From fda55a6ff04998d8ac9b8c312f6d2f3b462359a9 Mon Sep 17 00:00:00 2001
From: Nulled <63370961+Nul-led@users.noreply.github.com>
Date: Sat, 26 Sep 2026 08:58:59 +0200
Subject: [PATCH 1/4] chore: Enhance Privacy

---
 client/config.js |  2 ++
 client/loader.js | 55 +++++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/client/config.js b/client/config.js
index ec7bc023..2980a697 100644
--- a/client/config.js
+++ b/client/config.js
@@ -17,6 +17,8 @@
 */
 
 const BUILD = "6f59094d60f98fafc14371671d3ff31ef4d75d9e";
+// Update this SHA-512 pin whenever BUILD changes.
+const BUILD_INTEGRITY = "sha512-wMsIkGuT5cbZoZqnzqJIRXmTOE1Tn4KP/XdiF40XobfJ6XVrgaiQNduF5USHoaut5p+X6a5rswWq8O4Ia9qXRw==";
 const CDN = "https://static.diep.io/";
 const API_URL = `${window.location.href}api/`;
 
diff --git a/client/loader.js b/client/loader.js
index f6f000e0..68865e27 100644
--- a/client/loader.js
+++ b/client/loader.js
@@ -337,7 +337,60 @@ Module.todo.push([() => {
     Module.status = "FETCH";
     // fetch necessary info and build
     return [
-        fetch(`${CDN}build_${BUILD}.wasm.wasm`).then(res => res.arrayBuffer()),
+        (async () => {
+            const url = `${CDN}build_${BUILD}.wasm.wasm`;
+            let cache;
+            try {
+                cache = await caches.open("diepcustom-wasm-v1");
+                const hit = await cache.match(url);
+                if (hit) {
+                    const buffer = await hit.arrayBuffer();
+                    const hash = await crypto.subtle.digest("SHA-512", buffer);
+                    if (`sha512-${btoa(String.fromCharCode(...new Uint8Array(hash)))}` === BUILD_INTEGRITY) return buffer;
+                    await cache.delete(url);
+                }
+            } catch (_) { /* Cache Storage may be unavailable. */ }
+
+            // A sandboxed frame sends Origin: null instead of the site's origin.
+            const buffer = await new Promise((resolve, reject) => {
+                const frame = document.createElement("iframe");
+                frame.hidden = true;
+                frame.setAttribute("sandbox", "allow-scripts");
+                const finish = data => {
+                    clearTimeout(timer);
+                    window.removeEventListener("message", onMessage);
+                    frame.remove();
+                    if (data instanceof ArrayBuffer) resolve(data);
+                    else reject(new Error(data?.error || "WASM fetch failed"));
+                };
+                const onMessage = event => {
+                    if (event.source === frame.contentWindow && event.origin === "null") finish(event.data);
+                };
+                const timer = setTimeout(() => finish({ error: "WASM fetch timed out" }), 60000);
+                window.addEventListener("message", onMessage);
+                frame.srcdoc = `<script>
+                    fetch(${JSON.stringify(url).replace(/</g, "\\u003c")}, {
+                        integrity: ${JSON.stringify(BUILD_INTEGRITY)},
+                        credentials: "omit",
+                        referrerPolicy: "no-referrer",
+                        redirect: "error"
+                    }).then(response => {
+                        if (!response.ok) throw new Error("WASM HTTP " + response.status);
+                        return response.arrayBuffer();
+                    }).then(buffer => {
+                        parent.postMessage(buffer, "*", [buffer]);
+                    }).catch(error => {
+                        parent.postMessage({ error: String(error) }, "*");
+                    });
+                <\/script>`;
+                document.body.appendChild(frame);
+            });
+            try {
+                // Store the verified original bytes before Wail modifies them.
+                await cache?.put(url, new Response(buffer));
+            } catch (_) { /* A full or disabled cache must not prevent loading. */ }
+            return buffer;
+        })(),
         fetch(`${API_URL}servers`).then(res => res.json()),
         fetch(`${API_URL}tanks`).then(res => res.json())
     ];

From 2da9dd3511e0aa6b768bfc8e918bbe634eae4b8e Mon Sep 17 00:00:00 2001
From: Nulled <63370961+Nul-led@users.noreply.github.com>
Date: Sat, 26 Sep 2026 09:02:27 +0200
Subject: [PATCH 2/4] chore: Simplify WASM caching

---
 client/loader.js | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/client/loader.js b/client/loader.js
index 68865e27..7e66d2fa 100644
--- a/client/loader.js
+++ b/client/loader.js
@@ -341,14 +341,9 @@ Module.todo.push([() => {
             const url = `${CDN}build_${BUILD}.wasm.wasm`;
             let cache;
             try {
-                cache = await caches.open("diepcustom-wasm-v1");
+                cache = await caches.open("diepcustom-wasm");
                 const hit = await cache.match(url);
-                if (hit) {
-                    const buffer = await hit.arrayBuffer();
-                    const hash = await crypto.subtle.digest("SHA-512", buffer);
-                    if (`sha512-${btoa(String.fromCharCode(...new Uint8Array(hash)))}` === BUILD_INTEGRITY) return buffer;
-                    await cache.delete(url);
-                }
+                if (hit) return await hit.arrayBuffer();
             } catch (_) { /* Cache Storage may be unavailable. */ }
 
             // A sandboxed frame sends Origin: null instead of the site's origin.

From 7841c14a40e03cc653cc031c542c5d7c7cd5eab4 Mon Sep 17 00:00:00 2001
From: Nulled <63370961+Nul-led@users.noreply.github.com>
Date: Sat, 26 Sep 2026 09:05:23 +0200
Subject: [PATCH 3/4] chore: Log WASM cache errors

---
 client/loader.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/loader.js b/client/loader.js
index 7e66d2fa..7ef1cddc 100644
--- a/client/loader.js
+++ b/client/loader.js
@@ -344,7 +344,7 @@ Module.todo.push([() => {
                 cache = await caches.open("diepcustom-wasm");
                 const hit = await cache.match(url);
                 if (hit) return await hit.arrayBuffer();
-            } catch (_) { /* Cache Storage may be unavailable. */ }
+            } catch (error) { console.warn("WASM cache unavailable", error); }
 
             // A sandboxed frame sends Origin: null instead of the site's origin.
             const buffer = await new Promise((resolve, reject) => {
@@ -383,7 +383,7 @@ Module.todo.push([() => {
             try {
                 // Store the verified original bytes before Wail modifies them.
                 await cache?.put(url, new Response(buffer));
-            } catch (_) { /* A full or disabled cache must not prevent loading. */ }
+            } catch (error) { console.warn("WASM could not be cached", error); }
             return buffer;
         })(),
         fetch(`${API_URL}servers`).then(res => res.json()),

From 8654bc5b42560f072923bf015211c75da6cf9097 Mon Sep 17 00:00:00 2001
From: Nulled <63370961+Nul-led@users.noreply.github.com>
Date: Sat, 26 Sep 2026 09:11:28 +0200
Subject: [PATCH 4/4] chore: Alert on WASM load failure

---
 client/loader.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/client/loader.js b/client/loader.js
index 7ef1cddc..94e5a9c6 100644
--- a/client/loader.js
+++ b/client/loader.js
@@ -356,7 +356,10 @@ Module.todo.push([() => {
                     window.removeEventListener("message", onMessage);
                     frame.remove();
                     if (data instanceof ArrayBuffer) resolve(data);
-                    else reject(new Error(data?.error || "WASM fetch failed"));
+                    else {
+                        alert("Failed to load or verify the WASM build. Check the console for details.");
+                        reject(new Error(data?.error || "WASM fetch failed"));
+                    }
                 };
                 const onMessage = event => {
                     if (event.source === frame.contentWindow && event.origin === "null") finish(event.data);