Quality, security, and accessibility pass

next.config.ts

@@ -1,8 +1,41 @@
 import type { NextConfig } from "next";
 
+/**
+ * Content-Security-Policy. Google Maps (loaded at runtime in venue-map.tsx) needs
+ * maps.googleapis.com for scripts/XHR and the *.gstatic/*.google hosts for tiles;
+ * Next.js + Tailwind emit inline scripts/styles, hence 'unsafe-inline'. Applied
+ * only in production so it can't interfere with the dev server's HMR/eval.
+ */
+const CSP = [
+  "default-src 'self'",
+  "base-uri 'self'",
+  "form-action 'self'",
+  "frame-ancestors 'none'",
+  "object-src 'none'",
+  "img-src 'self' data: blob: https://*.googleapis.com https://*.gstatic.com https://*.google.com",
+  "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com",
+  "style-src 'self' 'unsafe-inline'",
+  "font-src 'self' data:",
+  "connect-src 'self' https://maps.googleapis.com https://*.googleapis.com",
+  "worker-src 'self' blob:",
+].join("; ");
+
+const securityHeaders = [
+  { key: "X-Frame-Options", value: "DENY" },
+  { key: "X-Content-Type-Options", value: "nosniff" },
+  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+  { key: "Permissions-Policy", value: "camera=(), geolocation=(), microphone=(self)" },
+  ...(process.env.NODE_ENV === "production"
+    ? [{ key: "Content-Security-Policy", value: CSP }]
+    : []),
+];
+
 const nextConfig: NextConfig = {
   // Standalone output produces a self-contained server.js for the Cloud Run Dockerfile.
   output: "standalone",
+  async headers() {
+    return [{ source: "/:path*", headers: securityHeaders }];
+  },
 };
 
 export default nextConfig;

src/app/api/briefing/route.ts

@@ -60,6 +60,10 @@ export async function POST(req: NextRequest) {
   } catch {
     return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
   }
+  // Normalize the client-supplied collections so a malformed body can't throw a
+  // TypeError mid-handler (which would surface as a misleading Gemini-shaped 500).
+  body.incidents = Array.isArray(body.incidents) ? body.incidents : [];
+  body.recentEvents = Array.isArray(body.recentEvents) ? body.recentEvents : [];
   const isHandover = req.nextUrl.searchParams.get("type") === "handover";
 
   try {

src/app/api/copilot/route.ts

@@ -2,6 +2,7 @@ import { NextResponse, type NextRequest } from "next/server";
 import { Type, type FunctionDeclaration } from "@google/genai";
 import { geminiErrorMessage, getClient, getModel } from "@/lib/gemini";
 import { DEMO_VENUE } from "@/shared/constants";
+import { STAFF_ROLES } from "@/shared/models";
 
 export const dynamic = "force-dynamic";
 
@@ -12,6 +13,9 @@ export const dynamic = "force-dynamic";
  * tool calls are returned to the client, which executes them locally.
  */
 
+/** Most recent chat turns sent to the model — bounds prompt size and cost. */
+const MAX_HISTORY = 12;
+
 interface ChatMessage {
   role: "user" | "assistant";
   text: string;
@@ -53,16 +57,7 @@ const TOOL_DECLARATIONS: FunctionDeclaration[] = [
       properties: {
         role: {
           type: Type.STRING,
-          enum: [
-            "catering",
-            "concessions",
-            "stewarding",
-            "security",
-            "medical",
-            "facilities",
-            "traffic",
-            "logistics",
-          ],
+          enum: [...STAFF_ROLES],
         },
         title: { type: Type.STRING },
         detail: { type: Type.STRING, description: "Specific, actionable instruction" },
@@ -99,7 +94,7 @@ export async function POST(req: NextRequest) {
   } catch {
     return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
   }
-  const history = (body.messages ?? []).slice(-12).filter((m) => m.text?.trim());
+  const history = (body.messages ?? []).slice(-MAX_HISTORY).filter((m) => m.text?.trim());
   if (history.length === 0 || history[history.length - 1].role !== "user") {
     return NextResponse.json({ error: "Last message must be from the user" }, { status: 400 });
   }

src/app/api/demand/route.ts

@@ -2,42 +2,19 @@ import { NextResponse, type NextRequest } from "next/server";
 import { Type } from "@google/genai";
 import { geminiErrorMessage, generateJson } from "@/lib/gemini";
 import { DEMO_VENUE } from "@/shared/constants";
-import type {
-  DemandLine,
-  DemandPlan,
-  StaffRole,
-  StaffTask,
-  SupplyItem,
-  WeatherForecast,
+import {
+  clampPriority,
+  STAFF_ROLES,
+  SUPPLY_ITEMS,
+  type DemandLine,
+  type DemandPlan,
+  type StaffTask,
+  type SupplyItem,
+  type WeatherForecast,
 } from "@/shared/models";
 
 export const dynamic = "force-dynamic";
 
-const SUPPLY_ITEMS: SupplyItem[] = [
-  "umbrella",
-  "poncho",
-  "bottled-water",
-  "cold-drink",
-  "hot-beverage",
-  "hot-food",
-  "cold-food",
-  "handheld-fan",
-  "blanket",
-  "ice",
-  "energy-drink",
-];
-
-const STAFF_ROLES: StaffRole[] = [
-  "catering",
-  "concessions",
-  "stewarding",
-  "security",
-  "medical",
-  "facilities",
-  "traffic",
-  "logistics",
-];
-
 /** Opening stock on hand, so the model computes real shortfalls (gap). */
 const DEFAULT_STOCK: Record<SupplyItem, number> = {
   umbrella: 200,
@@ -71,7 +48,7 @@ const DEMAND_SCHEMA = {
       items: {
         type: Type.OBJECT,
         properties: {
-          item: { type: Type.STRING, enum: SUPPLY_ITEMS },
+          item: { type: Type.STRING, enum: [...SUPPLY_ITEMS] },
           predictedUnits: { type: Type.INTEGER },
           currentStock: { type: Type.INTEGER },
           driver: { type: Type.STRING },
@@ -85,7 +62,7 @@ const DEMAND_SCHEMA = {
       items: {
         type: Type.OBJECT,
         properties: {
-          role: { type: Type.STRING, enum: STAFF_ROLES },
+          role: { type: Type.STRING, enum: [...STAFF_ROLES] },
           title: { type: Type.STRING },
           detail: { type: Type.STRING },
           priority: { type: Type.INTEGER },
@@ -116,10 +93,15 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
   }
 
+  const attendance = Number(body.attendance);
+  if (!Number.isFinite(attendance)) {
+    return NextResponse.json({ error: "attendance must be a number" }, { status: 400 });
+  }
+
   const stock = { ...DEFAULT_STOCK, ...(body.currentStock ?? {}) };
   const prompt = [
     `Match clock: minute ${body.minute} (kickoff at 60), phase ${body.phase}.`,
-    `Expected attendance: ${body.attendance.toLocaleString()}.`,
+    `Expected attendance: ${attendance.toLocaleString()}.`,
     "",
     "Weather forecast:",
     JSON.stringify(body.weather, null, 2),
@@ -144,6 +126,7 @@ export async function POST(req: NextRequest) {
     };
     const tasks: StaffTask[] = gen.prepTasks.map((t, i) => ({
       ...t,
+      priority: clampPriority(t.priority),
       id: `task-dmd-${body.minute}-${i}`,
       createdAtMinute: body.minute,
       origin: "demand",

src/app/api/emergency/route.ts

@@ -3,7 +3,15 @@ import { Type } from "@google/genai";
 import { geminiErrorMessage, generateJson } from "@/lib/gemini";
 import { addTask } from "@/lib/store";
 import { DEMO_VENUE } from "@/shared/constants";
-import type { EvacuationPlan, EvacZoneOrder, Incident, StaffRole, StaffTask } from "@/shared/models";
+import {
+  clampPriority,
+  STAFF_ROLES,
+  type EvacuationPlan,
+  type EvacZoneOrder,
+  type Incident,
+  type StaffRole,
+  type StaffTask,
+} from "@/shared/models";
 
 export const dynamic = "force-dynamic";
 
@@ -21,16 +29,6 @@ interface EmergencyRequest {
 }
 
 const ZONE_IDS = DEMO_VENUE.zones.map((z) => z.id);
-const STAFF_ROLES: StaffRole[] = [
-  "catering",
-  "concessions",
-  "stewarding",
-  "security",
-  "medical",
-  "facilities",
-  "traffic",
-  "logistics",
-];
 
 const EVAC_SCHEMA = {
   type: Type.OBJECT,
@@ -55,7 +53,7 @@ const EVAC_SCHEMA = {
       items: {
         type: Type.OBJECT,
         properties: {
-          role: { type: Type.STRING, enum: STAFF_ROLES },
+          role: { type: Type.STRING, enum: [...STAFF_ROLES] },
           title: { type: Type.STRING },
           detail: { type: Type.STRING },
           priority: { type: Type.INTEGER },
@@ -110,7 +108,7 @@ export async function POST(req: NextRequest) {
       commandSummary: gen.commandSummary,
       zoneOrders: gen.zoneOrders.map((o) => ({
         ...o,
-        priority: Math.min(3, Math.max(1, Math.round(o.priority))) as 1 | 2 | 3,
+        priority: clampPriority(o.priority),
         zoneName: DEMO_VENUE.zones.find((z) => z.id === o.zoneId)?.name ?? o.zoneId,
       })),
     };
@@ -120,7 +118,7 @@ export async function POST(req: NextRequest) {
         role: t.role,
         title: `[EVAC] ${t.title}`,
         detail: t.detail,
-        priority: Math.min(3, Math.max(1, Math.round(t.priority))) as 1 | 2 | 3,
+        priority: clampPriority(t.priority),
         origin: "emergency",
         createdAtMinute: body.minute,
         dueBy: "immediately",

src/app/api/sim/route.ts

@@ -14,6 +14,14 @@ export async function POST(req: NextRequest) {
   if (body.type !== "speed" && body.type !== "jump" && body.type !== "restart") {
     return NextResponse.json({ error: "Unknown control type" }, { status: 400 });
   }
+  // Guard the numeric payloads: a non-finite tickMs/toMinute would otherwise
+  // reach the clamp as NaN and feed setInterval(NaN) / an infinite jump loop.
+  if (body.type === "speed" && !Number.isFinite(body.tickMs)) {
+    return NextResponse.json({ error: "tickMs must be a finite number" }, { status: 400 });
+  }
+  if (body.type === "jump" && !Number.isFinite(body.toMinute)) {
+    return NextResponse.json({ error: "toMinute must be a finite number" }, { status: 400 });
+  }
   const live = getLiveMatch();
   live.control(body);
   return NextResponse.json({ ok: true, minute: live.minute });

src/app/api/tasks/route.ts

@@ -1,19 +1,11 @@
 import { NextResponse, type NextRequest } from "next/server";
 import { addTask, listTasks } from "@/lib/store";
-import type { StaffRole, TaskOrigin } from "@/shared/models";
+import { clampPriority, STAFF_ROLES, type StaffRole, type TaskOrigin } from "@/shared/models";
 
 export const dynamic = "force-dynamic";
 
-const ROLES: StaffRole[] = [
-  "catering",
-  "concessions",
-  "stewarding",
-  "security",
-  "medical",
-  "facilities",
-  "traffic",
-  "logistics",
-];
+/** Reject oversized free-text so the in-memory store can't be bloated. */
+const MAX_FIELD_LEN = 500;
 
 const ORIGINS: TaskOrigin[] = [
   "incident",
@@ -47,10 +39,16 @@ export async function POST(req: NextRequest) {
   } catch {
     return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
   }
-  if (!ROLES.includes(body.role) || !body.title || !body.detail) {
+  if (!STAFF_ROLES.includes(body.role) || !body.title || !body.detail) {
     return NextResponse.json({ error: "role, title, and detail are required" }, { status: 400 });
   }
-  const priority = Math.min(3, Math.max(1, Math.round(body.priority ?? 2))) as 1 | 2 | 3;
+  if (body.title.length > MAX_FIELD_LEN || body.detail.length > MAX_FIELD_LEN) {
+    return NextResponse.json(
+      { error: `title and detail must be under ${MAX_FIELD_LEN} characters` },
+      { status: 400 },
+    );
+  }
+  const priority = clampPriority(body.priority ?? 2);
   const task = addTask({
     role: body.role,
     title: body.title,

src/app/globals.css

@@ -8,3 +8,16 @@ body {
   background: #0d0d0d;
   color: #c3c2b7;
 }
+
+/* Respect users who ask the OS to minimize motion: the density/queue bars
+   animate their width on every telemetry tick, which this disables. */
+@media (prefers-reduced-motion: reduce) {
+  *,
+  *::before,
+  *::after {
+    animation-duration: 0.01ms !important;
+    animation-iteration-count: 1 !important;
+    transition-duration: 0.01ms !important;
+    scroll-behavior: auto !important;
+  }
+}

src/components/copilot.tsx

@@ -114,7 +114,11 @@ export function Copilot({
         <p className="text-[11px] font-semibold uppercase tracking-wider" style={{ color: ACCENT }}>
           ✦ Control-room copilot
         </p>
-        <button onClick={() => setOpen(false)} className="text-sm text-[#898781] hover:text-white">
+        <button
+          onClick={() => setOpen(false)}
+          aria-label="Close copilot"
+          className="text-sm text-[#898781] hover:text-white"
+        >
           ✕
         </button>
       </div>
@@ -171,6 +175,7 @@ export function Copilot({
           value={input}
           onChange={(e) => setInput(e.target.value)}
           placeholder="Ask or command…"
+          aria-label="Message the control-room copilot"
           className="min-w-0 flex-1 rounded border border-white/10 bg-[#0d0d0d] px-2.5 py-1.5 text-sm text-white placeholder:text-[#898781] focus:outline-none"
         />
         <button