From b57c4c075ff2f5c3ab1a74f146a9dd088f27c2a5 Mon Sep 17 00:00:00 2001
From: Ein Anderssono <einand@3gdev.com>
Date: Mon, 19 Oct 2026 12:03:51 +0200
Subject: [PATCH] Gate local Gemma behind explicit terms acceptance

---
 AGENTS.md                           |  2 ++
 README.md                           |  2 +-
 index.html                          | 54 +++++++++++++++++++++++++++--
 piper-worker.js                     |  2 ++
 scripts/check-frontend.sh           |  8 +++++
 tests/local-ai-integration.test.cjs | 28 +++++++++++++++
 6 files changed, 93 insertions(+), 3 deletions(-)
 create mode 100644 tests/local-ai-integration.test.cjs

diff --git a/AGENTS.md b/AGENTS.md
index 14d7590..1053a64 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -10,3 +10,5 @@
 - Helm charts are published to `harbor.k3s.k0.nu/ai-spel`; Argo CD uses the existing `ai-spel` project and namespace.
 - Player-facing speech uses the local Piper WebAssembly adapter when the player has activated audio. The separate `ai-spel-static` Nginx service serves pinned Swedish Piper models and ONNX/Piper runtime files from same-origin `/static/piper-wasm-v1/` URLs with immutable caching. Game text is synthesized on-device and must never be sent to a TTS provider.
 - This pipeline bundles only the Piper worker/client glue. Model/runtime downloads, image builds, and deployment belong to `ai-spel/ai-spel-static` and the existing `large` runner. Never build or run these assets locally.
+- Browser local AI loads its client adapter, Wllama runtime, WebAssembly, Gemma model, manifest, YAML prompt, and license resources only from the same-origin `/static/wllama-gemma3-v1/` path owned by `ai-spel/ai-spel-static`. Do not add browser CDN, npm, or model-hub fallbacks. The player must be shown and accept applicable model terms before the model downloads or runs. Acceptance, model failure, or local-AI opt-out must never block play. Incompatible asset changes require a new immutable static path and a coordinated frontend release.
+- Local model output is advisory only. Preserve the original player input, send local hints only as untrusted context to Rust, and label offline replies as unsaved. Local diagnostic logging is opt-in, browser-local, exportable/deletable, and expires after 30 days.
diff --git a/README.md b/README.md
index 774f2a8..ec112be 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ After login, character creation and play use one dialogue history and one text i
 
 During play the UI has no persistent location, task, inventory, economy, status, or purchase panels. The player asks for information or writes an action in the same input. Rust validates state changes; the AI can only propose a typed intent. A direct request to travel may establish a new place and an encounter when Rust commits that movement.
 
-The dialogue also offers **Gör om senaste** and **Torrkör senaste**. Both resend the latest player action while leaving the previous dialogue turn out of the AI conversation context. “Gör om” processes a fresh, normal turn. “Torrkör” calls the narrator and evaluates already-approved stored Luau rules, then rolls back the complete game transaction; it does not save the player turn, AI trace, rule, event, ownership, or world progress. A rule that would need to be newly generated is reported as not evaluated, because a dry run never stores newly generated rules.
+The dialogue also offers **Gör om senaste** and **Torrkör senaste**. Both resend the latest player action while leaving the previous dialogue turn out of the AI conversation context. “Gör om” processes a fresh, normal turn. “Torrkör” calls the narrator, generates and validates a temporary Luau rule when needed, and evaluates either that temporary rule or an approved stored rule. It rolls back the complete game transaction and does not save the player turn, AI trace, generated rule, event, ownership, or world progress. The reply identifies which rule was evaluated and marks a temporary rule as such.
 
 If the player asks to find or approach someone and no NPC is present, the direct dialogue scene may propose one person and an opening line. Rust creates that NPC only for the explicit request and commits the first exchange idempotently; a later turn continues the saved conversation. Clear requests about the current location are answered from its saved facts without asking the player to restate what they want to inspect.
 
diff --git a/index.html b/index.html
index e3ee866..7043686 100644
--- a/index.html
+++ b/index.html
@@ -116,6 +116,7 @@
   <footer id="version-footer">Frontend <span id="frontend-version">__FRONTEND_VERSION__</span> · Statik <span id="static-version">hämtar version…</span> · API <span id="api-version">hämtar version…</span></footer>
   <script src="/piper-runtime.js?v=__FRONTEND_VERSION__"></script>
   <script src="/voice.js?v=__FRONTEND_VERSION__"></script>
+  <script src="/static/wllama-gemma3-v1/local-ai.js"></script>
   <script>
     const auth = document.querySelector('#auth');
     const play = document.querySelector('#play');
@@ -162,6 +163,7 @@
       line.dataset.role = role;
       line.textContent = `${options.speaker || (role === 'user' ? 'Du' : 'Berättelsen')}: ${content}`;
       transcript.append(line);
+      if (role === 'user' || role === 'assistant') window.localGameAI?.record({type: 'dialogue', role, content});
       line.scrollIntoView({block: 'end'});
       if (role === 'assistant') {
         latestAssistantText = content;
@@ -206,6 +208,28 @@
       const authVoiceStatus = document.querySelector('#auth-voice-status');
       if (authVoiceStatus && !auth.hidden && message) authVoiceStatus.textContent = message;
     }
+    window.addEventListener('local-ai-status', event => {
+      if (!currentAccount || currentAccount.is_admin || play.hidden) return;
+      let statusLine = transcript.querySelector('li[data-local-ai-status]');
+      if (!statusLine) {
+        const detail = typeof event.detail === 'string' ? {text: event.detail} : event.detail;
+        statusLine = appendLine(detail.type === 'terms-required' ? 'assistant' : 'system', detail.text || '', {speaker: 'Lokal AI', speak: detail.type === 'terms-required'});
+        statusLine.dataset.localAiStatus = 'true';
+      }
+      const detail = typeof event.detail === 'string' ? {text: event.detail} : event.detail;
+      statusLine.replaceChildren(document.createTextNode(`Lokal AI: ${detail.text || ''}`));
+      if (detail.type === 'terms-required') {
+        statusLine.append(document.createTextNode(' Läs dokumenten: '));
+        for (const [label, url] of [['Spelvillkor för Gemma', detail.user_terms], ['Gemma-villkor', detail.terms], ['policy för förbjuden användning', detail.policy], ['modellinformation', detail.notice]]) {
+          if (!url) continue;
+          const link = document.createElement('a');
+          link.href = url; link.target = '_blank'; link.rel = 'noopener noreferrer';
+          link.textContent = label;
+          statusLine.append(link, document.createTextNode('. '));
+        }
+        statusLine.append(document.createElement('br'), document.createTextNode(detail.command || ''));
+      }
+    });
     function updateSpeechProgress(message = '') {
       const container = document.querySelector('#speech-progress-container');
       const progress = document.querySelector('#speech-progress');
@@ -700,6 +724,7 @@
       currentAccount = await request('/api/me');
       gameState = await request('/api/world');
       showPlay();
+      if (!currentAccount.is_admin) window.localGameAI?.start(currentAccount.id);
       if (!gameState.character) {
         transcript.replaceChildren();
         appendInitialPrompt();
@@ -866,6 +891,7 @@
       presenceTimer = null;
       playerMessagesPrimed = false;
       seenPlayerMessageIds.clear();
+      window.localGameAI?.stop();
       await request('/api/logout', {method: 'POST'});
       if (location.pathname !== '/admin') appendLine('assistant', 'Du har loggat ut. Logga in igen för att fortsätta spela.');
       characterDraft = null;
@@ -918,6 +944,12 @@
       document.querySelector('#dry-run-action').disabled = !enabled;
     }
     async function handleGameMessage(message, actionMode = 'normal') {
+      if (actionMode === 'normal' && /^lokal ai(?:\s|$)/i.test(message.trim())) {
+        const response = await window.localGameAI?.settings(message);
+        appendLine('user', message);
+        appendLine('assistant', response || 'Kommandon: “lokal ai villkor”, “lokal ai godkänn villkor”, “lokal ai avvisa villkor”, “lokal ai på/av”, “lokal ai loggar på/av”, “lokal ai exportera loggar” och “lokal ai radera loggar”.');
+        return;
+      }
       if (/^logga ut[.!]?$/i.test(message.trim())) {
         appendLine('user', message);
         await handleLogout();
@@ -946,13 +978,26 @@
       appendLine('user', message, actionMode === 'dry_run' ? {speaker: 'Torrkörning'} : actionMode === 'redo' ? {speaker: 'Gör om'} : {});
       messageField.disabled = true;
       try {
+        let clientAssistance = null;
+        if (actionMode === 'normal' && currentAccount && !currentAccount.is_admin && window.localGameAI) {
+          try {
+            const history = [...transcript.querySelectorAll('li')].map(line => line.textContent).filter(Boolean);
+            const assisted = await window.localGameAI.assist(message, history, gameState?.world || {});
+            clientAssistance = {
+              intent_hint: String(assisted.intent_hint || '').slice(0, 500),
+              warning: String(assisted.warning || '').slice(0, 500),
+              excerpts: Array.isArray(assisted.excerpts) ? assisted.excerpts.filter(item => typeof item === 'string' && item.length <= 500 && history.some(line => line.includes(item))).slice(0, 3) : [],
+            };
+            if (clientAssistance.warning) appendLine('system', `Lokal textkontroll: ${clientAssistance.warning}`, {speaker: 'Lokal AI', speak: false});
+          } catch (_) { /* Local assistance is optional; the original input always proceeds. */ }
+        }
         let result;
         for (let attempt = 0; attempt < 2; attempt += 1) {
           try {
             result = await request('/api/dialogue', {
               method: 'POST',
               headers: {'content-type': 'application/json'},
-              body: JSON.stringify({message, expected_world_version: gameState.world.version, idempotency_key: idempotencyKey, forget_previous_turn: actionMode !== 'normal', dry_run: actionMode === 'dry_run'}),
+              body: JSON.stringify({message, expected_world_version: gameState.world.version, idempotency_key: idempotencyKey, forget_previous_turn: actionMode !== 'normal', dry_run: actionMode === 'dry_run', client_assistance: clientAssistance}),
             });
             break;
           } catch (error) {
@@ -987,7 +1032,12 @@
         refreshActionTools();
       } catch (error) {
         messageField.value = message;
-        appendLine('assistant', `${explainDialogueError(error)} Ditt meddelande ligger kvar i inmatningen.`);
+        try {
+          const history = [...transcript.querySelectorAll('li')].map(line => line.textContent).filter(Boolean);
+          const localReply = await window.localGameAI?.offline(message, history, gameState?.world || {});
+          if (localReply) appendLine('assistant', `Lokalt, osparat förslag: ${localReply}`, {speaker: 'Lokal hjälp'});
+          else appendLine('assistant', `${explainDialogueError(error)} Ditt meddelande ligger kvar i inmatningen.`);
+        } catch (_) { appendLine('assistant', `${explainDialogueError(error)} Ditt meddelande ligger kvar i inmatningen.`); }
       }
       messageField.disabled = false;
       messageField.focus();
diff --git a/piper-worker.js b/piper-worker.js
index d5ee66b..be36ec0 100644
--- a/piper-worker.js
+++ b/piper-worker.js
@@ -18,6 +18,8 @@ self.fetch = async (resource, options) => {
   const requestedUrl = resource instanceof Request ? resource.url : String(resource);
   const localModelUrl = localPiperModelUrl(requestedUrl, self.location.origin);
   if (!localModelUrl) {
+    const requestUrl = new URL(requestedUrl, self.location.origin);
+    if (requestUrl.origin !== self.location.origin) throw new Error(`External Piper asset blocked: ${requestUrl.origin}`);
     const runtimeAsset = requestedUrl.includes('/static/piper-wasm-v1/onnx/');
     const runtimeFile = runtimeAsset ? new URL(requestedUrl, self.location.origin).pathname.split('/').pop() : undefined;
     if (activeRequestId && runtimeAsset) {
diff --git a/scripts/check-frontend.sh b/scripts/check-frontend.sh
index 22adcbd..d1df467 100755
--- a/scripts/check-frontend.sh
+++ b/scripts/check-frontend.sh
@@ -5,6 +5,7 @@ test -s index.html
 grep -q '<html lang="sv">' index.html
 grep -q 'id="frontend-version">__FRONTEND_VERSION__' index.html
 grep -q '<script src="/voice.js?v=__FRONTEND_VERSION__"></script>' index.html
+grep -q '<script src="/static/wllama-gemma3-v1/local-ai.js"></script>' index.html
 grep -q '<script src="/piper-runtime.js?v=__FRONTEND_VERSION__"></script>' index.html
 grep -q 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0' nginx/default.conf
 grep -q 'Cross-Origin-Embedder-Policy "require-corp"' nginx/default.conf
@@ -46,6 +47,12 @@ grep -q 'WebKit versions before Safari 27' voice.js
 grep -q "voiceIdentity: speakingNpc.voice_identity" index.html
 grep -q "role: 'narrator', voiceIdentity: 'neutral'" index.html
 grep -q 'COPY voice.js /usr/share/nginx/html/voice.js' Dockerfile
+grep -Fq 'localGameAI?.start(currentAccount.id)' index.html
+grep -q "type === 'terms-required'" index.html
+grep -q 'Gemma-villkor' index.html
+grep -q 'lokal ai godkänn villkor' index.html
+grep -q 'lokal ai avvisa villkor' index.html
+grep -q 'client_assistance: clientAssistance' index.html
 grep -q 'COPY public/piper-runtime.js /usr/share/nginx/html/piper-runtime.js' Dockerfile
 grep -q 'COPY public/tts/piper-wasm-v1/' Dockerfile
 grep -q 'build:piper' .gitea/workflows/publish.yaml
@@ -55,6 +62,7 @@ grep -q "new Worker(workerUrl, {type: 'module'})" piper-runtime.js
 grep -q 'worker.js?v=' piper-runtime.js
 grep -q 'worker.onmessageerror' piper-runtime.js
 grep -q 'localPiperModelUrl' piper-worker.js
+grep -q 'External Piper asset blocked' piper-worker.js
 grep -q 'trackDownloadProgress' piper-worker.js
 grep -q 'new ReadableStream' piper-download-progress.mjs
 grep -q 'createOnnxWasmPaths(self.location.origin)' piper-worker.js
diff --git a/tests/local-ai-integration.test.cjs b/tests/local-ai-integration.test.cjs
new file mode 100644
index 0000000..3193fad
--- /dev/null
+++ b/tests/local-ai-integration.test.cjs
@@ -0,0 +1,28 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const test = require('node:test');
+
+const page = fs.readFileSync(path.join(__dirname, '..', 'index.html'), 'utf8');
+
+test('local AI adapter comes from the static service and starts after authenticated game entry', () => {
+  assert.match(page, /<script src="\/static\/wllama-gemma3-v1\/local-ai\.js"><\/script>/);
+  assert.match(page, /showPlay\(\);\s*if \(!currentAccount\.is_admin\) window\.localGameAI\?\.start\(currentAccount\.id\)/);
+});
+
+test('Gemma license links are shown in the accessible game dialogue and consent can be withdrawn', () => {
+  assert.match(page, /type === 'terms-required'/);
+  assert.match(page, /Gemma-villkor/);
+  assert.match(page, /Spelvillkor för Gemma/);
+  assert.match(page, /policy för förbjuden användning/);
+  assert.match(page, /lokal ai godkänn villkor/);
+  assert.match(page, /lokal ai avvisa villkor/);
+  assert.match(page, /window\.localGameAI\?\.stop\(\)/);
+});
+
+test('local assistance remains advisory and preserves the normal dialogue request path', () => {
+  assert.match(page, /client_assistance: clientAssistance/);
+  assert.match(page, /Local assistance is optional; the original input always proceeds/);
+  assert.match(page, /request\('\/api\/dialogue'/);
+  assert.match(page, /Lokalt, osparat förslag:/);
+});