 12);
+        const type = header.toString("utf-8").charCodeAt(156);
+        const dataStart = offset + 512;
+        const dataEnd = dataStart + size;
+        if (dataEnd > tar.length) return null;
+        if (name === wanted && (type === 48 || type === 0)) {
+          return tar.subarray(dataStart, dataEnd);
+        }
+        offset = dataStart + Math.ceil(size / 512) * 512;
+      }
+      return null;
+    };
+    ENV_PIN = "FROGOE_CLOUDFLARED_VERSION";
+    assetName = (platform, arch) => {
+      const a = arch === "arm64" ? "arm64" : arch === "x64" ? "amd64" : arch === "ia32" ? "386" : null;
+      if (!a) return null;
+      switch (platform) {
+        case "darwin":
+          return a === "386" ? null : `cloudflared-darwin-${a}.tgz`;
+        case "linux":
+          return `cloudflared-linux-${a}`;
+        // bare binaries
+        case "win32":
+          return a === "arm64" ? null : `cloudflared-windows-${a}.exe`;
+        // bare executables
+        default:
+          return null;
+      }
+    };
+    binaryFileName = (platform) => platform === "win32" ? "cloudflared.exe" : "cloudflared";
+    cacheBase = (platform, env, home) => {
+      if (platform === "darwin") return path8.join(home, "Library", "Caches");
+      if (platform === "win32") return env.LOCALAPPDATA ?? path8.join(home, "AppData", "Local");
+      return path8.join(home, ".cache");
+    };
+    resolveLatestTag = async () => {
+      const res = await fetch("https://api.github.com/repos/cloudflare/cloudflared/releases/latest", {
+        headers: { accept: "application/vnd.github+json" }
+      });
+      if (!res.ok) throw new Error(`github api ${res.status}`);
+      const body = await res.json();
+      if (!body.tag_name) throw new Error("github api returned no tag_name");
+      return body.tag_name;
+    };
+    mb = (bytes) => (bytes / (1024 * 1024)).toFixed(0);
+    downloadWithProgress = async (res, onChunk) => {
+      const total = Number(res.headers.get("content-length") ?? 0);
+      const reader = res.body?.getReader();
+      if (!reader) return Buffer.from(await res.arrayBuffer());
+      const chunks = [];
+      let done = 0;
+      let nextReport = 0;
+      for (; ; ) {
+        const step = await reader.read();
+        if (step.done) break;
+        chunks.push(Buffer.from(step.value));
+        done += step.value.byteLength;
+        if (done >= nextReport) {
+          onChunk(done, total);
+          nextReport = done + 5 * 1024 * 1024;
+        }
+      }
+      return Buffer.concat(chunks);
+    };
+    binaryEchoes = (bin, tag) => {
+      try {
+        const probe = spawnSync(bin, ["--version"], { encoding: "utf-8", timeout: 1e4 });
+        const out = `${probe.stdout ?? ""}${probe.stderr ?? ""}`;
+        return probe.status === 0 && out.includes(tag);
+      } catch {
+        return false;
+      }
+    };
+    resolveBinary = async (onProgress) => {
+      const pathProbe = spawnSync("cloudflared", ["--version"], { stdio: "ignore", timeout: 5e3 });
+      if (pathProbe.status === 0) return { downloaded: false, path: "cloudflared" };
+      const platform = process.platform;
+      const asset = assetName(platform, process.arch);
+      if (!asset) {
+        throw new Error(
+          `cloudflared publishes no build for ${platform}/${process.arch} \u2014 install it and put \`cloudflared\` on PATH`
+        );
+      }
+      const tag = process.env[ENV_PIN] ? assertSafeTag(process.env[ENV_PIN]) : assertSafeTag(await resolveLatestTag());
+      const root = path8.join(cacheBase(platform, process.env, os.homedir()), "frogoe", "cloudflared");
+      const dir = path8.join(root, tag);
+      const bin = path8.join(dir, binaryFileName(platform));
+      const rootResolved = path8.resolve(root);
+      const binResolved = path8.resolve(bin);
+      if (!binResolved.startsWith(rootResolved + path8.sep)) {
+        throw new Error("cloudflared binary path escaped the frogoe cache \u2014 refusing to execute");
+      }
+      if (existsSync7(bin) && binaryEchoes(bin, tag)) return { downloaded: false, path: bin };
+      onProgress?.(`downloading cloudflared ${tag} (~25 MB, once)\u2026`);
+      const res = await fetch(
+        `https://github.com/cloudflare/cloudflared/releases/download/${tag}/${asset}`
+      );
+      if (!res.ok) throw new Error(`cloudflared ${tag} download failed (${res.status})`);
+      const raw = await downloadWithProgress(res, (done, total) => {
+        onProgress?.(`downloading cloudflared ${tag} \u2014 ${mb(done)}${total ? `/${mb(total)}` : ""} MB`);
+      });
+      const binary = asset.endsWith(".tgz") ? extractSingleFile(gunzipSync(raw), "cloudflared") : raw;
+      if (!binary) throw new Error("cloudflared archive did not contain the binary");
+      mkdirSync4(dir, { recursive: true });
+      writeFileSync4(bin, binary);
+      if (platform !== "win32") chmodSync(bin, 493);
+      if (!binaryEchoes(bin, tag)) {
+        throw new Error(
+          `cloudflared ${tag} failed its version check \u2014 deleted; set ${ENV_PIN} or install via brew`
+        );
+      }
+      return { downloaded: true, path: bin };
+    };
+    startTunnel = async (port, options) => {
+      const timeoutMs = options?.timeoutMs ?? 2e4;
+      const bin = await resolveBinary(options?.onProgress);
+      return new Promise((resolve2, reject) => {
+        const child = spawn(
+          bin.path,
+          ["tunnel", "--url", `http://localhost:${port}`, "--no-autoupdate"],
+          {
+            detached: true,
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true
+          }
+        );
+        let settled = false;
+        let url;
+        let buffer = "";
+        const exited = new Promise((notify) => {
+          child.once("exit", () => notify());
+        });
+        const killTree = () => {
+          if (process.platform === "win32" || !child.pid) {
+            child.kill("SIGTERM");
+            return;
+          }
+          try {
+            process.kill(-child.pid, "SIGTERM");
+          } catch {
+            child.kill("SIGTERM");
+          }
+        };
+        const finish = (error) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          if (error || !url) {
+            killTree();
+            const tail = buffer.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean).slice(-2).join(" | ");
+            const base = error?.message ?? "frogoe tunnel: cloudflared exited before producing a URL";
+            reject(new Error(tail ? `${base} \u2014 ${tail}` : base));
+            return;
+          }
+          resolve2({ exited, stop: killTree, url });
+        };
+        const timer = setTimeout(() => {
+          finish(
+            new Error(
+              `frogoe tunnel: no URL from cloudflared within ${timeoutMs / 1e3}s \u2014 check your internet, or brew install cloudflared`
+            )
+          );
+        }, timeoutMs);
+        child.once("exit", (code) => {
+          if (!settled) {
+            finish(new Error(`frogoe tunnel: cloudflared exited early (code ${code ?? "signal"})`));
+          }
+        });
+        const watch2 = (stream) => {
+          stream.on("data", (data) => {
+            if (settled && url) return;
+            buffer += data.toString("utf-8");
+            const found = parseTunnelUrl(buffer);
+            if (found && !url) {
+              url = found;
+              finish();
+            }
+          });
+        };
+        if (child.stderr && child.stdout) {
+          watch2(child.stderr);
+          watch2(child.stdout);
+        }
+      });
+    };
+  }
+});
+
+// src/browser/lock.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, rmSync, statSync, utimesSync } from "fs";
+import path9 from "path";
+var DEFAULT_LOCK_TIMINGS, LOCK_DIR_NAME, RECLAIM_DIR_NAME, isErrno, sleep2, tryAcquireDirLock, isDirLockStale, touch, reclaimStaleLock, withInstallLock;
+var init_lock = __esm({
+  "src/browser/lock.ts"() {
+    "use strict";
+    DEFAULT_LOCK_TIMINGS = {
+      heartbeatMs: 15e3,
+      pollMs: 200,
+      staleMs: 12e4,
+      waitNoticeMs: 1e4
+    };
+    LOCK_DIR_NAME = ".chrome.install.lock";
+    RECLAIM_DIR_NAME = ".chrome.install.reclaim.lock";
+    isErrno = (error, code) => {
+      if (typeof error === "object" && error !== null && "code" in error) {
+        return error.code === code;
+      }
+      return false;
+    };
+    sleep2 = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+    tryAcquireDirLock = (lockDir) => {
+      try {
+        mkdirSync5(lockDir, { recursive: false });
+        return true;
+      } catch (error) {
+        if (!isErrno(error, "EEXIST")) throw error;
+        return false;
+      }
+    };
+    isDirLockStale = (lockDir, staleMs) => {
+      try {
+        return Date.now() - statSync(lockDir).mtimeMs > staleMs;
+      } catch (error) {
+        if (isErrno(error, "ENOENT")) return false;
+        throw error;
+      }
+    };
+    touch = (lockDir) => {
+      try {
+        const now = /* @__PURE__ */ new Date();
+        utimesSync(lockDir, now, now);
+      } catch {
+      }
+    };
+    reclaimStaleLock = (lockDir, reclaimDir, staleMs) => {
+      if (!tryAcquireDirLock(reclaimDir)) return;
+      try {
+        if (isDirLockStale(lockDir, staleMs)) {
+          rmSync(lockDir, { recursive: true, force: true });
+        }
+      } finally {
+        rmSync(reclaimDir, { recursive: true, force: true });
+      }
+    };
+    withInstallLock = async (fn, rootDir, options) => {
+      const timings = options?.timings ?? DEFAULT_LOCK_TIMINGS;
+      const log = options?.log ?? ((line) => console.error(line));
+      const lockDir = path9.join(rootDir, LOCK_DIR_NAME);
+      const reclaimDir = path9.join(rootDir, RECLAIM_DIR_NAME);
+      if (!existsSync8(rootDir)) mkdirSync5(rootDir, { recursive: true });
+      let deadline = Date.now() + timings.staleMs;
+      const waitStart = Date.now();
+      let lastNoticeMs = 0;
+      for (; ; ) {
+        if (existsSync8(reclaimDir)) {
+          if (isDirLockStale(reclaimDir, timings.staleMs)) {
+            rmSync(reclaimDir, { recursive: true, force: true });
+          }
+          await sleep2(timings.pollMs);
+          continue;
+        }
+        if (tryAcquireDirLock(lockDir)) {
+          rmSync(reclaimDir, { recursive: true, force: true });
+          break;
+        }
+        const waitedMs = Date.now() - waitStart;
+        if (waitedMs - lastNoticeMs >= timings.waitNoticeMs) {
+          lastNoticeMs = waitedMs;
+          log(
+            `  browser: waiting for another frogoe process to finish installing chrome-headless-shell (${Math.round(waitedMs / 1e3)}s elapsed)\u2026`
+          );
+        }
+        if (isDirLockStale(lockDir, timings.staleMs) || Date.now() > deadline) {
+          reclaimStaleLock(lockDir, reclaimDir, timings.staleMs);
+          deadline = Date.now() + timings.staleMs;
+          continue;
+        }
+        await sleep2(timings.pollMs);
+      }
+      const heartbeat = setInterval(() => touch(lockDir), timings.heartbeatMs);
+      if (typeof heartbeat.unref === "function") heartbeat.unref();
+      try {
+        return await fn();
+      } finally {
+        clearInterval(heartbeat);
+        rmSync(lockDir, { recursive: true, force: true });
+      }
+    };
+  }
+});
+
+// src/browser/manager.ts
+import { cpSync as cpSync2, existsSync as existsSync9, mkdirSync as mkdirSync6, readdirSync as readdirSync2, renameSync, rmSync as rmSync2 } from "fs";
+import { homedir } from "os";
+import path10 from "path";
+var CHROME_BUILD, BROWSER_PATH_ENV, CACHE_ROOT, CACHE_DIR, ARCHIVE_CHECKSUMS, messageOf, positiveIntEnv, isCorruptInstallError, browserPathHintForPlatform, wrapDownloadFailure, isTimeoutError, wrapLaunchFailure, findInCache, legacyCacheDir, migrateLegacyCache, pruneLegacyCache, progressReporter, downloadBrowser, resolved, ensureBrowser;
+var init_manager = __esm({
+  "src/browser/manager.ts"() {
+    "use strict";
+    init_tunnel();
+    init_lock();
+    CHROME_BUILD = "131.0.6778.204";
+    BROWSER_PATH_ENV = "FROGOE_BROWSER_PATH";
+    CACHE_ROOT = path10.join(cacheBase(process.platform, process.env, homedir()), "frogoe");
+    CACHE_DIR = path10.join(CACHE_ROOT, "chrome");
+    ARCHIVE_CHECKSUMS = {
+      linux: "afaac86e302c4874245991a3d509d529c50ecdd447affff0cdc2b08520906c32",
+      mac: "933463c27a951d3fc153c408c4b8a96c89b9344379963f68a5ff9aa1718bcaf9",
+      mac_arm: "9dae11ffda8d77f92c56f64de84f81fa6781c9d41235a8e9397117d7d004a017",
+      win32: "e1a14441accf82785fd81b78d34d8faf5cc78bbab6b2f90fa7e7e972d93ed77f",
+      win64: "d45834686f461ef6f487c0eacc2063bc311a5de86e92de46600895bf44136714"
+    };
+    messageOf = (error) => {
+      if (error instanceof Error) return error.message;
+      if (typeof error === "string") return error;
+      return "";
+    };
+    positiveIntEnv = (name, raw, fallback) => {
+      if (raw === void 0 || raw.trim() === "") return fallback;
+      const trimmed = raw.trim();
+      if (!/^\d+$/u.test(trimmed) || Number.parseInt(trimmed, 10) <= 0) {
+        throw new Error(
+          `frogoe browser: ${name} must be a positive integer of milliseconds (got "${raw}") \u2014 unset it or fix the value, then re-run`
+        );
+      }
+      return Number.parseInt(trimmed, 10);
+    };
+    isCorruptInstallError = (error) => {
+      const message2 = messageOf(error).toLowerCase();
+      return message2.includes("end of central directory") || message2.includes("end-of-central-directory") || message2.includes("invalid or corrupt") || message2.includes("corrupt zip") || message2.includes("corrupted") || message2.includes("not a zip") || message2.includes("unexpected end of") || message2.includes("integrity check failed") || message2.includes("exists but the executable");
+    };
+    browserPathHintForPlatform = (platform) => {
+      if (platform === "darwin") return "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome";
+      if (platform === "win32") return "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe";
+      return "/usr/bin/google-chrome";
+    };
+    wrapDownloadFailure = (cause) => {
+      const original = messageOf(cause) || String(cause);
+      return new Error(
+        `frogoe browser: failed to download chrome-headless-shell ${CHROME_BUILD} \u2014 ${original}
+
+Point frogoe at an already-installed Chrome/Chromium instead:
+
+  export ${BROWSER_PATH_ENV}="${browserPathHintForPlatform(process.platform)}"
+
+Then re-run your command. Any Chrome build works for the sandbox; the pinned
+headless-shell re-downloads into ${CACHE_DIR} once the network allows.`,
+        { cause: cause instanceof Error ? cause : void 0 }
+      );
+    };
+    isTimeoutError = (error) => {
+      if (!(error instanceof Error)) return false;
+      return error.name === "TimeoutError" || /timed out \d+ ms/u.test(error.message);
+    };
+    wrapLaunchFailure = (cause, timeoutMs) => {
+      const head = isTimeoutError(cause) ? `frogoe browser: headless chrome did not start within ${String(timeoutMs)} ms.
+
+Raise the budget or point frogoe at an installed Chrome:
+
+  FROGOE_LAUNCH_TIMEOUT_MS=${String(timeoutMs * 2)} <your command>
+  export ${BROWSER_PATH_ENV}="${browserPathHintForPlatform(process.platform)}"
+` : `frogoe browser: headless chrome failed to launch \u2014 ${messageOf(cause) || String(cause)}
+
+If a local Chrome exists, point frogoe at it:
+
+  export ${BROWSER_PATH_ENV}="${browserPathHintForPlatform(process.platform)}"
+`;
+      return new Error(
+        `${head}
+Then re-run your command. (The pinned binary lives in ${CACHE_DIR} \u2014
+see skills/frogoe-cli \u2192 references/live-sandbox.md)`,
+        { cause: cause instanceof Error ? cause : void 0 }
+      );
+    };
+    findInCache = async (cacheDir, buildId) => {
+      if (!existsSync9(cacheDir)) return {};
+      const { Browser, detectBrowserPlatform, getInstalledBrowsers } = await import("@puppeteer/browsers");
+      const platform = detectBrowserPlatform();
+      const match = (await getInstalledBrowsers({ cacheDir })).find(
+        (entry) => entry.browser === Browser.CHROMEHEADLESSSHELL && entry.buildId === buildId && entry.platform === platform
+      );
+      if (!match) return {};
+      if (existsSync9(match.executablePath)) return { executablePath: match.executablePath };
+      return { staleInstallPath: match.path };
+    };
+    legacyCacheDir = (dir) => path10.resolve(dir, "node_modules", ".frogoe-browser");
+    migrateLegacyCache = async (legacyDir, cacheDir, buildId, log) => {
+      if (!existsSync9(legacyDir)) return null;
+      const { Browser, getInstalledBrowsers } = await import("@puppeteer/browsers");
+      const legacy = (await getInstalledBrowsers({ cacheDir: legacyDir })).find(
+        (entry) => entry.browser === Browser.CHROMEHEADLESSSHELL && entry.buildId === buildId && existsSync9(entry.executablePath)
+      );
+      if (!legacy) return null;
+      const browserRootName = path10.basename(path10.dirname(legacy.path));
+      const installName = path10.basename(legacy.path);
+      const destination = path10.join(cacheDir, browserRootName, installName);
+      mkdirSync6(path10.dirname(destination), { recursive: true });
+      rmSync2(destination, { recursive: true, force: true });
+      try {
+        try {
+          renameSync(legacy.path, destination);
+        } catch (error) {
+          if (!isErrno(error, "EXDEV")) throw error;
+          const staging = `${destination}.migrating-${String(process.pid)}`;
+          rmSync2(staging, { recursive: true, force: true });
+          try {
+            cpSync2(legacy.path, staging, { recursive: true });
+            renameSync(staging, destination);
+          } finally {
+            rmSync2(staging, { recursive: true, force: true });
+          }
+          rmSync2(legacy.path, { recursive: true, force: true });
+        }
+      } catch {
+        return null;
+      }
+      const found = await findInCache(cacheDir, buildId);
+      if (!found.executablePath) return null;
+      rmSync2(path10.dirname(legacy.path), { recursive: true, force: true });
+      rmSync2(legacyDir, { recursive: true, force: true });
+      log?.(`  browser: migrated the cached chrome-headless-shell into ${cacheDir} (one-time)`);
+      return found.executablePath;
+    };
+    pruneLegacyCache = (legacyDir, buildId) => {
+      if (!existsSync9(legacyDir)) return false;
+      try {
+        const browserRoot = path10.join(legacyDir, "chrome-headless-shell");
+        if (existsSync9(browserRoot)) {
+          const entries = readdirSync2(browserRoot);
+          if (entries.length > 0 && !entries.some((name) => name.endsWith(`-${buildId}`))) {
+            return false;
+          }
+        } else if (readdirSync2(legacyDir).length > 0) {
+          return false;
+        }
+        rmSync2(legacyDir, { recursive: true, force: true });
+        return true;
+      } catch {
+        return false;
+      }
+    };
+    progressReporter = () => {
+      const tty = process.stderr.isTTY === true;
+      const mb2 = (bytes) => (bytes / (1024 * 1024)).toFixed(1);
+      let lastPaintMs = 0;
+      let nextMilestone = 0.25;
+      return (downloaded, total) => {
+        if (tty) {
+          const finished = total > 0 && downloaded >= total;
+          if (Date.now() - lastPaintMs < 100 && !finished) return;
+          lastPaintMs = Date.now();
+          process.stderr.write(
+            `\r  browser: downloading chrome-headless-shell \u2014 ${mb2(downloaded)}${total > 0 ? `/${mb2(total)}` : ""} MB`
+          );
+          if (finished) process.stderr.write("\n");
+          return;
+        }
+        if (total <= 0 || downloaded / total < nextMilestone) return;
+        process.stderr.write(
+          `  browser: downloading chrome-headless-shell \u2014 ${Math.round(nextMilestone * 100)}% (${mb2(total)} MB)
+`
+        );
+        nextMilestone += 0.25;
+      };
+    };
+    downloadBrowser = async (log) => {
+      const { Browser, detectBrowserPlatform, install } = await import("@puppeteer/browsers");
+      const platform = detectBrowserPlatform();
+      if (!platform) {
+        throw wrapDownloadFailure(
+          new Error(`no chrome-headless-shell build exists for ${process.platform}/${process.arch}`)
+        );
+      }
+      const expectedHash = ARCHIVE_CHECKSUMS[platform];
+      if (expectedHash === void 0) {
+        log(
+          `  browser: no pinned checksum for ${platform} \u2014 downloading WITHOUT integrity verification`
+        );
+      }
+      const runInstall = () => install({
         browser: Browser.CHROMEHEADLESSSHELL,
-        buildId: "131.0.6778.204",
-        cacheDir,
-        unpack: true
-      })).executablePath;
-      return browserPath;
+        buildId: CHROME_BUILD,
+        cacheDir: CACHE_DIR,
+        unpack: true,
+        ...expectedHash === void 0 ? {} : { expectedHash },
+        downloadProgressCallback: progressReporter()
+      });
+      try {
+        return (await runInstall()).executablePath;
+      } catch (error) {
+        if (!isCorruptInstallError(error)) throw wrapDownloadFailure(error);
+        log("  browser: cached archive was corrupt \u2014 purging and retrying once\u2026");
+        rmSync2(CACHE_DIR, { recursive: true, force: true });
+        try {
+          return (await runInstall()).executablePath;
+        } catch (retryError) {
+          throw wrapDownloadFailure(retryError);
+        }
+      }
+    };
+    ensureBrowser = async (options) => {
+      if (resolved) return resolved;
+      const log = (line) => console.error(line);
+      const fromEnv = process.env[BROWSER_PATH_ENV]?.trim();
+      if (fromEnv !== void 0 && fromEnv !== "") {
+        if (!existsSync9(fromEnv)) {
+          throw new Error(
+            `frogoe browser: ${BROWSER_PATH_ENV} is set but "${fromEnv}" does not exist \u2014 fix the path or unset the variable, then re-run`
+          );
+        }
+        resolved = fromEnv;
+        return resolved;
+      }
+      const legacyDirs = options?.legacyDirs ?? [legacyCacheDir(process.cwd())];
+      const pre = await findInCache(CACHE_DIR, CHROME_BUILD);
+      if (pre.executablePath) {
+        resolved = pre.executablePath;
+      } else {
+        resolved = await withInstallLock(
+          async () => {
+            const post = await findInCache(CACHE_DIR, CHROME_BUILD);
+            if (post.executablePath) return post.executablePath;
+            if (post.staleInstallPath) {
+              log("  browser: incomplete install in the cache \u2014 purging before reinstalling\u2026");
+              rmSync2(post.staleInstallPath, { recursive: true, force: true });
+            }
+            for (const legacyDir of legacyDirs) {
+              const migrated = await migrateLegacyCache(legacyDir, CACHE_DIR, CHROME_BUILD, log);
+              if (migrated) return migrated;
+            }
+            return downloadBrowser(log);
+          },
+          CACHE_ROOT,
+          { log }
+        );
+      }
+      for (const legacyDir of legacyDirs) {
+        if (pruneLegacyCache(legacyDir, CHROME_BUILD)) {
+          log(`  browser: removed the superseded per-project cache at ${legacyDir}`);
+        }
+      }
+      return resolved;
+    };
+  }
+});
+
+// src/browser/launch.ts
+var LAUNCH_TIMEOUT_ENV, PROTOCOL_TIMEOUT_ENV, DEFAULT_LAUNCH_TIMEOUT_MS, DEFAULT_PROTOCOL_TIMEOUT_MS, launchBudgets, launchBrowser;
+var init_launch = __esm({
+  "src/browser/launch.ts"() {
+    "use strict";
+    init_manager();
+    LAUNCH_TIMEOUT_ENV = "FROGOE_LAUNCH_TIMEOUT_MS";
+    PROTOCOL_TIMEOUT_ENV = "FROGOE_PROTOCOL_TIMEOUT_MS";
+    DEFAULT_LAUNCH_TIMEOUT_MS = 12e4;
+    DEFAULT_PROTOCOL_TIMEOUT_MS = 3e5;
+    launchBudgets = (env = process.env) => ({
+      launchMs: positiveIntEnv(LAUNCH_TIMEOUT_ENV, env[LAUNCH_TIMEOUT_ENV], DEFAULT_LAUNCH_TIMEOUT_MS),
+      protocolMs: positiveIntEnv(
+        PROTOCOL_TIMEOUT_ENV,
+        env[PROTOCOL_TIMEOUT_ENV],
+        DEFAULT_PROTOCOL_TIMEOUT_MS
+      )
+    });
+    launchBrowser = async (options) => {
+      const { default: puppeteer } = await import("puppeteer-core");
+      const budgets = launchBudgets();
+      const executablePath = await ensureBrowser({ legacyDirs: options?.legacyDirs });
+      try {
+        return await puppeteer.launch({
+          args: ["--no-sandbox", "--disable-gpu"],
+          defaultViewport: options?.defaultViewport === void 0 ? null : options.defaultViewport,
+          executablePath,
+          headless: true,
+          protocolTimeout: budgets.protocolMs,
+          timeout: budgets.launchMs
+        });
+      } catch (error) {
+        throw wrapLaunchFailure(error, budgets.launchMs);
+      }
     };
   }
 });
 
 // src/net/ip.ts
 import { execSync } from "child_process";
-import os from "os";
+import os2 from "os";
 var VIRTUAL, isPrivateV4, isLoopback, selfAddresses, pickLanIp, interfaceFromRouteOutput, ROUTE_PROBES, routedInterfaceName, resolveLan;
 var init_ip = __esm({
   "src/net/ip.ts"() {
@@ -1713,7 +2556,7 @@ var init_ip = __esm({
       }
       return null;
     };
-    resolveLan = () => pickLanIp(os.networkInterfaces(), routedInterfaceName());
+    resolveLan = () => pickLanIp(os2.networkInterfaces(), routedInterfaceName());
   }
 });
 
@@ -1832,8 +2675,8 @@ var init_records = __esm({
 });
 
 // src/telemetry/session.ts
-import { appendFileSync, mkdirSync as mkdirSync3, readdirSync as readdirSync2 } from "fs";
-import path8 from "path";
+import { appendFileSync, mkdirSync as mkdirSync7, readdirSync as readdirSync3 } from "fs";
+import path11 from "path";
 var pad, sessionStamp, createSessionStore, latestSessionFile;
 var init_session = __esm({
   "src/telemetry/session.ts"() {
@@ -1844,25 +2687,25 @@ var init_session = __esm({
       return `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
     };
     createSessionStore = (gameDir, startedWall) => {
-      const dir = path8.join(gameDir, ".frogoe", "sessions");
+      const dir = path11.join(gameDir, ".frogoe", "sessions");
       let file;
       return {
         file: () => file,
         write: (records) => {
           if (records.length === 0) return;
           if (!file) {
-            mkdirSync3(dir, { recursive: true });
-            file = path8.join(dir, `${sessionStamp(startedWall)}.jsonl`);
+            mkdirSync7(dir, { recursive: true });
+            file = path11.join(dir, `${sessionStamp(startedWall)}.jsonl`);
           }
           appendFileSync(file, records.map((r) => JSON.stringify(r)).join("\n") + "\n", "utf-8");
         }
       };
     };
     latestSessionFile = (gameDir) => {
-      const dir = path8.join(gameDir, ".frogoe", "sessions");
+      const dir = path11.join(gameDir, ".frogoe", "sessions");
       try {
-        const files = readdirSync2(dir).filter((f) => f.endsWith(".jsonl")).sort();
-        return files.length > 0 ? path8.join(dir, files[files.length - 1] ?? "") : null;
+        const files = readdirSync3(dir).filter((f) => f.endsWith(".jsonl")).sort();
+        return files.length > 0 ? path11.join(dir, files[files.length - 1] ?? "") : null;
       } catch {
         return null;
       }
@@ -1875,9 +2718,9 @@ var run_exports = {};
 __export(run_exports, {
   startServer: () => startServer
 });
-import { existsSync as existsSync6, readFileSync as readFileSync7, statSync, watch } from "fs";
-import os2 from "os";
-import path9 from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync8, statSync as statSync2, watch } from "fs";
+import os3 from "os";
+import path12 from "path";
 import { createAdaptorServer } from "@hono/node-server";
 import { getConnInfo } from "@hono/node-server/conninfo";
 import { Hono } from "hono";
@@ -1886,6 +2729,7 @@ var init_run = __esm({
   "src/run.ts"() {
     "use strict";
     init_ip();
+    init_font_proxy();
     init_records();
     init_session();
     buildDevScript = (version) => `<script>(function(){var v="${String(version)}";try{var es=new EventSource("/__frogoe/reload");es.onmessage=function(){location.reload()};es.onerror=function(){es.close()};}catch(e){}setInterval(function(){fetch("/__frogoe/version",{cache:"no-store"}).then(function(r){return r.text()}).then(function(t){if(t!==v)location.reload()}).catch(function(){})},2000);var fps=[],cnt=0,sec=performance.now(),evs=[],up0=performance.now();function up(){return (performance.now()-up0)/1000}function tick(){cnt++;var n=performance.now();if(n-sec>=1000){fps.push(cnt);cnt=0;sec=n}requestAnimationFrame(tick)}requestAnimationFrame(tick);addEventListener("error",function(e){evs.push({type:"error",msg:String(e.message||e).slice(0,200),up:up()})});addEventListener("unhandledrejection",function(e){evs.push({type:"rejection",msg:String(e.reason).slice(0,200),up:up()})});document.addEventListener("visibilitychange",function(){evs.push({type:document.hidden?"hidden":"visible",up:up()})});function flush(beacon){var p={v:1,up:up(),fps:fps.splice(0),events:evs.splice(0)};if(performance.memory)p.mem=Math.round(performance.memory.usedJSHeapSize/1048576);var b=JSON.stringify(p);if(beacon&&navigator.sendBeacon){navigator.sendBeacon("/__frogoe/metrics",new Blob([b],{type:"application/json"}));return}fetch("/__frogoe/metrics",{method:"POST",body:b,headers:{"content-type":"application/json"},keepalive:true}).catch(function(){});}document.addEventListener("visibilitychange",function(){if(document.hidden)flush(true)});addEventListener("pagehide",function(){flush(true)});setInterval(function(){flush(false)},5000);})();</script>`;
@@ -1905,15 +2749,15 @@ var init_run = __esm({
       woff2: "font/woff2"
     };
     startServer = async (dir, requestedPort = 0, telemetry) => {
-      const root = path9.resolve(dir);
-      if (!existsSync6(path9.join(root, "index.html"))) {
+      const root = path12.resolve(dir);
+      if (!existsSync10(path12.join(root, "index.html"))) {
         throw new Error(`frogoe run: no index.html in ${root} \u2014 is this a game folder?`);
       }
       const clients = /* @__PURE__ */ new Set();
       let version = 0;
       let remoteSeen = false;
       let lastRemote = "";
-      const own = selfAddresses(os2.networkInterfaces());
+      const own = selfAddresses(os3.networkInterfaces());
       const session = telemetry ? createSessionStore(root, Date.now()) : void 0;
       const app = new Hono();
       app.use("*", async (c, next) => {
@@ -1948,6 +2792,22 @@ var init_run = __esm({
         "/__frogoe/version",
         (c) => c.text(String(version), 200, { "cache-control": "no-store" })
       );
+      const fontCacheDir = path12.join(root, ".frogoe", "font-cache");
+      app.get("/__frogoe/font/:token", async (c) => {
+        const url = decodeProxyToken(c.req.param("token"));
+        if (url === null) {
+          return c.text("forbidden", 403);
+        }
+        const result = await proxyFontRequest(url, fontCacheDir);
+        return new Response(result.body, {
+          headers: {
+            "cache-control": "no-store",
+            "content-type": result.contentType,
+            "x-frogoe-cache": result.fromCache ? "hit" : "miss"
+          },
+          status: result.status
+        });
+      });
       app.post("/__frogoe/metrics", async (c) => {
         try {
           const payload = JSON.parse(await c.req.text());
@@ -1964,23 +2824,24 @@ var init_run = __esm({
       });
       app.get("*", (c) => {
         const raw = decodeURIComponent(new URL(c.req.url).pathname);
-        const safe = path9.normalize(raw).replaceAll("\\", "/");
-        let file = path9.join(root, safe === "/" ? "index.html" : safe);
+        const safe = path12.normalize(raw).replaceAll("\\", "/");
+        let file = path12.join(root, safe === "/" ? "index.html" : safe);
         if (!file.startsWith(root)) {
           return c.text("forbidden", 403);
         }
-        if (existsSync6(file) && statSync(file).isDirectory()) {
-          file = path9.join(file, "index.html");
+        if (existsSync10(file) && statSync2(file).isDirectory()) {
+          file = path12.join(file, "index.html");
         }
-        if (!existsSync6(file)) {
+        if (!existsSync10(file)) {
           return c.text(`frogoe run: not found: ${raw}`, 404);
         }
-        const body = readFileSync7(file);
-        const ext = path9.extname(file).slice(1).toLowerCase();
+        const body = readFileSync8(file);
+        const ext = path12.extname(file).slice(1).toLowerCase();
         const type = MIME2[ext] ?? "application/octet-stream";
         if (ext === "html" || ext === "htm") {
           const html = body.toString("utf-8");
-          const injected = /<\/body>/iu.test(html) ? html.replace(/<\/body>/iu, `${buildDevScript(version)}</body>`) : html + buildDevScript(version);
+          const proxied = rewriteFontLinks(html);
+          const injected = /<\/body>/iu.test(proxied) ? proxied.replace(/<\/body>/iu, `${buildDevScript(version)}</body>`) : proxied + buildDevScript(version);
           return c.body(injected, 200, {
             "cache-control": "no-store",
             "content-type": type
@@ -2005,7 +2866,7 @@ var init_run = __esm({
       const lan = lanInfo.ip ? `http://${lanInfo.ip}:${port}` : void 0;
       let timer;
       const watcher = watch(root, { recursive: true }, (_event, file) => {
-        const first = file?.split(path9.sep)[0];
+        const first = file?.split(path12.sep)[0];
         if (first === "snapshots" || first === ".frogoe" || first === "dist") {
           return;
         }
@@ -2039,9 +2900,9 @@ var init_run = __esm({
 });
 
 // src/raster.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
-import path10 from "path";
-var SCENES, sleep2, rasterScriptFor, rasterizeArt;
+import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync9, statSync as statSync3 } from "fs";
+import path13 from "path";
+var SCENES, sleep3, rasterScriptFor, rasterizeArt;
 var init_raster = __esm({
   "src/raster.ts"() {
     "use strict";
@@ -2049,32 +2910,33 @@ var init_raster = __esm({
     init_runtime_source();
     init_art_verify();
     init_runtime_source();
-    init_browser();
+    init_launch();
+    init_manager();
     SCENES = [
       {
         draw: "drawPoster",
         height: 1920,
-        out: path10.join("dist", "assets", "poster.png"),
+        out: path13.join("dist", "assets", "poster.png"),
         size: "w, h",
-        source: path10.join("assets", "poster.js"),
+        source: path13.join("assets", "poster.js"),
         width: 1080
       },
       {
         draw: "drawIcon",
         height: 1024,
-        out: path10.join("dist", "assets", "icon.png"),
+        out: path13.join("dist", "assets", "icon.png"),
         size: "size",
-        source: path10.join("assets", "icon.js"),
+        source: path13.join("assets", "icon.js"),
         width: 1024
       }
     ];
-    sleep2 = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
+    sleep3 = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
     rasterScriptFor = (scene, palette) => {
       const sizeArg = scene.draw === "drawIcon" ? String(scene.width) : `${String(scene.width)}, ${String(scene.height)}`;
       const analyze = scene.draw === "drawIcon" ? "analyzeIconCorners" : "analyzeTitleBand";
       return `(async () => {
   ${runtimeSource()}
-  const mod = await import("./assets/${path10.basename(scene.source)}");
+  const mod = await import("./assets/${path13.basename(scene.source)}");
   const canvas = document.createElement("canvas");
   canvas.id = "__frogoe_raster";
   canvas.width = ${String(scene.width)};
@@ -2101,8 +2963,8 @@ var init_raster = __esm({
 })()`;
     };
     rasterizeArt = async (options) => {
-      const dir = path10.resolve(options.dir);
-      const missing = SCENES.filter((scene) => !existsSync7(path10.join(dir, scene.source)));
+      const dir = path13.resolve(options.dir);
+      const missing = SCENES.filter((scene) => !existsSync11(path13.join(dir, scene.source)));
       if (missing.length > 0) {
         throw new Error(
           `bundle/art-missing \u2014 author the identity scenes first (${missing.map((scene) => scene.source).join(", ")}); run \`frogoe check\` and see frogoe-creative \u2192 references/art.md`
@@ -2110,17 +2972,10 @@ var init_raster = __esm({
       }
       const { startServer: startServer2 } = await Promise.resolve().then(() => (init_run(), run_exports));
       const server = await startServer2(dir);
-      const { default: puppeteer } = await import("puppeteer-core");
-      const executablePath = await ensureBrowser();
-      const browser = await puppeteer.launch({
-        args: ["--no-sandbox", "--disable-gpu"],
-        defaultViewport: null,
-        executablePath,
-        headless: true
-      });
+      const browser = await launchBrowser({ legacyDirs: [legacyCacheDir(dir)] });
       try {
         const base = server.urls.local.replace(/\/$/u, "");
-        const brief = parseBrief(readFileSync8(path10.join(dir, "BRIEF.md"), "utf-8"));
+        const brief = parseBrief(readFileSync9(path13.join(dir, "BRIEF.md"), "utf-8"));
         const palette = {
           accent: brief?.accent ?? "#ff3b3b",
           bg: brief?.bg ?? "#101418",
@@ -2166,7 +3021,7 @@ var init_raster = __esm({
               }
             } else {
               const report = await page.evaluate("window.__frogoeArtReport");
-              const gameSource = readFileSync8(path10.join(dir, "game.js"), "utf-8");
+              const gameSource = readFileSync9(path13.join(dir, "game.js"), "utf-8");
               const verdict = verifyIconFullbleed(report, [...hexColorsOf(gameSource)]);
               if (verdict !== null) throw new Error(verdict);
               if (metrics.coverage < 0.08) {
@@ -2175,13 +3030,13 @@ var init_raster = __esm({
                 );
               }
             }
-            await sleep2(80);
+            await sleep3(80);
             const canvas = await page.$("#__frogoe_raster");
             if (canvas === null) throw new Error(`bundle/art-crash \u2014 ${scene.source}: no canvas`);
-            const outPath = path10.join(dir, scene.out);
-            mkdirSync4(path10.dirname(outPath), { recursive: true });
+            const outPath = path13.join(dir, scene.out);
+            mkdirSync8(path13.dirname(outPath), { recursive: true });
             await canvas.screenshot({ omitBackground: true, path: outPath, type: "png" });
-            files.push({ bytes: statSync2(outPath).size, file: scene.out });
+            files.push({ bytes: statSync3(outPath).size, file: scene.out });
           } finally {
             await page.close();
           }
@@ -2201,8 +3056,8 @@ __export(bundle_exports, {
   command: () => command2
 });
 import { defineCommand as defineCommand2 } from "citty";
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3 } from "fs";
-import path11 from "path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync5 } from "fs";
+import path14 from "path";
 var command2;
 var init_bundle2 = __esm({
   "src/commands/bundle.ts"() {
@@ -2218,9 +3073,9 @@ var init_bundle2 = __esm({
       async run({ args }) {
         const dir = args.dir ? String(args.dir) : process.cwd();
         const report = await bundle({ dir });
-        const outPath = args.out ? path11.resolve(String(args.out)) : path11.join(dir, "dist", "index.html");
-        mkdirSync5(path11.dirname(outPath), { recursive: true });
-        writeFileSync3(outPath, report.artifact, "utf-8");
+        const outPath = args.out ? path14.resolve(String(args.out)) : path14.join(dir, "dist", "index.html");
+        mkdirSync9(path14.dirname(outPath), { recursive: true });
+        writeFileSync5(outPath, report.artifact, "utf-8");
         const art = await rasterizeArt({ dir });
         for (const warning of [...report.warnings, ...art.warnings]) {
           console.log(`  \u26A0 ${warning}`);
@@ -2479,6 +3334,9 @@ var init_driver = __esm({
           });
           await page.mouse.up();
         },
+        async type(text) {
+          await page.keyboard.type(text, { delay: 30 });
+        },
         async clickRetryAwaitReload(timeoutMs) {
           const interactable = `(() => {
         const b = document.querySelector("[data-block-retry]");
@@ -2535,7 +3393,7 @@ var init_types = __esm({
 });
 
 // src/live/decisions.ts
-var FPS_FLOOR2, FPS_SUSTAINED_WINDOW, FROZEN_STREAK, outlineFinding, collapseFinding, pageErrorFinding, consoleErrorFinding, canvasMissingFinding, canvasUnpaintedFinding, contractMissingFinding, stateStuckFinding, earlyDeathFinding, fpsFinding, fpsSustainedFinding, frozenFrameFinding, pausedFinding, stateCorruptFinding, playabilityFinding, finishEventFinding, neverEndsFinding, audioLockedFinding, noGameoverCardFinding, THROTTLE_RATE, THROTTLED_FPS_FLOOR, fpsThrottledFinding, noRetryFinding, retryDeadFinding, rebootFinding;
+var FPS_FLOOR2, FPS_SUSTAINED_WINDOW, FROZEN_STREAK, END_BUDGET_MS, ROUND_END_GRACE_MS, endBudgetMs, warnsWhenItNeverEnds, outlineFinding, collapseFinding, pageErrorFinding, consoleErrorFinding, canvasMissingFinding, canvasUnpaintedFinding, contractMissingFinding, stateStuckFinding, earlyDeathFinding, fpsFinding, fpsSustainedFinding, frozenFrameFinding, pausedFinding, stateCorruptFinding, playabilityFinding, finishEventFinding, neverEndsFinding, audioLockedFinding, noGameoverCardFinding, THROTTLE_RATE, THROTTLED_FPS_FLOOR, fpsThrottledFinding, noRetryFinding, retryDeadFinding, rebootFinding;
 var init_decisions = __esm({
   "src/live/decisions.ts"() {
     "use strict";
@@ -2543,6 +3401,10 @@ var init_decisions = __esm({
     FPS_FLOOR2 = 30;
     FPS_SUSTAINED_WINDOW = 3;
     FROZEN_STREAK = 3;
+    END_BUDGET_MS = 45e3;
+    ROUND_END_GRACE_MS = 8e3;
+    endBudgetMs = (session) => session === "round" ? ROUND_END_GRACE_MS : session === "toy" ? 0 : END_BUDGET_MS;
+    warnsWhenItNeverEnds = (session) => session === "blitz";
     outlineFinding = (measures) => {
       const bare = measures.filter((m) => !m.hasOutline);
       if (bare.length === 0 || !bare[0]) {
@@ -2758,7 +3620,7 @@ var init_decisions = __esm({
     neverEndsFinding = (budgetMs) => finding({
       code: "live/never-ends",
       file: "game.js",
-      fix: `no death within ${Math.round(budgetMs / 1e3)}s of passive play \u2014 fine for endless/sandbox games, but feed games are short replayable loops; most deaths should arrive in seconds`,
+      fix: `no death within ${Math.round(budgetMs / 1e3)}s of passive play \u2014 blitz feed games are short loops; declare session: round in BRIEF.md for turn-based games or session: toy for endless toys, and the gate stops waiting`,
       message: "game never reached the over state",
       phase: "end",
       severity: "warning"
@@ -2835,12 +3697,11 @@ var init_decisions = __esm({
 });
 
 // src/live/phases.ts
-var END_BUDGET_MS, RETRY_NAV_MS, PLAY_STEPS, PLAY_STEP_MS, HOLD_STEP_INDEX, DRAG_STEP_INDEX, DRAG_SPAN, HOLD_MS, POLL_MS, GRACE_MS, STABILITY_CYCLES, START_BURST_TAPS, DESKTOP_FPS_MS, sleep3, jitterX, jitterY, hasError, runBootChecks, runDesktopPass, overShotName, retryShotName, waitForOver, runStartBurst, verifyDeath, runLifecycle;
+var RETRY_NAV_MS, PLAY_STEPS, PLAY_STEP_MS, HOLD_STEP_INDEX, DRAG_STEP_INDEX, DRAG_SPAN, HOLD_MS, POLL_MS, GRACE_MS, STABILITY_CYCLES, START_BURST_TAPS, DESKTOP_FPS_MS, sleep4, jitterX, jitterY, ladderFor, execStep, hasError, runBootChecks, runDesktopPass, overShotName, retryShotName, waitForOver, runStartBurst, verifyDeath, runLifecycle;
 var init_phases = __esm({
   "src/live/phases.ts"() {
     "use strict";
     init_decisions();
-    END_BUDGET_MS = 45e3;
     RETRY_NAV_MS = 8e3;
     PLAY_STEPS = 7;
     PLAY_STEP_MS = 850;
@@ -2853,11 +3714,98 @@ var init_phases = __esm({
     STABILITY_CYCLES = 2;
     START_BURST_TAPS = 3;
     DESKTOP_FPS_MS = 2e3;
-    sleep3 = (ms) => new Promise((resolve2) => {
+    sleep4 = (ms) => new Promise((resolve2) => {
       setTimeout(resolve2, ms);
     });
     jitterX = (step) => step * 37 % 121 - 60;
     jitterY = (step) => step * 53 % 181 - 90;
+    ladderFor = (verb, viewport) => {
+      const cx = Math.round(viewport.width / 2);
+      const cy = Math.round(viewport.height / 2);
+      const tap = (step) => ({
+        kind: "tap",
+        x: Math.round(cx + jitterX(step)),
+        y: Math.round(cy + jitterY(step))
+      });
+      const sweep = (step) => {
+        const x = Math.round(cx + jitterX(step));
+        const y = Math.round(cy + jitterY(step));
+        return { kind: "drag", x1: x - DRAG_SPAN, x2: x + DRAG_SPAN, y1: y, y2: y };
+      };
+      const base = () => Array.from({ length: PLAY_STEPS }, (_, step) => {
+        if (step === HOLD_STEP_INDEX) {
+          return { kind: "hold", ms: HOLD_MS, x: tap(step).x, y: tap(step).y };
+        }
+        if (step === DRAG_STEP_INDEX) return sweep(step);
+        return tap(step);
+      });
+      switch (verb) {
+        case "swap": {
+          const gap = 34;
+          return [
+            { kind: "tap", x: cx - gap, y: Math.round(cy + jitterY(0)) },
+            { kind: "tap", x: cx + gap, y: Math.round(cy + jitterY(0)) },
+            { kind: "tap", x: Math.round(cx + jitterX(2)), y: cy - gap },
+            { kind: "tap", x: Math.round(cx + jitterX(2)), y: cy + gap },
+            { kind: "tap", x: cx - gap, y: Math.round(cy + jitterY(4)) },
+            { kind: "tap", x: cx + gap, y: Math.round(cy + jitterY(4)) },
+            sweep(0),
+            { kind: "drag", x1: cx, x2: cx, y1: cy + DRAG_SPAN, y2: cy - DRAG_SPAN }
+          ];
+        }
+        case "place": {
+          return [
+            { kind: "tap", x: cx - 80, y: cy - 60 },
+            { kind: "tap", x: cx + 40, y: cy + 20 },
+            { kind: "tap", x: cx + 80, y: cy - 40 },
+            { kind: "tap", x: cx - 30, y: cy + 70 },
+            { kind: "tap", x: Math.round(cx + jitterX(4)), y: cy },
+            { kind: "tap", x: cx - 70, y: cy + 80 },
+            { kind: "drag", x1: cx - 60, x2: cx + 60, y1: cy, y2: cy }
+          ];
+        }
+        case "type": {
+          return [
+            { kind: "type", text: "frogoe" },
+            tap(0),
+            { kind: "type", text: "glow" },
+            tap(2),
+            { kind: "hold", ms: HOLD_MS, x: tap(3).x, y: tap(3).y },
+            sweep(5),
+            { kind: "type", text: "game" },
+            tap(6)
+          ];
+        }
+        case "draw": {
+          return [
+            { kind: "drag", x1: cx - 90, x2: cx + 90, y1: cy - 50, y2: cy + 30 },
+            { kind: "tap", x: cx + 60, y: cy - 60 },
+            { kind: "drag", x1: cx + 80, x2: cx - 70, y1: cy - 20, y2: cy + 70 },
+            { kind: "hold", ms: HOLD_MS, x: cx, y: cy },
+            { kind: "drag", x1: cx - 40, x2: cx + 70, y1: cy + 90, y2: cy - 90 },
+            { kind: "tap", x: cx - 60, y: cy + 20 }
+          ];
+        }
+        default:
+          return base();
+      }
+    };
+    execStep = async (driver, step) => {
+      switch (step.kind) {
+        case "tap":
+          await driver.tap(step.x, step.y);
+          break;
+        case "hold":
+          await driver.hold(step.x, step.y, step.ms);
+          break;
+        case "drag":
+          await driver.drag(step.x1, step.y1, step.x2, step.y2);
+          break;
+        case "type":
+          await driver.type(step.text);
+          break;
+      }
+    };
     hasError = (findings) => findings.some((f) => f.severity === "error");
     runBootChecks = async (driver, ctx) => {
       const findings = [];
@@ -2900,7 +3848,7 @@ var init_phases = __esm({
       return findings;
     };
     runDesktopPass = async (driver, ctx) => {
-      const doSleep = ctx.sleep ?? sleep3;
+      const doSleep = ctx.sleep ?? sleep4;
       const findings = await runBootChecks(driver, ctx);
       if (hasError(findings)) {
         return { findings };
@@ -2921,8 +3869,8 @@ var init_phases = __esm({
     };
     overShotName = (cycle) => cycle === 0 ? "live-mobile-over.png" : `live-mobile-over-${cycle + 1}.png`;
     retryShotName = (cycle) => cycle === 0 ? "live-mobile-retry.png" : `live-mobile-retry-${cycle + 1}.png`;
-    waitForOver = async (driver, doSleep) => {
-      for (let waited = 0; waited < END_BUDGET_MS; waited += POLL_MS) {
+    waitForOver = async (driver, doSleep, budgetMs) => {
+      for (let waited = 0; waited < budgetMs; waited += POLL_MS) {
         await doSleep(POLL_MS);
         if (await driver.gameState() === "over") {
           return true;
@@ -2931,7 +3879,7 @@ var init_phases = __esm({
       return false;
     };
     runStartBurst = async (driver, ctx) => {
-      const doSleep = ctx.sleep ?? sleep3;
+      const doSleep = ctx.sleep ?? sleep4;
       for (let step = 0; step < START_BURST_TAPS; step++) {
         const x = Math.round(ctx.viewport.width / 2 + jitterX(step));
         const y = Math.round(ctx.viewport.height / 2 + jitterY(step));
@@ -2940,7 +3888,7 @@ var init_phases = __esm({
       }
     };
     verifyDeath = async (driver, ctx, findings, cycle) => {
-      const doSleep = ctx.sleep ?? sleep3;
+      const doSleep = ctx.sleep ?? sleep4;
       let events = await driver.finishEvents();
       if (events.length === 0) {
         await doSleep(GRACE_MS);
@@ -2961,7 +3909,7 @@ var init_phases = __esm({
       return presence.retry;
     };
     runLifecycle = async (driver, ctx) => {
-      const doSleep = ctx.sleep ?? sleep3;
+      const doSleep = ctx.sleep ?? sleep4;
       const settle = ctx.settleMs ?? 2e3;
       const name = ctx.viewport.name;
       const findings = [];
@@ -2971,6 +3919,7 @@ var init_phases = __esm({
       if (hasError(boot)) {
         return { findings, lifecycle: { ends: false, retryReloads: 0 }, playability: "no-input" };
       }
+      const ladder = ladderFor(ctx.verb ?? "tap", ctx.viewport);
       const mark = await driver.fpsMark();
       const hashes = [];
       let streak = 0;
@@ -2979,16 +3928,8 @@ var init_phases = __esm({
       let sawPaused = false;
       let sawStuck = false;
       let corrupt = null;
-      for (let step = 0; step < PLAY_STEPS; step++) {
-        const x = Math.round(ctx.viewport.width / 2 + jitterX(step));
-        const y = Math.round(ctx.viewport.height / 2 + jitterY(step));
-        if (step === HOLD_STEP_INDEX) {
-          await driver.hold(x, y, HOLD_MS);
-        } else if (step === DRAG_STEP_INDEX) {
-          await driver.drag(x - DRAG_SPAN, y, x + DRAG_SPAN, y);
-        } else {
-          await driver.tap(x, y);
-        }
+      for (const step of ladder) {
+        await execStep(driver, step);
         await doSleep(PLAY_STEP_MS);
         const state = await driver.gameState();
         if (state === "over") {
@@ -3056,13 +3997,17 @@ var init_phases = __esm({
           findings.push(audioFinding);
         }
       }
+      const session = ctx.session ?? "blitz";
+      const budget = endBudgetMs(session);
       let ends = false;
       let retryReloads = 0;
-      if (!sawOver) {
-        sawOver = await waitForOver(driver, doSleep);
+      if (!sawOver && budget > 0) {
+        sawOver = await waitForOver(driver, doSleep, budget);
       }
       if (!sawOver) {
-        findings.push(neverEndsFinding(END_BUDGET_MS));
+        if (warnsWhenItNeverEnds(session)) {
+          findings.push(neverEndsFinding(END_BUDGET_MS));
+        }
       } else {
         ends = true;
         let canRetry = await verifyDeath(driver, ctx, findings, 0);
@@ -3089,7 +4034,7 @@ var init_phases = __esm({
           await ctx.shot?.(retryShotName(cycle));
           if (cycle < STABILITY_CYCLES - 1) {
             await runStartBurst(driver, ctx);
-            const overAgain = await waitForOver(driver, doSleep);
+            const overAgain = await waitForOver(driver, doSleep, END_BUDGET_MS);
             if (!overAgain) {
               findings.push(neverEndsFinding(END_BUDGET_MS));
               break;
@@ -3101,16 +4046,8 @@ var init_phases = __esm({
       const throttleMark = await driver.fpsMark();
       await driver.setCpuThrottling(THROTTLE_RATE);
       await runStartBurst(driver, ctx);
-      for (let step = 0; step < PLAY_STEPS; step++) {
-        const x = Math.round(ctx.viewport.width / 2 + jitterX(step));
-        const y = Math.round(ctx.viewport.height / 2 + jitterY(step));
-        if (step === HOLD_STEP_INDEX) {
-          await driver.hold(x, y, HOLD_MS);
-        } else if (step === DRAG_STEP_INDEX) {
-          await driver.drag(x - DRAG_SPAN, y, x + DRAG_SPAN, y);
-        } else {
-          await driver.tap(x, y);
-        }
+      for (const step of ladder) {
+        await execStep(driver, step);
         await doSleep(PLAY_STEP_MS);
       }
       const throttledBuckets = await driver.fpsSince(throttleMark);
@@ -3134,19 +4071,32 @@ var live_exports = {};
 __export(live_exports, {
   collectLive: () => collectLive
 });
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync4 } from "fs";
-import path12 from "path";
-var VIEWPORTS, waitForServer, collectLive;
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "fs";
+import path15 from "path";
+var VIEWPORTS, declaredIntent, waitForServer, collectLive;
 var init_live = __esm({
   "src/live/index.ts"() {
     "use strict";
-    init_browser();
+    init_src();
+    init_launch();
+    init_manager();
     init_driver();
     init_phases();
     VIEWPORTS = [
       { height: 844, name: "mobile", width: 390 },
       { height: 800, name: "desktop", width: 1280 }
     ];
+    declaredIntent = (dir) => {
+      try {
+        const brief = parseBrief(readFileSync10(path15.join(dir, "BRIEF.md"), "utf-8"));
+        return {
+          session: brief?.session !== void 0 && SESSIONS.includes(brief.session) ? brief.session : "blitz",
+          verb: brief?.verb !== void 0 && VERBS.includes(brief.verb) ? brief.verb : "tap"
+        };
+      } catch {
+        return { session: "blitz", verb: "tap" };
+      }
+    };
     waitForServer = async (url) => {
       for (let attempt = 0; attempt < 10; attempt++) {
         try {
@@ -3156,11 +4106,11 @@ var init_live = __esm({
           }
         } catch {
         }
-        await sleep3(500);
+        await sleep4(500);
       }
     };
     collectLive = async (options) => {
-      const dir = path12.resolve(options.dir);
+      const dir = path15.resolve(options.dir);
       const settle = options.settleMs ?? 2e3;
       const findings = [];
       const screenshots = [];
@@ -3170,16 +4120,10 @@ var init_live = __esm({
       };
       const { startServer: startServer2 } = await Promise.resolve().then(() => (init_run(), run_exports));
       const server = await startServer2(dir);
-      const snapshotDir = path12.join(dir, "snapshots");
-      mkdirSync6(snapshotDir, { recursive: true });
-      const { default: puppeteer } = await import("puppeteer-core");
-      const executablePath = await ensureBrowser();
-      const browser = await puppeteer.launch({
-        args: ["--no-sandbox", "--disable-gpu"],
-        defaultViewport: null,
-        executablePath,
-        headless: true
-      });
+      const snapshotDir = path15.join(dir, "snapshots");
+      mkdirSync10(snapshotDir, { recursive: true });
+      const intent = declaredIntent(dir);
+      const browser = await launchBrowser({ legacyDirs: [legacyCacheDir(dir)] });
       try {
         let serverReady = false;
         for (const viewport of VIEWPORTS) {
@@ -3191,19 +4135,21 @@ var init_live = __esm({
               size: { height: viewport2.height, width: viewport2.width }
             });
             const shot = async (name) => {
-              writeFileSync4(path12.join(snapshotDir, name), await driver.screenshot());
-              screenshots.push(path12.join("snapshots", name));
+              writeFileSync6(path15.join(snapshotDir, name), await driver.screenshot());
+              screenshots.push(path15.join("snapshots", name));
             };
             if (!serverReady) {
               await waitForServer(server.urls.local);
               serverReady = true;
             }
             await page.goto(server.urls.local, { timeout: 15e3, waitUntil: "domcontentloaded" });
-            await sleep3(settle);
+            await sleep4(settle);
             if (viewport2.name === "mobile") {
               const outcome = await runLifecycle(driver, {
                 settleMs: settle,
                 shot,
+                verb: intent.verb,
+                session: intent.session,
                 viewport: viewport2
               });
               findings.push(...outcome.findings);
@@ -3627,9 +4573,9 @@ var init_compose = __esm({
 });
 
 // src/manifest.ts
-import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
-import path13 from "path";
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
+import path16 from "path";
 var DESCRIPTION_CAP, descriptionFrom, buildManifest;
 var init_manifest = __esm({
   "src/manifest.ts"() {
@@ -3648,16 +4594,16 @@ var init_manifest = __esm({
       return null;
     };
     buildManifest = (options) => {
-      const dir = path13.resolve(options.dir);
-      const briefSource = readFileSync9(path13.join(dir, "BRIEF.md"), "utf-8");
+      const dir = path16.resolve(options.dir);
+      const briefSource = readFileSync11(path16.join(dir, "BRIEF.md"), "utf-8");
       const brief = parseBrief(briefSource);
       if (!brief?.title) return null;
-      const pin = existsSync8(path13.join(dir, "frogoe.json")) ? JSON.parse(readFileSync9(path13.join(dir, "frogoe.json"), "utf-8")).contract ?? "0.1.0" : "0.1.0";
-      const artifact = options.artifactHtml ?? readFileSync9(path13.join(dir, "dist", "index.html"), "utf-8");
-      const sha2562 = createHash2("sha256").update(artifact, "utf-8").digest("hex");
+      const pin = existsSync12(path16.join(dir, "frogoe.json")) ? JSON.parse(readFileSync11(path16.join(dir, "frogoe.json"), "utf-8")).contract ?? "0.1.0" : "0.1.0";
+      const artifact = options.artifactHtml ?? readFileSync11(path16.join(dir, "dist", "index.html"), "utf-8");
+      const sha2562 = createHash3("sha256").update(artifact, "utf-8").digest("hex");
       const mediaSha = (file) => {
-        const full = path13.join(dir, "dist", "assets", file);
-        return existsSync8(full) ? createHash2("sha256").update(readFileSync9(full)).digest("hex") : null;
+        const full = path16.join(dir, "dist", "assets", file);
+        return existsSync12(full) ? createHash3("sha256").update(readFileSync11(full)).digest("hex") : null;
       };
       return {
         artifact: "index.html",
@@ -3666,7 +4612,7 @@ var init_manifest = __esm({
         description: descriptionFrom(briefSource),
         entry: "index.html",
         fonts: brief.fonts ?? null,
-        icon: existsSync8(path13.join(dir, "dist", "assets", "icon.png")) ? "assets/icon.png" : null,
+        icon: existsSync12(path16.join(dir, "dist", "assets", "icon.png")) ? "assets/icon.png" : null,
         iconSha256: mediaSha("icon.png"),
         mood: brief.mood ?? null,
         palette: {
@@ -3675,8 +4621,9 @@ var init_manifest = __esm({
           fg: brief.fg ?? "",
           ...brief.outline ? { outline: brief.outline } : {}
         },
-        poster: existsSync8(path13.join(dir, "dist", "assets", "poster.png")) ? "assets/poster.png" : null,
+        poster: existsSync12(path16.join(dir, "dist", "assets", "poster.png")) ? "assets/poster.png" : null,
         posterSha256: mediaSha("poster.png"),
+        session: brief.session !== void 0 && SESSIONS.includes(brief.session) ? brief.session : "blitz",
         title: brief.title,
         verb: brief.verb ?? "tap"
       };
@@ -3689,8 +4636,8 @@ var embed_exports = {};
 __export(embed_exports, {
   command: () => command4
 });
-import { existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
-import path14 from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
+import path17 from "path";
 import { defineCommand as defineCommand4 } from "citty";
 var dataUri2, command4;
 var init_embed = __esm({
@@ -3700,15 +4647,15 @@ var init_embed = __esm({
     init_card();
     init_compose();
     init_manifest();
-    dataUri2 = (file) => existsSync9(file) ? `data:image/png;base64,${readFileSync10(file).toString("base64")}` : null;
+    dataUri2 = (file) => existsSync13(file) ? `data:image/png;base64,${readFileSync12(file).toString("base64")}` : null;
     command4 = defineCommand4({
       args: {
         dir: { type: "positional", required: false, description: "game folder (default: cwd)" }
       },
       async run({ args }) {
         const dir = args.dir ? String(args.dir) : process.cwd();
-        const artifactPath = path14.join(dir, "dist", "index.html");
-        if (!existsSync9(artifactPath)) {
+        const artifactPath = path17.join(dir, "dist", "index.html");
+        if (!existsSync13(artifactPath)) {
           throw new Error(
             "frogoe embed: no dist/index.html \u2014 run `frogoe bundle` first (and `frogoe check` before it: check \u2192 bundle \u2192 embed)"
           );
@@ -3724,20 +4671,20 @@ var init_embed = __esm({
         if (!manifest) {
           throw new Error("frogoe embed: could not build the manifest from BRIEF.md");
         }
-        const posterDataUri = dataUri2(path14.join(dir, "dist", "assets", "poster.png"));
-        const iconDataUri = dataUri2(path14.join(dir, "dist", "assets", "icon.png"));
-        const gameHtml = readFileSync10(artifactPath, "utf-8");
+        const posterDataUri = dataUri2(path17.join(dir, "dist", "assets", "poster.png"));
+        const iconDataUri = dataUri2(path17.join(dir, "dist", "assets", "icon.png"));
+        const gameHtml = readFileSync12(artifactPath, "utf-8");
         const { payloadB64 } = composePayload(gameHtml);
         const html = composeEmbedHtml({ iconDataUri, manifest, payloadB64, posterDataUri });
-        mkdirSync7(path14.join(dir, "dist"), { recursive: true });
-        writeFileSync5(
-          path14.join(dir, "dist", "manifest.json"),
+        mkdirSync11(path17.join(dir, "dist"), { recursive: true });
+        writeFileSync7(
+          path17.join(dir, "dist", "manifest.json"),
           `${JSON.stringify(manifest, null, 2)}
 `,
           "utf-8"
         );
-        const outPath = path14.join(dir, "dist", "embed.html");
-        writeFileSync5(outPath, html, "utf-8");
+        const outPath = path17.join(dir, "dist", "embed.html");
+        writeFileSync7(outPath, html, "utf-8");
         console.log(`  frogoe embed \u2192 ${outPath}`);
         console.log(
           `  ${html.length.toLocaleString("en-US")} bytes \xB7 sandbox allow-scripts \xB7 sha256 ${manifest.artifactSha256.slice(0, 12)}`
@@ -3864,17 +4811,18 @@ var vision_exports = {};
 __export(vision_exports, {
   command: () => command5
 });
-import { existsSync as existsSync10, readFileSync as readFileSync11 } from "fs";
-import path15 from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
+import path18 from "path";
 import { defineCommand as defineCommand5 } from "citty";
 var HELPERS, PAGE_SCRIPT, show, metricLine, command5;
 var init_vision = __esm({
   "src/commands/vision.ts"() {
     "use strict";
     init_src();
+    init_launch();
+    init_manager();
     init_art_eyes();
     init_art_verify();
-    init_browser();
     HELPERS = [
       luminance,
       contrastRatio2,
@@ -3984,14 +4932,14 @@ var init_vision = __esm({
         objects: { type: "boolean", description: "SPRITES objects only" }
       },
       async run({ args }) {
-        const dir = path15.resolve(args.dir ? String(args.dir) : process.cwd());
-        const briefPath = path15.join(dir, "BRIEF.md");
-        if (!existsSync10(briefPath)) {
+        const dir = path18.resolve(args.dir ? String(args.dir) : process.cwd());
+        const briefPath = path18.join(dir, "BRIEF.md");
+        if (!existsSync14(briefPath)) {
           throw new Error(
             "frogoe vision: no BRIEF.md in this folder \u2014 run this from a game (frogoe init)"
           );
         }
-        const brief = parseBrief(readFileSync11(briefPath, "utf-8"));
+        const brief = parseBrief(readFileSync13(briefPath, "utf-8"));
         if (!brief) {
           throw new Error("frogoe vision: BRIEF.md is present but unparsable \u2014 fill the frontmatter");
         }
@@ -4011,12 +4959,9 @@ var init_vision = __esm({
         const compact = !wantAll;
         const { startServer: startServer2 } = await Promise.resolve().then(() => (init_run(), run_exports));
         const server = await startServer2(dir);
-        const { default: puppeteer } = await import("puppeteer-core");
-        const browser = await puppeteer.launch({
-          args: ["--no-sandbox", "--disable-gpu"],
+        const browser = await launchBrowser({
           defaultViewport: { height: 844, width: 390 },
-          executablePath: await ensureBrowser(),
-          headless: true
+          legacyDirs: [legacyCacheDir(dir)]
         });
         let report;
         try {
@@ -4101,7 +5046,7 @@ var init_vision = __esm({
             console.log(show(icon, pretty));
           }
         }
-        if (!targeted && !existsSync10(path15.join(dir, "assets", "poster.js"))) {
+        if (!targeted && !existsSync14(path18.join(dir, "assets", "poster.js"))) {
           console.log("\n(note: run `frogoe check` first \u2014 vision only looks, it never gates)");
         }
       },
@@ -4183,7 +5128,7 @@ var report_exports = {};
 __export(report_exports, {
   command: () => command8
 });
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { defineCommand as defineCommand8 } from "citty";
 var command8;
 var init_report = __esm({
@@ -4202,7 +5147,7 @@ var init_report = __esm({
           console.log(`frogoe report: no sessions in ${dir} \u2014 play a run under \`frogoe run\` first`);
           return;
         }
-        const records = readFileSync12(file, "utf-8").split("\n").filter((line) => line.trim().length > 0).map((line) => JSON.parse(line));
+        const records = readFileSync14(file, "utf-8").split("\n").filter((line) => line.trim().length > 0).map((line) => JSON.parse(line));
         const s = summarizeRecords(records);
         console.log(`
   frogoe report \u2014 ${file}`);
@@ -4240,8 +5185,8 @@ var init_firewall = __esm({
         return null;
       }
     };
-    binaryBlocked = (path17) => {
-      const out = run(`--getappblocked "${path17}"`);
+    binaryBlocked = (path19) => {
+      const out = run(`--getappblocked "${path19}"`);
       if (out === null) return null;
       if (/blocked/iu.test(out)) return true;
       if (/allowed/iu.test(out)) return false;
@@ -4297,224 +5242,6 @@ var init_plan = __esm({
   }
 });
 
-// src/net/tunnel.ts
-import { spawn, spawnSync } from "child_process";
-import { existsSync as existsSync11, mkdirSync as mkdirSync8, chmodSync, writeFileSync as writeFileSync6 } from "fs";
-import os3 from "os";
-import path16 from "path";
-import { gunzipSync } from "zlib";
-var URL_PATTERN, parseTunnelUrl, TAG_PATTERN, assertSafeTag, octalAt, extractSingleFile, ENV_PIN, assetName, binaryFileName, cacheBase, resolveLatestTag, mb, downloadWithProgress, binaryEchoes, resolveBinary, startTunnel;
-var init_tunnel = __esm({
-  "src/net/tunnel.ts"() {
-    "use strict";
-    URL_PATTERN = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/iu;
-    parseTunnelUrl = (chunk) => URL_PATTERN.exec(chunk)?.[0];
-    TAG_PATTERN = /^\d{4}\.\d+\.\d+(-[A-Za-z0-9.]+)?$/u;
-    assertSafeTag = (tag) => {
-      if (!TAG_PATTERN.test(tag)) {
-        throw new Error(
-          `cloudflared version "${tag}" is not a valid release tag (expected e.g. 2025.10.1)`
-        );
-      }
-      return tag;
-    };
-    octalAt = (block, offset, length) => {
-      const raw = block.subarray(offset, offset + length).toString("utf-8");
-      const digits = raw.replace(/[\0 ]/gu, "");
-      return digits.length === 0 ? 0 : Number.parseInt(digits, 8);
-    };
-    extractSingleFile = (tar, wanted) => {
-      for (let offset = 0; offset + 512 <= tar.length; ) {
-        const header = tar.subarray(offset, offset + 512);
-        const name = header.subarray(0, 100).toString("utf-8").replace(/\0.*$/u, "");
-        const size = octalAt(header, 124, 12);
-        const type = header.toString("utf-8").charCodeAt(156);
-        const dataStart = offset + 512;
-        const dataEnd = dataStart + size;
-        if (dataEnd > tar.length) return null;
-        if (name === wanted && (type === 48 || type === 0)) {
-          return tar.subarray(dataStart, dataEnd);
-        }
-        offset = dataStart + Math.ceil(size / 512) * 512;
-      }
-      return null;
-    };
-    ENV_PIN = "FROGOE_CLOUDFLARED_VERSION";
-    assetName = (platform, arch) => {
-      const a = arch === "arm64" ? "arm64" : arch === "x64" ? "amd64" : arch === "ia32" ? "386" : null;
-      if (!a) return null;
-      switch (platform) {
-        case "darwin":
-          return a === "386" ? null : `cloudflared-darwin-${a}.tgz`;
-        case "linux":
-          return `cloudflared-linux-${a}`;
-        // bare binaries
-        case "win32":
-          return a === "arm64" ? null : `cloudflared-windows-${a}.exe`;
-        // bare executables
-        default:
-          return null;
-      }
-    };
-    binaryFileName = (platform) => platform === "win32" ? "cloudflared.exe" : "cloudflared";
-    cacheBase = (platform, env, home) => {
-      if (platform === "darwin") return path16.join(home, "Library", "Caches");
-      if (platform === "win32") return env.LOCALAPPDATA ?? path16.join(home, "AppData", "Local");
-      return path16.join(home, ".cache");
-    };
-    resolveLatestTag = async () => {
-      const res = await fetch("https://api.github.com/repos/cloudflare/cloudflared/releases/latest", {
-        headers: { accept: "application/vnd.github+json" }
-      });
-      if (!res.ok) throw new Error(`github api ${res.status}`);
-      const body = await res.json();
-      if (!body.tag_name) throw new Error("github api returned no tag_name");
-      return body.tag_name;
-    };
-    mb = (bytes) => (bytes / (1024 * 1024)).toFixed(0);
-    downloadWithProgress = async (res, onChunk) => {
-      const total = Number(res.headers.get("content-length") ?? 0);
-      const reader = res.body?.getReader();
-      if (!reader) return Buffer.from(await res.arrayBuffer());
-      const chunks = [];
-      let done = 0;
-      let nextReport = 0;
-      for (; ; ) {
-        const step = await reader.read();
-        if (step.done) break;
-        chunks.push(Buffer.from(step.value));
-        done += step.value.byteLength;
-        if (done >= nextReport) {
-          onChunk(done, total);
-          nextReport = done + 5 * 1024 * 1024;
-        }
-      }
-      return Buffer.concat(chunks);
-    };
-    binaryEchoes = (bin, tag) => {
-      try {
-        const probe = spawnSync(bin, ["--version"], { encoding: "utf-8", timeout: 1e4 });
-        const out = `${probe.stdout ?? ""}${probe.stderr ?? ""}`;
-        return probe.status === 0 && out.includes(tag);
-      } catch {
-        return false;
-      }
-    };
-    resolveBinary = async (onProgress) => {
-      const pathProbe = spawnSync("cloudflared", ["--version"], { stdio: "ignore", timeout: 5e3 });
-      if (pathProbe.status === 0) return { downloaded: false, path: "cloudflared" };
-      const platform = process.platform;
-      const asset = assetName(platform, process.arch);
-      if (!asset) {
-        throw new Error(
-          `cloudflared publishes no build for ${platform}/${process.arch} \u2014 install it and put \`cloudflared\` on PATH`
-        );
-      }
-      const tag = process.env[ENV_PIN] ? assertSafeTag(process.env[ENV_PIN]) : assertSafeTag(await resolveLatestTag());
-      const root = path16.join(cacheBase(platform, process.env, os3.homedir()), "frogoe", "cloudflared");
-      const dir = path16.join(root, tag);
-      const bin = path16.join(dir, binaryFileName(platform));
-      const rootResolved = path16.resolve(root);
-      const binResolved = path16.resolve(bin);
-      if (!binResolved.startsWith(rootResolved + path16.sep)) {
-        throw new Error("cloudflared binary path escaped the frogoe cache \u2014 refusing to execute");
-      }
-      if (existsSync11(bin) && binaryEchoes(bin, tag)) return { downloaded: false, path: bin };
-      onProgress?.(`downloading cloudflared ${tag} (~25 MB, once)\u2026`);
-      const res = await fetch(
-        `https://github.com/cloudflare/cloudflared/releases/download/${tag}/${asset}`
-      );
-      if (!res.ok) throw new Error(`cloudflared ${tag} download failed (${res.status})`);
-      const raw = await downloadWithProgress(res, (done, total) => {
-        onProgress?.(`downloading cloudflared ${tag} \u2014 ${mb(done)}${total ? `/${mb(total)}` : ""} MB`);
-      });
-      const binary = asset.endsWith(".tgz") ? extractSingleFile(gunzipSync(raw), "cloudflared") : raw;
-      if (!binary) throw new Error("cloudflared archive did not contain the binary");
-      mkdirSync8(dir, { recursive: true });
-      writeFileSync6(bin, binary);
-      if (platform !== "win32") chmodSync(bin, 493);
-      if (!binaryEchoes(bin, tag)) {
-        throw new Error(
-          `cloudflared ${tag} failed its version check \u2014 deleted; set ${ENV_PIN} or install via brew`
-        );
-      }
-      return { downloaded: true, path: bin };
-    };
-    startTunnel = async (port, options) => {
-      const timeoutMs = options?.timeoutMs ?? 2e4;
-      const bin = await resolveBinary(options?.onProgress);
-      return new Promise((resolve2, reject) => {
-        const child = spawn(
-          bin.path,
-          ["tunnel", "--url", `http://localhost:${port}`, "--no-autoupdate"],
-          {
-            detached: true,
-            stdio: ["ignore", "pipe", "pipe"],
-            windowsHide: true
-          }
-        );
-        let settled = false;
-        let url;
-        let buffer = "";
-        const exited = new Promise((notify) => {
-          child.once("exit", () => notify());
-        });
-        const killTree = () => {
-          if (process.platform === "win32" || !child.pid) {
-            child.kill("SIGTERM");
-            return;
-          }
-          try {
-            process.kill(-child.pid, "SIGTERM");
-          } catch {
-            child.kill("SIGTERM");
-          }
-        };
-        const finish = (error) => {
-          if (settled) return;
-          settled = true;
-          clearTimeout(timer);
-          if (error || !url) {
-            killTree();
-            const tail = buffer.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean).slice(-2).join(" | ");
-            const base = error?.message ?? "frogoe tunnel: cloudflared exited before producing a URL";
-            reject(new Error(tail ? `${base} \u2014 ${tail}` : base));
-            return;
-          }
-          resolve2({ exited, stop: killTree, url });
-        };
-        const timer = setTimeout(() => {
-          finish(
-            new Error(
-              `frogoe tunnel: no URL from cloudflared within ${timeoutMs / 1e3}s \u2014 check your internet, or brew install cloudflared`
-            )
-          );
-        }, timeoutMs);
-        child.once("exit", (code) => {
-          if (!settled) {
-            finish(new Error(`frogoe tunnel: cloudflared exited early (code ${code ?? "signal"})`));
-          }
-        });
-        const watch2 = (stream) => {
-          stream.on("data", (data) => {
-            if (settled && url) return;
-            buffer += data.toString("utf-8");
-            const found = parseTunnelUrl(buffer);
-            if (found && !url) {
-              url = found;
-              finish();
-            }
-          });
-        };
-        if (child.stderr && child.stdout) {
-          watch2(child.stderr);
-          watch2(child.stdout);
-        }
-      });
-    };
-  }
-});
-
 // src/commands/run.ts
 var run_exports2 = {};
 __export(run_exports2, {
@@ -4643,9 +5370,9 @@ var init_run2 = __esm({
 
 // src/utils/skillsManifest.ts
 import { execFile } from "child_process";
-import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync12, readdirSync as readdirSync3, readFileSync as readFileSync13, statSync as statSync3 } from "fs";
-import { homedir } from "os";
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync15, readdirSync as readdirSync4, readFileSync as readFileSync15, statSync as statSync4 } from "fs";
+import { homedir as homedir2 } from "os";
 import { isAbsolute, join, relative, resolve, sep } from "path";
 import { promisify } from "util";
 function isCoreSkill(name) {
@@ -4654,10 +5381,10 @@ function isCoreSkill(name) {
 function listFilesSorted(dir) {
   const out = [];
   const walk = (d) => {
-    for (const name of readdirSync3(d)) {
+    for (const name of readdirSync4(d)) {
       if (name === ".DS_Store") continue;
       const p = join(d, name);
-      if (statSync3(p).isDirectory()) walk(p);
+      if (statSync4(p).isDirectory()) walk(p);
       else out.push(p);
     }
   };
@@ -4666,13 +5393,13 @@ function listFilesSorted(dir) {
 }
 function hashSkillBundle(skillDir) {
   const files = listFilesSorted(skillDir);
-  const h = createHash3("sha256");
+  const h = createHash4("sha256");
   for (const f of files) {
     const rel = relative(skillDir, f).split(sep).join("/");
     h.update(rel);
     h.update("\0");
     const ext = rel.slice(rel.lastIndexOf("."));
-    const buf = readFileSync13(f);
+    const buf = readFileSync15(f);
     if (TEXT_EXT.has(ext)) h.update(buf.toString("utf8").replace(/\r\n/g, "\n"), "utf8");
     else h.update(buf);
     h.update("\0");
@@ -4680,7 +5407,7 @@ function hashSkillBundle(skillDir) {
   return { hash: h.digest("hex").slice(0, 16), files: files.length };
 }
 function buildManifest2(skillsRoot, meta) {
-  const names = readdirSync3(skillsRoot).filter((n) => existsSync12(join(skillsRoot, n, "SKILL.md"))).sort();
+  const names = readdirSync4(skillsRoot).filter((n) => existsSync15(join(skillsRoot, n, "SKILL.md"))).sort();
   const skills = {};
   for (const name of names) skills[name] = hashSkillBundle(join(skillsRoot, name));
   return { source: meta.source, skills };
@@ -4696,7 +5423,7 @@ function agentFromDir(dir) {
 }
 function listSubdirs(dir) {
   try {
-    return readdirSync3(dir, { withFileTypes: true }).filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => e.name);
+    return readdirSync4(dir, { withFileTypes: true }).filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => e.name);
   } catch {
     return [];
   }
@@ -4705,7 +5432,7 @@ function discoverSkillRoots(base, scope) {
   const candidates = [];
   const add = (hostBase, host) => {
     const dir = join(hostBase, host, "skills");
-    if (existsSync12(dir) && statSync3(dir).isDirectory())
+    if (existsSync15(dir) && statSync4(dir).isDirectory())
       candidates.push({ dir, agent: agentLabel(host), scope });
   };
   for (const host of listSubdirs(base)) add(base, host);
@@ -4732,18 +5459,18 @@ function scopeForDir(dir, home, cwd) {
 }
 function locateInstall(skillNames, opts = {}) {
   if (opts.dir) {
-    return existsSync12(opts.dir) ? {
+    return existsSync15(opts.dir) ? {
       dir: opts.dir,
       agent: agentFromDir(opts.dir),
-      scope: scopeForDir(opts.dir, opts.home ?? homedir(), opts.cwd ?? process.cwd())
+      scope: scopeForDir(opts.dir, opts.home ?? homedir2(), opts.cwd ?? process.cwd())
     } : null;
   }
   const roots = [
-    ...discoverSkillRoots(opts.home ?? homedir(), "global"),
+    ...discoverSkillRoots(opts.home ?? homedir2(), "global"),
     ...discoverSkillRoots(opts.cwd ?? process.cwd(), "project")
   ];
   for (const root of roots) {
-    if (skillNames.some((n) => existsSync12(join(root.dir, n, "SKILL.md")))) return root;
+    if (skillNames.some((n) => existsSync15(join(root.dir, n, "SKILL.md")))) return root;
   }
   return null;
 }
@@ -4751,7 +5478,7 @@ function hashInstalled(root, skillNames) {
   const out = {};
   for (const name of skillNames) {
     const skillDir = join(root.dir, name);
-    if (existsSync12(join(skillDir, "SKILL.md"))) out[name] = hashSkillBundle(skillDir);
+    if (existsSync15(join(skillDir, "SKILL.md"))) out[name] = hashSkillBundle(skillDir);
   }
   return out;
 }
@@ -4788,7 +5515,7 @@ function findRepoManifest(cwd = process.cwd()) {
   let dir = cwd;
   for (let i = 0; i < 16; i++) {
     const p = join(dir, MANIFEST_FILE);
-    if (existsSync12(p)) return p;
+    if (existsSync15(p)) return p;
     const parent = join(dir, "..");
     if (parent === dir) break;
     dir = parent;
@@ -4828,9 +5555,9 @@ async function remoteHeadSha(repoSlug) {
 }
 function resolveLocalManifest(source) {
   const direct = source.endsWith(".json") ? source : join(source, MANIFEST_FILE);
-  if (existsSync12(direct)) return JSON.parse(readFileSync13(direct, "utf8"));
+  if (existsSync15(direct)) return JSON.parse(readFileSync15(direct, "utf8"));
   const skillsRoot = source.endsWith("skills") ? source : join(source, "skills");
-  if (existsSync12(skillsRoot)) return buildManifest2(skillsRoot, { source: skillsRoot });
+  if (existsSync15(skillsRoot)) return buildManifest2(skillsRoot, { source: skillsRoot });
   throw new Error(`No skills manifest found at: ${source}`);
 }
 async function fetchRemoteManifest(source) {
@@ -4853,7 +5580,7 @@ async function resolveLatestManifest(source, cwd = process.cwd(), opts = {}) {
   }
   if (!source && !opts.canonical) {
     const repoManifest = findRepoManifest(cwd);
-    if (repoManifest) return JSON.parse(readFileSync13(repoManifest, "utf8"));
+    if (repoManifest) return JSON.parse(readFileSync15(repoManifest, "utf8"));
   }
   return fetchRemoteManifest(source);
 }
@@ -5120,7 +5847,7 @@ import { defineCommand as defineCommand11, runMain } from "citty";
 // package.json
 var package_default = {
   name: "frogoe",
-  version: "0.5.5",
+  version: "0.7.0",
   description: "froge CLI \u2014 the agent's hands: init, add, run, check, bundle",
   homepage: "https://github.com/frogoe/engine#readme",
   bugs: "https://github.com/frogoe/engine/issues",