Universal-AI/index.html at main · TechLuddite/Universal-AI · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
<!doctype html>
<html lang="en">
  <head>
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />

    <!--
      Content Security Policy — the network guarantee, in enforceable form.

      There is no backend. The page has no analytics, no telemetry, no fonts,
      no trackers, and no API. `connect-src` lists the only origins this page
      is permitted to reach, ever:

        huggingface.co, *.hf.co      model weights, if you opt into WebLLM
        raw.githubusercontent.com    the compiled model libraries

      Those are contacted only when you explicitly choose the WebLLM Overseer
      and press download. The default Utility Engine contains no network code
      at all, so on a default game nothing leaves your machine — open DevTools
      and watch. What CSP guarantees on top of that is the harder part: even a
      compromised dependency could not exfiltrate anything anywhere else.

      `wasm-unsafe-eval` is required to compile WebLLM's WebAssembly. It does
      not permit eval() of JavaScript.
    -->
    <meta
      http-equiv="Content-Security-Policy"
      content="
        default-src 'self';
        script-src 'self' 'wasm-unsafe-eval';
        worker-src 'self' blob:;
        style-src 'self' 'unsafe-inline';
        img-src 'self' data: blob:;
        font-src 'self';
        connect-src 'self' blob: data: https://huggingface.co https://*.hf.co https://raw.githubusercontent.com;
        form-action 'none';
        base-uri 'self';
        object-src 'none'
      "
    />
    <!--
      No `frame-ancestors` here: it is ignored when delivered via <meta>, and
      GitHub Pages cannot set response headers, so clickjacking protection
      isn't available on this host. Listing it anyway would only imply a
      protection that isn't there.
    -->


    <title>Universal AI — an idle game about optimization</title>
    <meta
      name="description"
      content="A Universal Paperclips tribute. Build NPU chips, hand the wheel to an autonomous Overseer, and watch what optimization does when nobody stops it. Runs entirely in your browser."
    />
    <meta name="theme-color" content="#0c0a09" />
    <meta name="color-scheme" content="dark" />

    <link rel="manifest" href="./manifest.webmanifest" />
    <link rel="icon" href="./icon.svg" type="image/svg+xml" />

    <!--
      Boot shell. Lives inside #root, so React wipes it on first render and it
      costs a healthy load nothing but the frames before the bundle parses.

      It exists because when the bundle *doesn't* parse, the page had nothing to
      say: `<div id="root">` on a dark background is a grey screen, identical
      whether the app is booting, the module 404'd, or the CSP blocked it. That
      is the same failure this repo keeps finding — a silent fallback that looks
      like the healthy path. This one announces itself: after eight seconds with
      no React, the diagnostic fades in.

      Pure CSS on purpose. `script-src 'self'` forbids inline script, but
      `style-src` allows 'unsafe-inline', so a timed reveal is the one mechanism
      available to a page whose JavaScript never arrived.
    -->
    <style>
      /* Preflight sets this too, but preflight ships in the bundle that may
         never arrive. Kept off `background` so the Cyberpunk palette's own
         slate body colour isn't overridden on a healthy load. */
      body { margin: 0; }
      #boot {
        min-height: 100vh;
        background: #0c0a09;
        display: flex;
        flex-direction: column;
        align-items: center;
        justify-content: center;
        gap: 0.75rem;
        padding: 2rem;
        text-align: center;
        font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
        color: #a8a29e;
      }
      #boot h1 { margin: 0; font-size: 1rem; font-weight: 600; color: #e7e5e4; letter-spacing: 0.08em; }
      #boot p  { margin: 0; font-size: 0.8125rem; line-height: 1.6; max-width: 34rem; }
      #boot a  { color: #a8a29e; }
      @keyframes boot-reveal { to { opacity: 1; } }
      /* Hidden until the bundle has had every reasonable chance to boot. */
      #boot .stalled { opacity: 0; animation: boot-reveal 400ms ease 8s forwards; }
      #boot .stalled strong { color: #fca5a5; font-weight: 600; }
    </style>
  </head>
  <body>
    <div id="root">
      <div id="boot">
        <h1>UNIVERSAL AI</h1>
        <p>Loading…</p>
        <p class="stalled">
          <strong>The application bundle did not load.</strong><br />
          Nothing is wrong with your browser — this page was served without its
          compiled assets. Reloading will not help. Please report it at
          <a href="https://github.com/TechLuddite/Universal-AI/issues">github.com/TechLuddite/Universal-AI/issues</a>.
        </p>
      </div>
    </div>
    <script type="module" src="/src/main.tsx"></script>
  </body>
</html>