DUCK STRIKE
A browser low-poly FPS: endless AI waves in a single arena, CS-style buy phases between waves, a boss every 5 waves, and a global leaderboard on death.
The seven dimensions
memoryTechnical Depth 7/10
A self-built FPS stack that holds up: hitscan rays with separate head/body hitboxes, LOS occlusion rays, sqrt(random) uniform disc spread, trauma-squared camera shake. The gem is the dual-timeline bullet time — the world runs on scaled dt while the player and weapons keep real time (game.ts:586-600). Enemy AI is layered greedy avoidance without a navmesh: straight → axis-slide → angle-scan → side-lock. No real pathfinding, and the single small arena means hard perf problems never had to be solved.
stadia_controllerGame Design 7/10
An interlocking loop: kill bounties + streak bonuses + headshot rewards fund the between-wave armory; streak thresholds grant heal/berserk/ammo; kills charge a time-slow ultimate; meta upgrades persist. Six weapons and six behaviorally distinct enemies. The real standout is the touch scheme: the fire button doubles as look — hold to shoot, drag the same finger to aim — solving the two-thumb conflict. One map only, and the boss's flagship abilities never actually trigger (see quality).
securityBackend & Security 6/10
Real deployed backend with above-average awareness: parameterized queries, sanitizers, difficulty whitelists, score plausibility clamps (killCap = wave²·3+150), and a self-built D1 rate limiter designed fail-open. But the trust model is still 'believe the client': the wave field accepts up to 100,000 — reporting wave=200 defeats the killCap — Turnstile was added server-side but never wired into the client, and the original admin key '7351' shipped hardcoded before being rotated (the old key still sits in BACKEND.md).
codeCode Quality 7/10
The best-structured of the five: strict TS, a 230-line commented config.ts data layer, small focused modules (largest file 681 lines), minimal interfaces to break circular deps. But shipping without tests left a real bug: maxHpRuntime is declared and never assigned (enemies.ts:53), so the boss's enrage and minion-summon phases — headline features in the README — are dead code; the health bar also divides by unscaled HP.
experimentTesting 1.5/10
Zero automated tests, no CI. The only defense is build-time typecheck. The never-triggering boss enrage is exactly the regression a minimal unit test would have caught — the direct cost of the gap. Half a point back for the README_AI discipline of 'trust exit codes, not claims'.
verifiedCompleteness 7.5/10
Full-chain delivery in a week: deployed playable build, intro page with 8 screenshots, desktop+mobile input, synthesized SFX plus a 5-style step-sequencer soundtrack, an off-screen-rendered enemy codex, leaderboard/message board/online charts, and four docs with recorded pitfalls. Docked for the single map and for documented boss abilities that are actually dead code.
emoji_objectsOriginality 4.5/10
The most formulaic of the five: wave survival + CS buy economy + COD-zombies structure, and the 'duck' theme exists only in strings — the models are soldier asset packs; even the player isn't a duck. Real original touches: the kill-charged time-slow ultimate, the companion attack dog with aggro transfer, and the fire-button-as-look touch design.
trending_upHighlights
- Dual-timeline bullet time — world on scaled dt, player at full speed, charge drains in real time, early-cancel keeps the remainder (
game.ts:586-600) - Zero-file procedural audio — all SFX synthesized, plus a parameterized 5-style step-sequencer soundtrack (
sound.ts,music.ts) - Layered navmesh-free avoidance — straight → axis-slide → ±110° scan → 0.5 s side-lock debounce, each layer's intent commented (
enemies.ts:312-347) - Fail-open D1 rate limiting + score clamps — self-built because *.pages.dev has no WAF; players never get hurt by limiter errors (
_lib.ts:76-96) - SECURITY_INCIDENT.md — a first-hand record of prompt-injection attempts against the agentic dev workflow itself
trending_downWeaknesses
- Boss enrage/summon is dead code —
maxHpRuntimenever assigned, so the HP-phase check always reads 100% (enemies.ts:53) - Zero tests, zero CI — the reason the bug above shipped and survived
- Leaderboard forgeable — wave accepts 100k, Turnstile client never wired, deviceId self-reported (
run.ts,App.vue:55) - Heartbeat unthrottled — fake deviceIds can inflate the online-count headline number (
heartbeat.ts) - Key-hygiene history — admin key
'7351'shipped hardcoded; the stale key still documented in BACKEND.md
Rare artifact: a prompt-injection incident log
SECURITY_INCIDENT.md records attacks the AI workflow encountered mid-development: payloads injected through tool-result channels, a gift-card social-engineering lure, and fake tool-success messages.
For a hobby game repo to ship a security incident report about its own AI development process is — as of 2026 — genuinely unusual, and a useful primary source on agentic-coding threat models.
smart_toyAI-assisted development
All 27 commits co-authored by Claude Opus 4.8 (1M context). The repo contains README_AI.md — a handover doc written for 'the next AI' — and SECURITY_INCIDENT.md documenting prompt-injection attempts during development: rare first-person evidence of an agentic workflow. Cadence: six commits in 47 minutes; a gyroscope feature added and reverted within 13 minutes.
summarizeFacts
| Stack | Vue 3 · TypeScript · Babylon.js 7 · Tailwind 4 · Vite · CF Pages Functions · D1 |
|---|---|
| Genre | Wave-survival FPS |
| Period | 2026-06-26 → 2026-07-02 |
| Active dev days | 4 days |
| Commits | 27 |
| Lines of code | ~5,000 |
| Author | craig7351 (Book AI) |
Verdict
The best code structure of the five and a clever touch-input idea, undercut by the series' recurring flaw at its most visible: a marquee boss feature that never runs because nothing ever tested it.