No, I think I'm seeing the same bug. Time seems to sometimes subjectively freeze:
─── Messages ───
Old man shuts the gate behind you. You hear him mutter "every time, I swear..."
You must retrieve the Amulet of Lost Semicolons.
You kill the rat! (sneak attack!)
The rat squeals and dies!
You wait. (x10) ᛜ
ᚢ You kill the rat! (sneak attack!) ᛉ
The rat squeals and dies!
You hear muttering. ᛋ
You hear muttering.
You hear muttering.
You hear a distant creak. ᛖ ᛃ
The runestone crumbles as you touch it. You learn: ᛟ means "ice"! ᛚ
You hear a distant creak.
The goblin misses you. (x3)
The goblin hits you for 4.
The goblin hits you for 3. ᛏ
The goblin hits you for 4.
The goblin hits you for 3.
The goblin misses you. ᛚ
The goblin hits you for 4.
The goblin hits you for 2.
The goblin hits you for 4.
The goblin misses you.
The goblin hits you for 2.
The goblin misses you. (x2)
The goblin hits you for 2.
The goblin kills you!
You die...
Note how there were no user action messages during the time the goblin was attacking.
Definitely a bug. I'll look into this at some point. Please note that this is not a finished game by any means. If anyone asked I'd call it a tech demo at this point :)
Same, I've added a .#screenshots derivation. High up-front effort but almost zero maintenance afterwards.
Bonus: since you're generating screenshots programmatically anyway, you can generate a pair of each with your app's light/dark theme, and swap them in/out depending on prefers-color-scheme: dark. <picture> elements work in GitHub READMEs, too: https://github.com/CyberShadow/CyDo#readme
+1 for this approach. For a mobile app, I made Nix spawn an ephemeral Android emulator instance for generating up-to-date screenshots, requiring no prior setup and leaving no lingering data around after running. Setting it up wasn't that high-effort in my case either; coming up with the idea was the hard part, the Nix code was one-shot by your favorite LLM.
Granted manually updating the screenshots isn't the most laborious task in the world, but the "upload-apk + take-screenshot + transfer-back-to-PC + edit" process is usually barely annoying enough that you end up almost never doing it otherwise (similar to the OP's experience in the closing paragraph).
If you grant access to the Nix daemon socket but not writing outside the current directory, that's an effective sandbox. It allows evaluating derivations but not actually installing them.
If you invoke Claude Code with --input-format stream-json --output-format stream-json, you can use it headlessly. I built a personal UI / orchestration framework around it. Most features are available, but not exactly all (e.g. there is no way to undo via this protocol, but you can still do it manually by terminating / editing the session file / resuming). Other agentic software has similar features (Codex uses JSON-RPC, Copilot CLI has ACP which is also based on JSON-RPC).
Can you share what made this behavior obvious to you? E.g. when I first saw Open Code, it looked like yet another implementation of Claude Code, Codex-CLI, Gemini-CLI, Project Goose, etc. - all these are TUI apps for agentic coding. However, from these, only Open Code automatically started an unauthenticated web server when I simply started the TUI, so this came as a surprise to me.
> Browsers don't let random pages on the internet hit localhost without prompting you anymore
No, that's a Chrome-specific feature that Google added. It is not part of any standard, and does not exist in other browsers (e.g. Safari and Firefox).
> The rest is just code running as your user can talk to code running as your user
No, that assumes that there is only a single user on the machine, and there are either no forms of isolation or that all forms of isolation also use private network namespaces, which has not been how daemons are isolated in UNIX or by systemd. For example, if you were to ever run OpenCode as root, any local process can trivially gain root as well.
Huh? I have this permission in Firefox right now. It looks like Safari handles this with the OS local network permission.
True I did assume machines are single user, I haven't seen a shared computer in ages. Doing local development I have insecure/incomplete software listening on localhost all the time while developing it. And lots of people have passwordless sudo, or unprivileged access to the docker socket so protection against local processes running as me is not part of my threat model. And I know this is pretty dev centric but OpenCode is dev centric as well.
Looks like it's impossible for me to use this service - when I try to submit the form, I get a reCAPTCHA challenge. By the time I complete it (Google requires me to make several attempts, each one being several pages), the page errors out in the background with "reCAPTCHA execution timeout".
I don't think you understand. This website imposes its own time limit within which I must solve the CAPTCHA. Taking your time to solve the challenge slowly will not allow you to proceed, because the website's timeout will have expired.