2 Commits

Include renames

Author	SHA1	Message	Date
jwinterm	ed24d43b56	chore: prepare the repository for public release ... Removes operator-private material from the shipped tree, corrects documentation that had drifted from the code, deletes dead code, and applies a consistent prose style. Private material moved out of the public tree (docs/private/, git-ignored): - the wallet keyfile recovery runbook and its helper scripts, which together published the mainnet wallet file path, the service account, backup snapshot filenames, and the wallet RPC listener state. The helper duplicated the same constants, so relocating the document alone would not have removed them. - the stagenet parallel-candidate runbook and its fixtures. - the dated production-state record, the internal remediation plan, and the TODO list. None are reference documentation for an outside reader. Redacted or genericised: - operator home-directory paths in shipped scripts and units. The asset build script now takes KENNEY_ASSETS_DIR instead of a hard-coded path. - private LAN addresses in tests, env examples and deploy docs, replaced with RFC 5737 documentation addresses. - the default alert sender and the notification hub example. - the Monero wallet unit now matches the Wownero one: a dedicated service account and a config file, instead of the operator's login account with the wallet password in argv where any local user can read it from /proc. Ignore rules now cover every .env variant rather than the bare name, plus local agent state. The deployment docs instruct operators to create .env.mainnet and .env.stagenet, which the exact-name rule would have allowed to be committed. Documentation corrected against the code: per-chain dungeon level counts, the premium unlock rule, Tavern chat scope, backup retention, the chain-profile fallback, the environment template location, and several sections describing shipped work as pending. Dead code removed: configPersistence, rpccalls, a duplicate vendored ROT.js bundle, the unused tile-picker overlay, the unreachable legacy game-size path and its vestigial parameter, spectator stubs that shadowed the real SpectatorManager, and commented-out debugging. nip98 now imports the shared nostr loader rather than duplicating it. Prose style: em-dashes removed throughout in favour of colons, semicolons and commas; comments restated as present-tense descriptions of the code rather than narration of past changes. 127 suites / 1015 tests pass.	2026-07-27 06:40:38 -04:00
jwinterm	dacbf356ed	fix: close pre-launch review findings and light the premium renderers ... Adversarial multi-agent review of the launch candidate produced 22 confirmed findings (12 more were refuted). This closes the critical, high, and the mediums/lows that are cheap and real, then does the iso/3D/Tavern art pass. CRITICAL — unauthenticated remote kill switch Socket.IO does not wrap listener invocation, and this process treats uncaughtException/unhandledRejection as fatal, so ONE unguarded throw in ANY listener exits the server. `socket.emit('debug_ping')` with no argument did exactly that, and systemd restarts straight back into it. Every registration in handleConnection now goes through a safe-dispatch wrapper that contains sync throws and rejected promises to the offending socket; handleDebugPing also stops trusting its payload. HIGH - NIP-98 login now binds the signed event to this deployment's host. The path check alone let an event signed for any other origin authenticate here, and linking ADOPTS the account owning that pubkey — full account takeover. - Fog of war is enforced server-side. getState() shipped absolute entrance/exit/treasure coordinates and the monster's exact position in every frame, with concealment implemented only in the browser. Discovery is sticky; the monster is reported only while in view. - NODE_ENV must now be explicit and recognized. Unset, every production gate read false while DebugManager reported production and silenced logging. - Tavern chat applies the lobby's ban list, rate limiter and user_id attribution before entering global chat. - userRegistry is deleted by socket.id (it was keyed by socket.id and deleted by socket.client.id, so nothing was ever freed). MEDIUM / LOW - Payouts: a legitimately split transfer_split kept its transaction hashes instead of quarantining already-broadcast funds with tx_hash NULL, and provably pre-broadcast failures return to 'pending' rather than needs_review. - RateLimiter key parsing fixed — cleanup() freed nothing and expired windows never reset, because ids contain colons. - Enter no longer submits a paid entry from behind a modal. - Lobby chat no longer double-escapes server-escaped text. - Rate limits for identity:get / address:prompt / early_entry. - Spectators released when a game ends by disconnect, not just settlement. - movementManager / addressManager per-socket maps cleaned on disconnect. Renderers Iso: opaque shading instead of translucent fog, additive torch/lantern/beacon light pools, crevice AO, embers, cold memory wash, and it stops reallocating the whole canvas every animation frame. 3D: instanced level geometry (3 draw calls), procedural stone/flagstone materials, torch lights + shadows, real meshes for stairs/chest/monster (they were humanoid capsules), dust motes, wall cutaway, and lighting rebalanced now that fog is measured from the camera. Tavern Block height and hash fragments drift around the stage edge and ripple when a block lands, fed by a cosmetic chain tip added to the blockheight broadcast. Speech bubbles work again (they keyed off a socketId the server stopped sending). 126 suites / 1005 tests pass.	2026-07-26 07:29:47 -04:00