refactor: update security policies in window creation and enhance loading page CSP

README.md

@@ -1,47 +1,41 @@
-# scoreko-electron
+# Scoreko Desktop
 
-Windows desktop installer for Scoreko. The packaged app includes Electron, NodeCG, the compiled `scoreko-dev` bundle, and the production modules needed to run it, so end users do not need Node.js, pnpm, or a cloned repository.
+This is the Windows desktop wrapper for Scoreko. It bundles Electron, NodeCG, and our custom `scoreko-dev` bundle into a single standalone executable. Users just double-click the installer and everything works—no Node.js, pnpm, or command line required.
 
-## Build on a development machine
+## Local Development
 
-From the repository root:
+If you're working on the app locally, start by installing dependencies at the repository root:
 
 ```powershell
 pnpm install
 ```
 
-Then from `scoreko-electron-dev`:
+Then, move into the wrapper folder:
 
 ```powershell
+cd scoreko-electron-dev
 npm install
-npm run dist:win
 ```
 
-The installer is written to `scoreko-electron-dev/release/Scoreko-setup-0.1.0.exe`.
+### Useful Commands
 
-## What the build does
+- `npm run start`: Builds the bundle and launches Electron locally for testing.
+- `npm run dist:win`: Packages everything and creates the `.exe` Windows installer in the `release/` folder.
+- `npm run prepare:runtime`: Extracts a fresh NodeCG runtime from the parent bundle (useful if you changed dependencies).
+- `npm run rebuild:native`: Rebuilds native Node modules (like SQLite) specifically for Electron's V8 engine.
+- `npm run doctor`: Runs a quick sanity check to verify your local configuration and port availability.
 
-- Builds the parent `scoreko-dev` bundle with `pnpm build`.
-- Creates `scoreko-electron-dev/lib/nodecg` with a small NodeCG runtime.
-- Installs production runtime modules into that runtime.
-- Rebuilds `better-sqlite3` for Electron before creating the installer.
-- Packages the runtime as an Electron extra resource outside the app archive.
+## How it works under the hood
 
-## Runtime behavior
+When you build the installer, the script automatically compiles the main `scoreko-dev` bundle, provisions a lightweight NodeCG runtime in `lib/nodecg`, and packages it as an external asset alongside the Electron app.
 
-On first launch, Scoreko copies the packaged NodeCG runtime to the user's app data folder and then relaunches itself before starting NodeCG. This keeps `cfg`, `db`, and `logs` writable on Windows even when the app is installed under `Program Files`, and avoids transient startup failures caused by freshly copied runtime files.
+When a user runs Scoreko for the first time, the app copies this NodeCG runtime directly into their local AppData folder. This is a deliberate choice: it ensures that databases, configs, and logs remain fully writable, even if the user installed the app in restricted directories like `Program Files`. 
 
-## Useful scripts
+## Auto-Updates via Gitea
 
-- `npm run start`: build everything and run Electron locally.
-- `npm run prepare:runtime`: recreate `lib/nodecg` from the parent bundle.
-- `npm run rebuild:native`: rebuild NodeCG native modules for Electron.
-- `npm run dist:win`: create the Windows installer.
-- `npm run doctor`: check the prepared runtime and the configured port.
+Scoreko supports seamless, opt-in updates through your Gitea instance. 
 
-## Updates from Gitea
-
-Scoreko can check a Gitea release feed without forcing the user to update. Edit `static/updates.json` before building:
+Before building your production installer, check `static/updates.json`:
 
 ```json
 {
@@ -52,11 +46,15 @@ Scoreko can check a Gitea release feed without forcing the user to update. Edit
 }
 ```
 
-For each release, bump `package.json` version, build with `npm run dist:win`, create a Gitea release tagged like `v0.2.0`, and attach `release/Scoreko-setup-0.2.0.exe`. When Scoreko sees a newer tag, it asks whether to download and install it.
+**To ship an update:**
+1. Bump the version in `package.json`.
+2. Run `npm run dist:win` to generate the new installer.
+3. Create a new release tag in Gitea (e.g., `v0.2.0`) and attach the `.exe`. 
+4. The app will detect the new version, notify the user, and handle the installation safely.
 
-## Configuration
+## Environment Configuration
 
-The defaults match the parent bundle:
+The app ships with sensible defaults that match our development bundle:
 
 - `NODECG_BUNDLE_NAME=scoreko-dev`
 - `NODECG_PORT=9090`
@@ -65,4 +63,4 @@ The defaults match the parent bundle:
 - `SCOREKO_UPDATES_ENABLED=true`
 - `SCOREKO_UPDATE_ASSET_PATTERN=Scoreko-setup-.*\.exe$`
 
-Copy `.env.example` only if you need local overrides while developing.
+You only need to mess with `.env.example` if you want to override these values locally while testing.