fix: five high-severity bugs from the adversarial code audit

[obiot]

The high-severity tier from the parallel bug hunt (loader / audio / math beats), every finding re-verified by hand against the code before fixing. All specs written failing-first: 17 of 27 new tests red on the old code, 27/27 green after.

1. new Color("darkgray") threw + wrong/missing CSS keywords — math/color.ts

• darkgray / darkgrey table keys were pasted from a spec table with their footnote marker ("darkgray[*]") → lookup missed → parseCSS fell through to parseHex → throw invalid parameter.
• cyan, magenta, rebeccapurple missing entirely (same throw).
• silver [192,192,129], aliceblue [240,248,245], burlywood [222,184,35] — single-digit channel typos.

New tests/css-colors.spec.ts validates the full 148-keyword table against the CSS spec (expected values derived via parseHex, no hand-transcribed channels), so a paste error can never hide again.

2. Matrix2d 6-arg canvas form dropped translation + transposed rotation — math/matrix2d.ts

The layout is column-major (tx/ty getters read val[6]/val[7]; apply() agrees), but the 6-arg branch stored (a,b,c,d,e,f) row-major: e/f landed in the unused projective row — new Matrix2d(1,0,0,1,x,y) produced the identity with no translation — and rotation came out inverted. 9-arg form unaffected. New spec includes a 6-arg ≡ 9-arg equivalence check.

3. moveTowards() never arrived and returned the target — all 4 vector classes

Two bugs, copy-pasted across Vector2d/Vector3d/ObservableVector2d/ObservableVector3d:

• arrival test was distance <= step * step — wrong units (snapped early for step > 1, dithered around the target forever for fractional steps);
• on "arrival" it returned the caller's target vector without moving this, violating its own @returns Reference to this object JSDoc — chained calls silently mutated the target.

Now lands exactly on the target, always returns this; documented negative-step flee semantics preserved (covered by a test). Observables land via set() so observers fire. New spec runs the same 4 cases across all four classes via describe.each.

4. Every video preloaded with forced anonymous CORS — loader/parsers/video.js

setAttribute("crossorigin", settings.crossOrigin) ran unconditionally; the default (undefined) stamps the string "undefined", and per the HTML spec an invalid enumerated value maps to Anonymous (a missing attribute means no CORS). Cross-origin videos served without CORS headers failed to load when they would have played fine untainted. Now guarded on typeof === "string" — the empty string (a valid value meaning anonymous) is still honored.

5. Video preload hung forever on autoplay-restricted browsers — loader/parsers/video.js

The completion event was canplay unless autoplay was explicitly false — but the common manifest shape simply omits autoplay, and iOS Safari & friends never fire canplay for a video that isn't allowed to play → the whole preloader stalled and the game never started (the code's own comment described the Safari behavior; the guard just didn't match it). Now loadedmetadata unless autoplay: true explicitly asks to wait for canplay; streaming videos keep loadedmetadata.

Test plan

• 4 new spec files (27 tests), failing-first: 17 red on old code, all green after
• Full suite: 4597 passed / 0 failed / 15 skipped
• eslint + biome + build clean

🤖 Generated with Claude Code

https://claude.ai/code/session_019t8kP8vp58ZrvaD2FqJU6A

[Copilot]

Pull request overview

Fixes a set of high-severity correctness issues across melonJS math utilities and the video loader, and adds targeted regression specs to prevent reintroduction.

Changes:

• Correct CSS named-color keyword mapping (including missing keywords and incorrect RGB channels) and add a full keyword-table verification spec.
• Fix Matrix2d 6-argument canvas convention mapping (translation + rotation layout) and add equivalence/behavior specs.
• Fix moveTowards() behavior across vector implementations (arrival condition + return/mutation contract) and adjust video preloader wiring (crossorigin handling + completion event selection), with new regression tests and changelog entries.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
packages/melonjs/src/math/color.ts	Fix CSS color keyword table entries (missing/incorrect keys and channels).
packages/melonjs/tests/css-colors.spec.ts	Add spec validating full CSS named-color keyword table against hex values.
packages/melonjs/src/math/matrix2d.ts	Fix 6-arg setTransform(a,b,c,d,e,f) mapping for column-major storage.
packages/melonjs/tests/matrix2d-settransform.spec.ts	Add regression tests for 6-arg canvas form translation/rotation + 6-arg≡9-arg equivalence.
packages/melonjs/src/math/vector2d.ts	Fix moveTowards() arrival threshold and return/mutation semantics.
packages/melonjs/src/math/vector3d.ts	Fix moveTowards() arrival threshold and return/mutation semantics (x/y interpolation).
packages/melonjs/src/math/observableVector2d.ts	Fix moveTowards() arrival threshold and ensure observer notifications via set().
packages/melonjs/src/math/observableVector3d.ts	Fix moveTowards() arrival threshold and ensure observer notifications via set().
packages/melonjs/tests/vector-movetowards.spec.ts	Add shared contract tests covering all 4 vector classes (step, arrival, fractional convergence, negative-step flee).
packages/melonjs/src/loader/parsers/video.js	Fix crossorigin stamping and reliable preload completion event selection.
packages/melonjs/tests/video-parser.spec.js	Add regression tests for CORS attribute handling and autoplay-related completion event selection.
packages/melonjs/CHANGELOG.md	Document the fixed regressions/bugs for release notes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.