fix: inline Three.js + characters.js into srcdoc iframe

Instead of external script src (blocked by CSP) or file serving (blocked by
allowed_paths), fetch Three.js once at startup and inline both scripts
directly into the HTML. The srcdoc iframe becomes fully self-contained.

- Tries cdnjs (r167), unpkg, jsdelivr in order
- Falls back to local sandbox_cache/three.min.js if present
- characters.js read from local file (already in repo)
- No file serving, no CDN in iframe, no CSP issues

app.py

@@ -87,15 +87,15 @@ BRIDGE_JS = """
 
 
 def _wrap_in_iframe(studio_html: str) -> str:
-    """Write studio HTML to a file and return an iframe loading it via src."""
-    import hashlib
-    key = hashlib.md5(studio_html[:200].encode()).hexdigest()[:8]
-    filename = f"sandbox_cache/studio_{key}.html"
-    Path(filename).write_text(studio_html)
+    """Wrap self-contained studio HTML in a srcdoc iframe.
+    Three.js and characters.js are inlined, so no external requests needed.
+    """
+    import html as html_mod
+    escaped = html_mod.escape(studio_html, quote=True)
     return (
-        f'<iframe id="ivds-studio-iframe" src="/gradio_api/file={filename}" '
+        f'<iframe id="ivds-studio-iframe" srcdoc="{escaped}" '
         f'style="width:100%;height:600px;border:none;border-radius:8px;background:#1a1a2e" '
-        f'allow="autoplay"></iframe>'
+        f'allow="autoplay" sandbox="allow-scripts"></iframe>'
     )
 
 # ── Background temp-dir cleanup daemon ───────────────────────────────────────
@@ -309,4 +309,4 @@ with gr.Blocks(title="🎮 Immersive Vibe Development Studio") as demo:
 
 
 if __name__ == "__main__":
-    demo.launch(css=CSS, ssr_mode=False, allowed_paths=["sandbox_cache"])
+    demo.launch(css=CSS, ssr_mode=False)

studio.py

@@ -1,10 +1,54 @@
 """
 Self-contained Three.js r167 isometric game-dev studio scene for Gradio.
+Three.js and characters.js are inlined at module load so the HTML is fully
+self-contained and works in srcdoc iframes without any external requests.
 """
 import json
-
-_CHARACTERS_JS_URL = "/gradio_api/file=sandbox_cache/characters.js"
-_THREEJS_CDN       = "https://unpkg.com/three@0.167.0/build/three.min.js"
+import urllib.request
+from pathlib import Path
+
+
+def _fetch_threejs() -> str:
+    # Try local file first (committed to repo)
+    local = Path(__file__).parent / "sandbox_cache" / "three.min.js"
+    if local.exists() and local.stat().st_size > 100_000:
+        print("[studio] Using local three.min.js")
+        return local.read_text()
+    # Try CDNs
+    cdns = [
+        "https://cdnjs.cloudflare.com/ajax/libs/three.js/r167/three.min.js",
+        "https://unpkg.com/three@0.167.0/build/three.min.js",
+        "https://cdn.jsdelivr.net/npm/three@0.167.0/build/three.min.js",
+    ]
+    for url in cdns:
+        try:
+            with urllib.request.urlopen(url, timeout=15) as r:
+                data = r.read().decode("utf-8")
+                if len(data) > 100_000:
+                    # Cache locally for next startup
+                    try:
+                        local.write_text(data)
+                    except Exception:
+                        pass
+                    print(f"[studio] Fetched Three.js from {url} ({len(data):,} bytes)")
+                    return data
+        except Exception as e:
+            print(f"[studio] CDN {url} failed: {e}")
+    print("[studio] ERROR: All Three.js sources failed")
+    return "console.error('[IVDS] Three.js failed to load — studio will not render');"
+
+
+def _load_characters_js() -> str:
+    p = Path(__file__).parent / "sandbox_cache" / "characters.js"
+    if p.exists():
+        return p.read_text()
+    return "/* characters.js not found */"
+
+
+print("[studio] Loading Three.js from CDN...")
+_THREEJS_JS    = _fetch_threejs()
+_CHARACTERS_JS = _load_characters_js()
+print(f"[studio] Three.js: {len(_THREEJS_JS):,} bytes | characters.js: {len(_CHARACTERS_JS):,} bytes")
 
 
 def build_studio_html(model_assignments: list[dict]) -> str:
@@ -65,15 +109,9 @@ body {{ background: #1a1a2e; overflow: hidden; font-family: 'Courier New', monos
   <div id="phase-progress"><div id="phase-fill" style="width:0%"></div></div>
 </div>
 
-<script src="{_THREEJS_CDN}"></script>
-<script src="{_CHARACTERS_JS_URL}"></script>
+<script>{_THREEJS_JS}</script>
+<script>{_CHARACTERS_JS}</script>
 <script>
-if (typeof THREE === 'undefined') {{
-  document.body.innerHTML = '<div style="color:#f66;padding:2rem;font-family:monospace">'
-    + 'ERROR: Three.js failed to load from CDN.<br>'
-    + 'URL: {_THREEJS_CDN}</div>';
-  throw new Error('THREE is undefined');
-}}
 const assignments = {assignments_json};
 
 const DESK_POSITIONS = [