0.2.23

- Update miss and correct guess sound effects to new versions
- allow iframe hosted version to pass url as a query string parameter (&iframe_host=https%3A%2F%2Fwww.battlewords.com%2Fplaynow.html) url encoding is required.
- minimal security added to prevent users from changing the options in a challenge.

README.md

@@ -121,6 +121,11 @@ docker run -p8501:8501 battlewords
  - Persistent Storage: all game results saved locally for personal statistics without accounts.
  - Challenge Mode: remote storage of challenge results, multi-user leaderboard, and shareable links.
 
+-0.2.23
+ - Update miss and correct guess sound effects to new versions
+ - allow iframe hosted version to pass url as a query string parameter (&iframe_host=https%3A%2F%2Fwww.battlewords.com%2Fplaynow.html) url encoding is required.
+ - minimal security added to prevent users from changing the options in a challenge.
+
 -0.2.22
  - fix challenge mode link 
  - challenge mode UI improvements

battlewords/__init__.py

@@ -1,2 +1,2 @@
-__version__ = "0.2.22"
+__version__ = "0.2.23"
 __all__ = ["models", "generator", "logic", "ui", "game_storage"]

battlewords/assets/audio/effects/correct_guess.mp3

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:397af68b9d343f146c1aa897f9bd64fdb646739edfabfb6ead6f2747fc089d2e
-size 50246
+oid sha256:65fcf49f02fd7a6c70dd3c270c254c03dd286e9fb50e382d285b79cb5e24d22d
+size 97255

battlewords/assets/audio/effects/miss.mp3

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:e1d774c8241e9295a813f29127e2cb2c148b2ede6845b8ce1702ed970158fc04
-size 25834
+oid sha256:07f70499881c735fc284e9a6b17f0f6d383b35b6e06f0c90aa672597110b916c
+size 23449

battlewords/game_storage.py

@@ -5,7 +5,7 @@ BattleWords-specific storage wrapper for HuggingFace storage operations.
 This module provides high-level functions for saving and loading BattleWords games
 using the shared storage module from battlewords.modules.
 """
-__version__ = "0.1.2"
+__version__ = "0.1.3"
 
 import json
 import tempfile
@@ -13,6 +13,7 @@ import os
 from datetime import datetime, timezone
 from typing import Dict, Any, List, Optional, Tuple
 import logging
+from urllib.parse import unquote
 
 from battlewords.modules import (
     upload_files_to_repo,
@@ -423,6 +424,8 @@ def get_shareable_url(sid: str, base_url: str = None) -> str:
     """
     Generate a shareable URL from a short ID.
     If running locally, use localhost. Otherwise, use HuggingFace Space domain.
+    Additionally, if an "iframe_host" query parameter is present in the current
+    Streamlit request, it takes precedence and will be used as the base URL.
 
     Args:
         sid: Short ID (8 characters)
@@ -439,17 +442,38 @@ def get_shareable_url(sid: str, base_url: str = None) -> str:
     import os
     from battlewords.modules.constants import SPACE_NAME
 
-    # 1. If base_url is provided, use it directly
+    # 0) If not explicitly provided, try to read iframe_host from Streamlit query params
+    if base_url is None:
+        try:
+            import streamlit as st # local import to avoid hard dependency
+            params = getattr(st, "query_params", None)
+            if params is None and hasattr(st, "experimental_get_query_params"):
+                params = st.experimental_get_query_params()
+            if params and "iframe_host" in params:
+                raw_host = params.get("iframe_host")
+                # st.query_params may return str or list[str]
+                if isinstance(raw_host, (list, tuple)):
+                    raw_host = raw_host[0] if raw_host else None
+                if raw_host:
+                    decoded = unquote(str(raw_host))
+                    if decoded:
+                        base_url = decoded
+        except Exception:
+            # Ignore any errors here and fall back to defaults below
+            pass
+
+    # 1) If base_url is provided (either parameter or iframe_host), use it directly
     if base_url:
-        return f"{base_url.rstrip('/')}/?game_id={sid}"
+        sep = '&' if '?' in base_url else '?'
+        return f"{base_url}{sep}game_id={sid}"
 
-    # 2. Check for local development (common Streamlit env vars)
+    # 2) Check for local development (common Streamlit env vars)
     port = os.environ.get("PORT") or os.environ.get("STREAMLIT_SERVER_PORT") or "8501"
     host = os.environ.get("HOST") or os.environ.get("STREAMLIT_SERVER_ADDRESS") or "localhost"
     if host in ("localhost", "127.0.0.1") or os.environ.get("IS_LOCAL", "").lower() == "true":
         return f"http://{host}:{port}/?game_id={sid}"
 
-    # 3. Otherwise, build HuggingFace Space URL from SPACE_NAME
+    # 3) Otherwise, build HuggingFace Space URL from SPACE_NAME
     space = (SPACE_NAME or "surn/battlewords").lower().replace("/", "-")
     return f"https://{space}.hf.space/?game_id={sid}"
 

battlewords/ui.py

@@ -255,7 +255,7 @@ def inject_styles() -> None:
 
           /* Final score style */
           .bw-final-score { color: #1ca41c !important; font-weight: 800; }
-          .stExpander {z-index: 10;}
+          .stExpander {z-index: 10;width: 50%;}
           div[data-testid="stToastContainer"], div[data-testid="stToast"] {
             margin: 0 auto;
           }
@@ -596,7 +596,7 @@ def _render_sidebar():
             options=game_modes,
             index=game_modes.index(current_mode) if current_mode in game_modes else 0,
             key="game_mode",
-            on_change=_new_game,
+            on_change=_on_game_option_change,  # was _new_game
         )
 
         st.header("Wordlist Controls")
@@ -615,7 +615,7 @@ def _render_sidebar():
                 index=current_index,
                 format_func=lambda f: f.rsplit(".", 1)[0],
                 key="selected_wordlist",
-                on_change=_new_game,  # immediately start a new game with the selected list
+                on_change=_on_game_option_change,  # was _new_game
             )
 
             if st.button("Sort Wordlist", width=125, key="sort_wordlist_btn"):
@@ -636,7 +636,8 @@ def _render_sidebar():
             "Spacer (space between words)",
             options=spacer_options,
             index=spacer_options.index(st.session_state.spacer),
-            key="spacer"
+            key="spacer",
+            on_change=_on_game_option_change,  # add callback
         )
 
         # Add Show Incorrect Guesses option - now enabled by default
@@ -1434,6 +1435,8 @@ def _game_over_content(state: GameState) -> None:
               /*filter: invert(1);*/
            }
            .st-bb {background-color: rgba(29, 100, 200, 0.5);} 
+           .st-key-generate_share_link div[data-testid="stButton"] button { aspect-ratio: auto;} 
+           .st-key-generate_share_link div[data-testid="stButton"] button:hover { color: #1d64c8;}
         </style>
         """,
         unsafe_allow_html=True,
@@ -1715,4 +1718,42 @@ def run_app():
     # End condition (only show overlay if dismissed)
     state = _to_state()
     if is_game_over(state) and not st.session_state.get("hide_gameover_overlay", False):
-        _render_game_over(state)
+        _render_game_over(state)
+
+def _on_game_option_change() -> None:
+    """
+    Unified callback for game option changes.
+    If currently in a loaded challenge, break the link by resetting challenge state
+    and removing the game_id query param. Then start a new game with the updated options.
+    """
+    try:
+        # Remove challenge-specific query param if present
+        if hasattr(st, "query_params"):
+            qp = st.query_params
+            # st.query_params may be a Mapping; pop safely if supported
+            try:
+                if "game_id" in qp:
+                    qp.pop("game_id")
+            except Exception:
+                # Fallback: clear all params if pop not supported
+                try:
+                    st.query_params.clear()
+                except Exception:
+                    pass
+    except Exception:
+        pass
+
+    # Clear challenge session flags and links
+    if st.session_state.get("loaded_game_sid") is not None:
+        st.session_state.loaded_game_sid = None
+    # Remove loaded challenge settings so UI no longer treats session as challenge mode
+    st.session_state.pop("shared_game_settings", None)
+    # Ensure the loader won't auto-reload challenge on rerun within this session
+    st.session_state["shared_game_loaded"] = True
+
+    # Clear any existing generated share link tied to the previous challenge
+    st.session_state.pop("share_url", None)
+    st.session_state.pop("share_sid", None)
+
+    # Start a fresh game with updated options
+    _new_game()