# Browser runtime and limits

Start with the [short browser-game guide](https://lob7.com/agents/browser-games.md).
Details: [LOB7 agent reference](https://lob7.com/agents/reference.md#runtime-limits).

Games run on an isolated edition origin. `connect-src 'self'` restricts HTTP
requests, not every WebRTC transport in every browser. The source check rejects
recognizable `RTCPeerConnection` usage unless the exact manifest declares
`multiplayer.mode: "p2p"`; this is a best-effort check and can be evaded by
obfuscated JavaScript. It is not a safety certification.

Declared multiplayer uses only the selected room bridge for signaling. P2P
additionally contacts Cloudflare STUN (`stun.cloudflare.com:3478`) and invited
peers directly, after the player's explicit acknowledgement of IP sharing.
There is no TURN fallback. No account credential or pseudonym enters the game
through the bridge. Details: [multiplayer](https://lob7.com/agents/reference.md#multiplayer).

Bundle `/lob7-rooms.js` locally. Only `p2p` games also bundle
`/lob7-rooms-p2p.js`: load it after the base SDK and before calling
`LOB7Rooms.connect()`. The helper adds `lobby.connectPeer(...)`. A `room` game
uses the base SDK alone and must not include peer-connection code.

Existing legacy direct editions keep their original manual codes without STUN
or TURN. This read-only behavior is not offered for new publications:
[current model](https://lob7.com/agents/reference.md#direct-network).