@maka/maka-cli 5.235.0 → 5.237.0

package/bundle/typescript/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maka/maka-cli",
-  "version": "5.235.0",
+  "version": "5.237.0",
   "type": "module",
   "summary": "A command line tool for scaffolding Meteor 3.x applications using either React.",
   "description": "A command line tool for scaffolding Meteor 3.x applications using React.",

package/bundle/typescript/src/commands/game/sideQuest/commands/disable.js

@@ -72,12 +72,12 @@ export class DisableCommand extends Command {
         // 2. A DEVICE ICON: inside the host, its WAN; from the grid, a slaved
         //    device you hold a host mark for, or a loose wireless one where
         //    the body stands. Mirrors hack.ts tryDeviceHack.
-        const matching = (room) => room.openableDevices().filter(d => d.rating > 0).filter(d => d.hasIconFor(actor.name)).filter(d => d.name.toLowerCase().includes(raw)
+        const matching = (room, inHost = false) => room.openableDevices().filter(d => d.rating > 0).filter(d => d.hasIconFor(actor.name, inHost)).filter(d => d.name.toLowerCase().includes(raw)
             || (d.opensExit ?? '').toLowerCase() === raw
             || d.description.toLowerCase().includes(raw));
         const inside = actor.insideHost;
         if (inside) {
-            const matches = matching(inside);
+            const matches = matching(inside, true);
             if (matches.length === 1)
                 return { kind: 'device', device: matches[0], room: inside, host: inside, viaWan: false };
             if (matches.length > 1)

package/bundle/typescript/src/commands/game/sideQuest/commands/edit-file.js

@@ -1,4 +1,5 @@
 import { Command } from './command.js';
+import { gridActionModifier } from '../utilities/grids.js';
 import { hint } from '../utilities/hints.js';
 import { rollPool, formatRoll } from '../utilities/dice.js';
 import { billAction } from '../utilities/action-cost.js';
@@ -111,8 +112,12 @@ export class EditFileCommand extends Command {
         const computer = actor.skillRating('computer');
         // Inside a host no grid penalty applies (p.246); silence still taxes
         // every Matrix action (p.235-236, Player.matrixActionPenalty).
+        // The grid tax was NAMED here and never charged -- gridActionModifier
+        // is the helper that answers both halves, returning 0 inside a host
+        // and the public grid's -2 out on it (p.233).
+        const grid = gridActionModifier(actor.currentGrid, !!actor.hostInside, actor.currentGrid);
         const pool = Math.max(1, actor.logic + (computer > 0 ? computer : -1)
-            + actor.matrixActionPenalty + actor.woundModifier - actor.sustainingPenalty);
+            + actor.matrixActionPenalty + grid.total + actor.woundModifier - actor.sustainingPenalty);
         const limit = actor.matrixAttribute('dataProcessing');
         const defence = hostDefensePool(host);
         const attempt = rollPool(pool, limit, { gremlins: actor.deckGremlins });

package/bundle/typescript/src/commands/game/sideQuest/commands/erase-mark.js

@@ -1,4 +1,5 @@
 import { Command } from './command.js';
+import { gridActionModifier } from '../utilities/grids.js';
 import { hint } from '../utilities/hints.js';
 import { rollPool, formatRoll } from '../utilities/dice.js';
 import { billAction } from '../utilities/action-cost.js';
@@ -192,8 +193,12 @@ export class EraseMarkCommand extends Command {
         if (bill)
             return bill;
         const computer = actor.skillRating('computer');
+        // The grid you are riding taxes every Matrix action you take from it
+        // (p.233); inside a host it is nothing, because a host's interior is
+        // not on a grid.
+        const grid = gridActionModifier(actor.currentGrid, !!actor.hostInside, actor.currentGrid);
         const pool = Math.max(1, actor.logic + (computer > 0 ? computer : -1)
-            + penalty + actor.matrixActionPenalty + actor.woundModifier - actor.sustainingPenalty);
+            + penalty + actor.matrixActionPenalty + grid.total + actor.woundModifier - actor.sustainingPenalty);
         const limit = actor.matrixAttribute('attack');
         // THE PLACER ROLLS, not the icon the key is written on (p.239, see
         // IPlacer). `chosen` is the icon whose keys this action is scrubbing.

package/bundle/typescript/src/commands/game/sideQuest/commands/hack.js

@@ -569,7 +569,7 @@ export class HackCommand extends BypassCommand {
         if (!named)
             return null;
         const raw = named.toLowerCase();
-        const matching = (room) => room.openableDevices().filter(d => d.rating > 0).filter(d => d.hasIconFor(actor.name)).filter(d => d.name.toLowerCase().includes(raw)
+        const matching = (room, inHost = false) => room.openableDevices().filter(d => d.rating > 0).filter(d => d.hasIconFor(actor.name, inHost)).filter(d => d.name.toLowerCase().includes(raw)
             || (d.opensExit ?? '').toLowerCase() === raw
             || d.description.toLowerCase().includes(raw));
         // INSIDE THE HOST you are directly connected to every device on
@@ -579,7 +579,7 @@ export class HackCommand extends BypassCommand {
         let viaWan = false;
         let device;
         if (host) {
-            const matches = matching(host);
+            const matches = matching(host, true);
             if (matches.length !== 1)
                 return null;
             device = matches[0];
@@ -608,7 +608,14 @@ export class HackCommand extends BypassCommand {
                 viaWan = true;
                 const onHost = host.hostMarksBy.get(actor.name) ?? 0;
                 if (onHost < 1) {
-                    return `${device.name} is on the map, but it hangs off ${hostLabel(host)}'s WAN -- slaved, and a host's devices answer nobody who holds no mark on the host itself (p.233).${hint(` ("${this.verbName} ${hostLabel(host)}" for a mark first; "enter" once you have one and the lock defends with its own DR ${device.rating} alone.)`)}`;
+                    // AND THE OTHER DOOR IS A CABLE (eJANPpm7qCaCAJBJw). This
+                    // refusal used to name one way past it -- go through the host
+                    // -- which made the host the only road to everything hanging
+                    // off it. p.233 carves out the exception in the same breath as
+                    // the rule: a direct connection, and the slave "cannot use its
+                    // master's ratings to defend itself". It costs the runner's
+                    // body in the room, which is the whole trade.
+                    return `${device.name} is on the map, but it hangs off ${hostLabel(host)}'s WAN -- slaved, and a host's devices answer nobody who holds no mark on the host itself (p.233).${hint(` ("${this.verbName} ${hostLabel(host)}" for a mark first; "enter" once you have one and the lock defends with its own DR ${device.rating} alone. Or go the other way: "jack out", walk to it, and "tap ${device.name}" -- a cable doesn't ask the network for permission, and a mark on a slave is a mark on its master.)`)}`;
                 }
             }
             else {

package/bundle/typescript/src/commands/game/sideQuest/commands/hide.js

@@ -1,4 +1,5 @@
 import { Command } from './command.js';
+import { gridActionModifier } from '../utilities/grids.js';
 import { hint } from '../utilities/hints.js';
 import { rollPool, formatRoll } from '../utilities/dice.js';
 import { accrueOverwatch } from '../utilities/overwatch.js';
@@ -63,8 +64,12 @@ export class HideCommand extends Command {
         if (bill)
             return bill;
         const ew = actor.skillRating('electronic-warfare');
+        // The grid you are riding taxes every Matrix action you take from it
+        // (p.233); inside a host it is nothing, because a host's interior is
+        // not on a grid.
+        const grid = gridActionModifier(actor.currentGrid, !!actor.hostInside, actor.currentGrid);
         const pool = Math.max(1, actor.intuition + (ew > 0 ? ew : -1)
-            + actor.matrixActionPenalty + actor.woundModifier - actor.sustainingPenalty);
+            + actor.matrixActionPenalty + grid.total + actor.woundModifier - actor.sustainingPenalty);
         const limit = actor.matrixAttribute('sleaze');
         const attempt = rollPool(pool, limit, { gremlins: actor.deckGremlins });
         const defence = rollPool(room.hostRating + room.hostAttributes().dataProcessing);

package/bundle/typescript/src/commands/game/sideQuest/commands/overwatch.js

@@ -1,4 +1,5 @@
 import { Command } from './command.js';
+import { gridActionModifier } from '../utilities/grids.js';
 import { rollPool, formatRoll } from '../utilities/dice.js';
 import { accrueOverwatch, settledScore, CONVERGENCE_AT } from '../utilities/overwatch.js';
 import { leaveMatrix } from '../utilities/planes.js';
@@ -38,8 +39,10 @@ export class OverwatchCommand extends Command {
             return burned;
         const limit = actor.matrixAttribute('sleaze');
         // The check is itself a Sleaze action, so silence taxes it too
-        // (canon p.235-236, Player.matrixActionPenalty).
-        const mine = rollPool(Math.max(1, actor.logic + (skill > 0 ? skill : -1) + actor.matrixActionPenalty + actor.woundModifier - actor.sustainingPenalty), limit);
+        // (canon p.235-236, Player.matrixActionPenalty) -- and so does the
+        // grid you take it from (p.233), which is nothing inside a host.
+        const grid = gridActionModifier(actor.currentGrid, !!actor.hostInside, actor.currentGrid);
+        const mine = rollPool(Math.max(1, actor.logic + (skill > 0 ? skill : -1) + actor.matrixActionPenalty + grid.total + actor.woundModifier - actor.sustainingPenalty), limit);
         const god = rollPool(6);
         if (showsMechanics(this.scene, actor)) {
             this.logger.meta(`${mechanicsActorPrefix(this.scene, actor)}Check Overwatch (EW, sleaze): ${formatRoll(mine)}`);

package/bundle/typescript/src/commands/game/sideQuest/commands/tap.js

@@ -1,12 +1,13 @@
 import { Command } from './command.js';
 import { billAction } from '../utilities/action-cost.js';
-import { hostLabel } from '../utilities/grid-names.js';
+import { hostLabel, matchesCameraName } from '../utilities/grid-names.js';
 import { rollPool, formatRoll } from '../utilities/dice.js';
 import { accrueOverwatch } from '../utilities/overwatch.js';
 import { MAX_MARKS } from '../utilities/marks.js';
 import { isWatched, cameraMasterHost, directConnectionBlocker } from '../utilities/surveillance.js';
 import { hint } from '../utilities/hints.js';
 import { showsMechanics, mechanicsActorPrefix } from '../utilities/mechanics-audience.js';
+import { deviceDefensePool, bruteForceMatrixDv, freeMatrixPerceptionHits, overwatchFromDefense } from '../utilities/matrix-intrusion.js';
 /**
  * TAP -- THE DIRECT CONNECTION (backlog items 9 and 10, Niko, session
  * 2026-08-27T02-07-12-404Z: "check the rules on this -- shouldn't I be
@@ -44,6 +45,15 @@ import { showsMechanics, mechanicsActorPrefix } from '../utilities/mechanics-aud
  * against a camera's ratings instead of a host's -- and the cost is
  * that you had to walk in and touch it.
  *
+ * IT IS NOT ONLY FOR CAMERAS ANY MORE (eJANPpm7qCaCAJBJw). The verb
+ * shipped pointed at a lens because that is what the reports asked for,
+ * and that left every OTHER slaved device -- the maglock, the keypad,
+ * the safe, the security furniture p.217 names first -- reachable only
+ * by cracking the host first. Backwards: Data Trails p.87-88 works this
+ * exact play on a DOOR, and the cable is the reason a hardened site is
+ * something you walk into rather than something you read off the sky.
+ * `tap <name>` is that, and tapDevice below is the rule.
+ *
  * WHERE THE AIR-GAP CLAUSE WENT. This used to say the cable's one
  * outright win was an air-gapped host, which had no door onto the grid
  * at all. There is no such host any more (hhSWzLSXECFtfoAGa): a host is
@@ -55,7 +65,7 @@ import { showsMechanics, mechanicsActorPrefix } from '../utilities/mechanics-aud
  */
 export class TapCommand extends Command {
     static verb = 'tap';
-    static description = 'Cable into a camera you are standing next to -- a DIRECT CONNECTION (p.232), run as HACK ON THE FLY (p.240). A slaved device can\'t hide behind its host\'s ratings against a cable, so the camera fights you with its own; and a mark on a slaved device is a mark on the host it answers to (p.233), which is your way in. Needs your BODY in the room and a deck in hand. Fail and you are noticed. To cable in loud instead, "force camera" is Brute Force over the same cable (p.238).';
+    static description = 'Cable into a device you are standing next to -- "tap" for the cameras, or "tap <keypad/maglock/safe>" for the security furniture. A DIRECT CONNECTION (p.232), run as HACK ON THE FLY (p.240). A slaved device can\'t hide behind its host\'s ratings against a cable, so it fights you with its own; and a mark on a slaved device is a mark on the host it answers to (p.233), which is your way in. Works on an icon you have never spotted and on one whose wireless is off -- a cable is not wireless (p.421). Needs your BODY in the room and a deck in hand. Fail and you are noticed. To cable into the lenses loud instead, "force camera" is Brute Force over the same cable (p.238).';
     /**
      * WHICH INTRUSION ACTION THE CABLE CARRIES. Same rule as hack.ts:
      * the verb decides, not a word inside the target name. `tap loud`
@@ -69,11 +79,32 @@ export class TapCommand extends Command {
     /** How `force camera` reaches the loud route over the same cable. */
     withMode(m) { this.modeOverride = m; return this; }
     mode() { return this.modeOverride ?? 'sleaze'; }
-    async execute() {
+    async execute(args = []) {
         const actor = this.actor;
         const room = actor.currentLocation;
         const rooms = this.rooms ?? {};
         const mode = this.mode();
+        // THE CABLE GOES INTO WHATEVER YOU NAME (eJANPpm7qCaCAJBJw, Maka:
+        // "a device slaved to a host cannot be detected or interacted with
+        // outside the host"). The cameras were the only thing this verb
+        // could reach, which left the maglock, the keypad and the safe --
+        // the security furniture p.217 names first -- reachable ONLY by
+        // owning the host first. That is backwards from the book's own
+        // worked example: Data Trails p.87-88 runs the play on a DOOR.
+        const named = args.join(' ').trim();
+        if (named && !matchesCameraName(named)) {
+            const device = this.resolveDevice(room, named);
+            if (device)
+                return this.tapDevice(room, device, mode);
+            // NAMED SOMETHING, GOT SOMETHING ELSE IS NOT AN OPTION. This used
+            // to fall through to the lenses whenever the room had any, so
+            // `tap turnstile` in a watched room cabled the cameras and
+            // reported a mark on a host the player never aimed at -- a
+            // Complex Action spent on the wrong target with no way to tell.
+            // A word that names nothing here is a refusal that lists what it
+            // could have named.
+            return this.nothingNamed(room, named);
+        }
         if (!isWatched(room)) {
             return `No cameras in here to cable into.${hint(` (Your overlay tags them "◎ Camera cluster" when there are.)`)}`;
         }
@@ -216,5 +247,203 @@ export class TapCommand extends Command {
         this.scene.updateStatus();
         return lines.join('\n');
     }
+    /**
+     * WHICH THING IN THIS ROOM THE PLAYER MEANT. The same shape hack.ts's
+     * device route uses -- name, the exit it seals, or its description --
+     * with two deliberate differences, and they are the whole point of
+     * this route:
+     *
+     *   IT DOES NOT ASK hasIconFor. A silent icon is hidden ON THE GRID
+     *   (p.217, p.235-236). Your body is standing in front of the object
+     *   with a hand on its housing; you are not looking for it, you are
+     *   touching it. Requiring a Matrix Perception sweep before you may
+     *   cable into a keypad you can SEE would be the search rule applied
+     *   to a thing that was never lost.
+     *
+     *   IT DOES NOT ASK wireless. p.421's "Turning It Off" is exact about
+     *   what that costs a device: "the items can no longer be wirelessly
+     *   hacked." A cable is not wireless. A dark maglock is immune to
+     *   everything on the grid and still opens to a filament -- which is
+     *   why physical infiltration stays the answer to a hardened site
+     *   rather than a dead end.
+     *
+     * Open devices are excluded: a thing standing open has nothing left to
+     * key.
+     */
+    resolveDevice(room, named) {
+        const raw = named.toLowerCase();
+        const matches = room.openableDevices()
+            .filter(d => d.rating > 0)
+            .filter(d => d.name.toLowerCase().includes(raw)
+            || (d.opensExit ?? '').toLowerCase() === raw
+            || d.description.toLowerCase().includes(raw));
+        return matches.length === 1 ? matches[0] : undefined;
+    }
+    /** Named something this room has no cable-end for. Says what it DOES
+     *  have, because a refusal that lists the connectors is a refusal that
+     *  teaches the verb. */
+    nothingNamed(room, named) {
+        const here = room.openableDevices().filter(d => d.rating > 0).map(d => d.name);
+        if (isWatched(room))
+            here.push('the cameras (bare "tap")');
+        return here.length > 0
+            ? `Nothing here called "${named}" has a data connector on it. What does: ${here.join(', ')}.`
+            : `Nothing in ${room.name} has a port to cable into -- no cameras, no panel, no lock with electronics in it.`;
+    }
+    /**
+     * A DIRECT CONNECTION TO A DEVICE (SR5 p.232-233; Data Trails p.87-88,
+     * "A Lesson in Host Invasion" -- which runs this exact play on a DOOR
+     * slaved to a host, not on a camera).
+     *
+     * THE RULE THIS BUYS, and it is the one the report has been circling:
+     * "If a slaved device is under attack via a direct connection, it
+     * cannot use its master's ratings to defend itself" (p.233). So the
+     * keypad that hides behind HR 3 out on the grid -- and that `hack`
+     * from the grid refuses outright until you hold a mark on the host --
+     * defends here with nothing but its own DR. That is the identical pool
+     * `hack` faces from INSIDE the host, because being inside a WAN and
+     * holding a cable are the same rule: "if you are in a host that has a
+     * WAN, you are considered directly connected to all devices in the
+     * WAN" (p.233).
+     *
+     * AND THE PAYOFF RUNS UPHILL: "if you get a mark on a slave you also
+     * get a mark on the master" (p.233). A filament in a maglock is a key
+     * to the host it answers to. That is the road INTO a host, which this
+     * engine offered only through a camera lens.
+     *
+     * THE PRICE IS YOUR BODY, which is what keeps it from being a
+     * shortcut: directConnectionBlocker wants you in the meat, in the
+     * room, with a deck in hand. A persona out on the grid cannot hold a
+     * cable.
+     */
+    async tapDevice(room, device, mode) {
+        const actor = this.actor;
+        const blocked = directConnectionBlocker(actor, room, device.name);
+        if (blocked)
+            return blocked;
+        const held = device.marksBy.get(actor.name) ?? 0;
+        if (held >= MAX_MARKS) {
+            return `You already hold ${MAX_MARKS} marks on ${device.name} -- it answers to you as readily as to the house.`;
+        }
+        const burned = actor.burnedAttributeRefusal(mode === 'attack' ? 'attack' : 'sleaze');
+        if (burned)
+            return burned;
+        // THE MASTER IS THE HOST OVER THIS DEVICE'S OWN ROOM, and nothing
+        // further. cameraMasterHost falls back to any host on the site
+        // because a camera NETWORK is a site-wide thing the seeds describe;
+        // a keypad's master is not, and reaching across the district for one
+        // would be inventing a WAN the seed never declared. No host over it
+        // means a loose device: the mark lands on the thing you cabled into
+        // and propagates nowhere, which is the honest answer.
+        const host = room.hasNode ? room : undefined;
+        const billed = billAction(this.scene, actor, 'complex', mode === 'attack' ? 'Brute Force' : 'Hack on the Fly');
+        if (billed)
+            return billed;
+        const silence = actor.matrixActionPenalty;
+        const limit = actor.matrixAttribute(mode === 'attack' ? 'attack' : 'sleaze');
+        const pool = mode === 'attack'
+            ? Math.max(1, actor.getAttackPool() + silence + actor.bonus('matrix-attack'))
+            : Math.max(1, actor.logic + actor.skillRating('hacking') + actor.bonus('hacking') + actor.bonus('matrix-sleaze')
+                + silence + actor.woundModifier - actor.sustainingPenalty);
+        actor.performAction('cables into a slaved device', `${room.name} -- a filament out of their deck and into ${device.name}`);
+        const roll = rollPool(pool, limit, { gremlins: actor.deckGremlins });
+        // ITS OWN RATINGS. Not wanDefensePool -- that is what a slave borrows
+        // when you come at it THROUGH the network (p.233), and the cable is
+        // the exception the same sentence carves out.
+        const defense = deviceDefensePool(device);
+        const defenseRoll = rollPool(defense.pool);
+        const netHits = roll.hits - defenseRoll.hits;
+        if (showsMechanics(this.scene, actor)) {
+            const who = mechanicsActorPrefix(this.scene, actor);
+            this.logger.meta(`${who}Direct connection, ${device.name} (${mode === 'attack' ? 'brute force' : 'sleaze'}): ${formatRoll(roll)}`);
+            this.logger.meta(`  ${defense.label} (DR ${device.rating}) -- its OWN, not ${host ? hostLabel(host) : 'the network'}'s, p.233: ${formatRoll(defenseRoll)} -- net ${netHits >= 0 ? '+' : ''}${netHits}`);
+        }
+        this.logger.write(`${actor.name} direct-connected to ${device.name} in ${room.name} (${mode}): net ${netHits}, master=${host?.name ?? 'none'}.`);
+        // p.231-232: GOD bills the DEFENDER's hits, the same as every other
+        // illegal Attack or Sleaze action in this engine.
+        const bill = accrueOverwatch(this.scene, actor, overwatchFromDefense(defenseRoll.hits), `direct connection (${device.name}, ${mode})`);
+        const godLines = bill.lines;
+        if (netHits <= 0) {
+            if (mode === 'sleaze') {
+                // p.236: a blown Sleaze is NOTICED, and a slaved device that
+                // notices tells the host it hangs off.
+                actor.sneaking = false;
+                if (host) {
+                    host.hostAlert = true;
+                    this.scene.addWorldEvent(`${device.name} flags a bad handshake on its cable -- ${hostLabel(host, { capital: true })} is awake.`, { plane: 'matrix' });
+                    this.scene.updateStatus();
+                    return [
+                        `The filament seats, the handshake goes wrong, and ${device.name} says so out loud.`,
+                        `  The node it answers to knows something is on the wire.`,
+                        ...godLines,
+                    ].join('\n');
+                }
+                this.scene.updateStatus();
+                return [
+                    `The filament seats and ${device.name} refuses the key -- whoever owns it has your icon on file now.`,
+                    ...godLines,
+                ].join('\n');
+            }
+            // p.236: a failed Attack is never noticed.
+            this.scene.updateStatus();
+            return [
+                `You put your shoulder into it down the wire and ${device.name} just... doesn't give. Nobody upstairs noticed.`,
+                ...godLines,
+            ].join('\n');
+        }
+        const now = Math.min(MAX_MARKS, held + 1);
+        device.marksBy.set(actor.name, now);
+        const lines = [
+            `{light-blue-fg}The filament finds the connector and ${device.name} stops being furniture -- it's a device, and it's talking to you.{/light-blue-fg}`,
+            `  {light-blue-fg}It never gets to hide behind the network: a cable doesn't ask permission, so it has to defend itself on DR ${device.rating} alone (p.233).{/light-blue-fg}`,
+            `  {light-blue-fg}MARK PLACED -- ${now} of ${MAX_MARKS} on ${device.name}.{/light-blue-fg}`,
+        ];
+        // A MARK ON A SLAVE IS A MARK ON THE MASTER (p.233). One, whatever
+        // you took off the slave -- the same rule hack.ts's device route
+        // applies, and the reason this verb is a way IN rather than only a
+        // way through a door.
+        if (host) {
+            const onHost = host.hostMarksBy.get(actor.name) ?? 0;
+            if (onHost < MAX_MARKS)
+                host.hostMarksBy.set(actor.name, onHost + 1);
+            const nowHost = host.hostMarksBy.get(actor.name) ?? 0;
+            lines.push(`  {light-blue-fg}And it lands on the host too: ${device.name} answers to ${hostLabel(host)}, and anything ${hostLabel(host)} trusts to speak for it just handed you a key. [${nowHost}/${MAX_MARKS}]{/light-blue-fg}`);
+            lines.push(`  {light-blue-fg}${nowHost >= MAX_MARKS
+                ? `That node thinks you belong now -- "jack in" and "hack" walks straight in.`
+                : `${hostLabel(host, { capital: true })} cracks easier with every key you hold${hint(` -- "jack in" and "hack", or find another slave to cable`)}.`}{/light-blue-fg}`);
+        }
+        if (mode === 'attack') {
+            actor.sneaking = false;
+            if (host)
+                host.hostAlert = true;
+            this.scene.addWorldEvent(`${actor.name} forced ${device.name} over a cable -- the housing shows it.`);
+            // p.238: Brute Force burns what it forces, 1 DV per two full net
+            // hits, resisted by Device Rating + Firewall.
+            const dv = bruteForceMatrixDv(netHits);
+            if (dv > 0) {
+                const resisted = Math.max(0, dv - rollPool(defense.pool).hits);
+                if (resisted > 0) {
+                    device.takeBarrierDamage(resisted);
+                    lines.push(`  The forcing burns ${resisted} into its boards -- ${device.barrierSummary()}`);
+                    if (device.isHoled)
+                        lines.push(`  It dies open. Whatever it was holding shut is not shut any more.`);
+                }
+            }
+        }
+        else {
+            // p.240: Hack on the Fly reads while it keys.
+            if (freeMatrixPerceptionHits(netHits) > 0) {
+                lines.push(`  {light-blue-fg}And you read it while you keyed it (p.240): ${device.name} is a ${device.kind}, DR ${device.rating}${device.opensExit ? `, and it is what holds the ${device.opensExit} way shut` : ''}.{/light-blue-fg}`);
+            }
+            lines.push(`  Nothing logged, nothing flagged. You were never here.`);
+        }
+        // WHAT THE MARK IS FOR. A key you cannot spend is a key that gets
+        // reported as broken.
+        lines.push(`  {light-blue-fg}${device.name} takes orders from you now${hint(` -- "${device.verbs()[0]} ${device.name}"`)}.{/light-blue-fg}`);
+        lines.push(...godLines);
+        actor.noteConditionChanged();
+        this.scene.updateStatus();
+        return lines.join('\n');
+    }
 }
 //# sourceMappingURL=tap.js.map

package/bundle/typescript/src/commands/game/sideQuest/engine-version.js

@@ -1505,5 +1505,66 @@
 //   -2]' where it applied. Inside a host it is correctly nothing -- a
 //   host's interior is not on a grid -- and it stacks with p.49's retry
 //   penalty, so a public-grid decker gets 5, 3, 1, none.
-export const ENGINE_VERSION = '1.85.1';
+// 1.85.2 (2026-09-16): SWEEP THE FAMILY -- the grid tax on every verb
+//   1.85.1 fixed the grid modifier on the sweep. CLAUDE.md's rule is
+//   that a uniform approximation is still a deviation and partial canon
+//   is worse than either extreme, so the other Matrix verbs were audited
+//   rather than left to be reported one at a time.
+//   FOUR MORE WERE BUILDING A POOL WITHOUT IT: Edit File (p.239), Erase
+//   Mark (p.239), Hide (p.240) and Check Overwatch Score (p.238). All
+//   four read Player.matrixActionPenalty -- which is ONLY the
+//   running-silent -2 -- and none called gridActionModifier. edit-file's
+//   own comment even NAMED the rule it was not applying ("inside a host
+//   no grid penalty applies"), which is the tell: the author knew about
+//   the grid and handled only the exempt case.
+//   Each takes it now, and gridActionModifier answers both halves --
+//   zero inside a host (p.246: its interior is not on a grid), the
+//   public grid's -2 out on it (p.233).
+//   NOT CHANGED: the `tap` verb. It is a direct connection to a lens in the
+//   flesh, and the books do not say whether the grid tax still applies
+//   to an action taken down a cable. Left alone and said so rather than
+//   guessed in either direction.
+// 1.86.0 (2026-09-17): THE CABLE REACHES EVERY SLAVE, AND A SPOT STAYS
+//   ON ITS OWN SIDE OF THE WALL (eJANPpm7qCaCAJBJw).
+//   THE RULES QUESTION FIRST, because the report asked for one: a device
+//   slaved to a host is NOT moved inside it. p.233's entire
+//   slave-defence rule ("whenever a slaved device is called on to make a
+//   defense test, it uses either its own or its master's rating") exists
+//   precisely because you can come at a slave from outside, and the same
+//   paragraph carves out the exception that proves it -- "if a slaved
+//   device is under attack via a direct connection ... it cannot use its
+//   master's ratings to defend itself". Data Trails p.87-88 runs the
+//   whole worked example on a DOOR slaved to a host. Being inside the
+//   host is not the only road; it is the road that costs no cable
+//   ("if you are in a host that has a WAN, you are considered directly
+//   connected to all devices in the WAN").
+//   SO THE GAP WAS THE CABLE. `tap` could reach a camera lens and
+//   nothing else, which left every maglock, keypad and safe -- the
+//   security furniture p.217 names first -- reachable only by cracking
+//   the host first. Exactly backwards from the book's own example.
+//   `tap <device>` is the direct connection now: it rolls the device's
+//   OWN Device Rating + Firewall (the identical pool `hack` faces from
+//   inside the host, because both ARE direct connections), the mark it
+//   buys lands on the master too (p.233), and GOD bills the defender's
+//   hits (p.231-232). It reaches an icon that has never been spotted --
+//   your hand is on the housing, you are not searching for it -- and one
+//   whose WIRELESS IS OFF, because p.421's "Turning It Off" says only
+//   that such a device "can no longer be WIRELESSLY hacked" and a
+//   filament is not wireless. That is what keeps a dark site a thing you
+//   walk into rather than a dead end.
+//   AND THE LEAK: `enter host, glance, exit` lit up every silent icon on
+//   the street. One `spottedBy` set served both vantages, and they are
+//   not the same test -- inside the host a slave hides behind its BARE
+//   rating (one die for a p.356 camera, p.233), outside it borrows the
+//   host's Rating and Sleaze (nine on an HR 3 site). A one-die win was
+//   satisfying a nine-die gate. p.246 is the rule: "the virtual space
+//   inside a host is separate from the outside grid." Device.
+//   spottedInsideBy and Room.camerasSpottedInsideBy keep the sides
+//   apart, one way only -- an OUTSIDE spot still counts inside, because
+//   it beat the harder test.
+//   The other half of that report was that the inside win was invisible:
+//   hostInteriorIcons listed personas, files and ice and never the WAN,
+//   so a device found in there first appeared when you left. It is
+//   listed inside now, where p.233 puts it.
+export const ENGINE_VERSION = '1.86.0';
 //# sourceMappingURL=engine-version.js.map

package/bundle/typescript/src/commands/game/sideQuest/models/device.js

@@ -164,16 +164,54 @@ export class Device {
      * not go missing again between looks.
      */
     spottedBy = new Set();
+    /**
+     * SPOTTED FROM INSIDE THE HOST IT IS SLAVED TO -- a separate record,
+     * and the bug that earned it (eJANPpm7qCaCAJBJw, Maka: "Even if I
+     * never see the device ... when I leave the host, all slaved devices
+     * are automatically visible").
+     *
+     * There was ONE set, so a sweep won in either place unlocked both --
+     * and the two places are not the same test. Inside the host you are
+     * directly connected and the slave "cannot use its master's ratings"
+     * (p.233), so it hides behind its bare rating: ONE die for a p.356
+     * camera. Out on the grid it borrows the host's Rating and Sleaze --
+     * nine dice on the reporter's HR 3 bazaar. A one-die win was being
+     * spent to satisfy a nine-die gate, so entering a host and glancing
+     * around lit up every slaved icon on the street outside it.
+     *
+     * p.246 is the rule underneath: "the virtual space inside a host is
+     * separate from the outside grid." What you learned in there, you
+     * learned in there.
+     *
+     * IT ONLY RUNS ONE WAY. An OUTSIDE spot beats the harder test, so it
+     * counts inside too (see hasIconFor); an inside spot does not come
+     * back out with you.
+     */
+    spottedInsideBy = new Set();
     /** Is this icon on the grid for this viewer? Wireless and rated (the
-     *  old broadcastsAro question), and either loud or already spotted. */
-    hasIconFor(viewerName) {
+     *  old broadcastsAro question), and either loud or already spotted
+     *  FROM WHERE THEY ARE STANDING -- `inside` means inside the host this
+     *  device is slaved to, where p.233 makes them directly connected. */
+    hasIconFor(viewerName, inside = false) {
         if (!this.broadcastsAro())
             return false;
-        return !this.silent || this.spottedBy.has(viewerName);
+        if (!this.silent)
+            return true;
+        if (this.spottedBy.has(viewerName))
+            return true;
+        return inside && this.spottedInsideBy.has(viewerName);
     }
     /** Hidden from this viewer, and therefore worth rolling against. */
-    isHiddenFrom(viewerName) {
-        return this.broadcastsAro() && this.silent && !this.spottedBy.has(viewerName);
+    isHiddenFrom(viewerName, inside = false) {
+        return this.broadcastsAro() && this.silent && !this.hasIconFor(viewerName, inside);
+    }
+    /** Record a sweep this viewer won, on the side of the wall they won it
+     *  (p.246). */
+    markSpotted(viewerName, inside) {
+        if (inside)
+            this.spottedInsideBy.add(viewerName);
+        else
+            this.spottedBy.add(viewerName);
     }
     /**
      * WHAT IT IS MADE OF (p.197-198): Structure is the condition monitor

package/bundle/typescript/src/commands/game/sideQuest/models/room.js

@@ -81,6 +81,25 @@ export class Room extends AbstractRoom {
      * of the grid.
      */
     camerasSpottedBy = new Set();
+    /**
+     * AND THE SAME SPLIT Device.spottedInsideBy carries, for the same
+     * reason and the same bug. A sweep won INSIDE the host the lenses are
+     * slaved to beats their bare rating -- one die, for a p.356 camera --
+     * while the grid outside asks for the host's Rating + Sleaze. Sharing
+     * one set let the cheap win open the dear door, so stepping into a
+     * host and looking around lit the cameras up on the street when you
+     * came back out. p.246: the two spaces are separate.
+     *
+     * Outward-only, like the device's: an outside spot counts everywhere,
+     * an inside one stays inside.
+     */
+    camerasSpottedInsideBy = new Set();
+    /** Has this viewer pinned the cluster's icon from where they stand? */
+    camerasSpottedFor(viewerName, inside = false) {
+        if (this.camerasSpottedBy.has(viewerName))
+            return true;
+        return inside && this.camerasSpottedInsideBy.has(viewerName);
+    }
     /**
      * WHAT THE LENSES RATE (eJANPpm7qCaCAJBJw, third rejection: "the
      * camera cluster doesn't have a DR"), and the reporter's ruling that

package/bundle/typescript/src/commands/game/sideQuest/utilities/ar.js

@@ -176,7 +176,16 @@ export function aroTags(scene, actor, room) {
         // still picked, breached, shot and keyed exactly as before.
         if (!device.hasIconFor(actor.name))
             continue;
-        tags.push(`▤ ${device.name} -- wireless, ${drTagFor(device, actor.name)}${device.isOpen() ? ', standing open' : `.${hint(` ("${device.verbs()[0]} ${device.name}")`)}`}`);
+        // THE CABLE IS THE OTHER VERB (eJANPpm7qCaCAJBJw). The overlay
+        // taught the physical one and nothing else, so a decker standing in
+        // front of a slaved keypad had no way to learn that the filament in
+        // their deck beats the host's ratings (p.233). Only offered when
+        // there is a deck to plug in -- a hint naming gear you do not have
+        // is noise.
+        const cable = device.isOpen() || !(actor.getCyberdeck() || actor.isTechnomancer())
+            ? ''
+            : hint(` ("tap ${device.name}" cables in -- it can't hide behind its host against a cable)`);
+        tags.push(`▤ ${device.name} -- wireless, ${drTagFor(device, actor.name)}${device.isOpen() ? ', standing open' : `.${hint(` ("${device.verbs()[0]} ${device.name}")`)}${cable}`}`);
     }
     // LOOSE DEVICES lying in plain sight. A wireless deck on a table
     // announces itself; one in a drawer you never opened does not.

package/bundle/typescript/src/commands/game/sideQuest/utilities/grid-view.js

@@ -480,6 +480,29 @@ function hostInteriorIcons(scene, actor, room) {
             ? `◇ ${item.name} [data] -- unsealed, sitting open in the host's archive. ("take" it)`
             : `◇ ${item.name} [data] -- SEALED in the host's archive. ("hack" the host to break the seal)`);
     }
+    // THE WAN, WHICH IS WHAT YOU CAME IN FOR (p.233: "if you are in a host
+    // that has a WAN, you are considered directly connected to all devices
+    // in the WAN"; eJANPpm7qCaCAJBJw, Maka: "when I leave the host, all
+    // slaved devices are automatically visible").
+    //
+    // This list did not exist, and its absence is half of that report. A
+    // sweep inside the host rolls against the slave's BARE rating -- one
+    // die for a p.356 camera, because you are directly connected and it
+    // "cannot use its master's ratings" -- and then nothing in here
+    // printed what you had just found. The win was invisible until the
+    // persona stepped back out onto the grid, where the icon appeared for
+    // free against a test it had never beaten. Device.spottedInsideBy now
+    // keeps the two sides of that wall apart (p.246); this is the side
+    // that had nothing to show.
+    //
+    // Same gate as the outside list, read from in here: an icon is on this
+    // list once THIS viewer has pinned it, and `hack`/`disable` target
+    // exactly the same set.
+    for (const device of room.devices) {
+        if (!device.hasIconFor(actor.name, true))
+            continue;
+        icons.push(deviceIconLine(device, actor));
+    }
     // THE ICE IS IN THE ROOM WITH YOU, AND THE ROOM USED TO DENY IT.
     //
     // A regression this file shipped: hostInteriorIcons listed personas

package/bundle/typescript/src/commands/game/sideQuest/utilities/silent-icons.js

@@ -2,7 +2,7 @@ import { rollPool, formatRoll } from './dice.js';
 import { deviceHidePool, wanHidePool } from './matrix-intrusion.js';
 import { isWatched, cameraMasterHost } from './surveillance.js';
 import { gridActionModifier, gridNote } from './grids.js';
-function hiddenDevice(device, master) {
+function hiddenDevice(device, master, inside) {
     // p.235-236: the hider rolls LOGIC + SLEAZE. Not Firewall -- that
     // resists an intrusion (p.238/p.240) and has nothing to do with being
     // seen. This used to call deviceDefensePool, the INTRUSION pool, so
@@ -13,7 +13,11 @@ function hiddenDevice(device, master) {
     return {
         name: device.name,
         hide: { pool: hide.pool, label: hide.label },
-        reveal: (viewer) => { device.spottedBy.add(viewer); },
+        // WHERE THE WIN IS BANKED (p.246). A sweep inside the host beat the
+        // slave's bare rating; the grid outside asks for the master's
+        // Rating + Sleaze. Writing both from one roll is what made
+        // "enter, glance, exit" reveal a street's worth of silent icons.
+        reveal: (viewer) => { device.markSpotted(viewer, inside); },
     };
 }
 function hiddenPersona(actor) {
@@ -37,10 +41,11 @@ export function hiddenIconsIn(scene, room, viewer) {
     // A device in a room with a host is slaved to it (p.233), and from
     // the grid it borrows the master's ratings. Inside the host you are
     // directly connected and it stands alone -- deviceHidePool.
-    const deviceMaster = viewer.hostInside ? undefined : room.host;
+    const inside = !!viewer.hostInside;
+    const deviceMaster = inside ? undefined : room.host;
     const out = room.devices
-        .filter(d => d.isHiddenFrom(viewer.name))
-        .map(d => hiddenDevice(d, deviceMaster));
+        .filter(d => d.isHiddenFrom(viewer.name, inside))
+        .map(d => hiddenDevice(d, deviceMaster, inside));
     // THE CAMERAS, which p.217 names FIRST. They are not a Device -- the
     // cluster is derived from the room (surveillance.ts isWatched) -- so
     // the rating rides the ROOM (Room.cameraRating), seeded per site.
@@ -58,7 +63,7 @@ export function hiddenIconsIn(scene, room, viewer) {
     // could not have reconciled them because two of the three were never
     // printed. One seeded number feeds all three now, so what the player
     // reads is what it rolls (reporter's ruling: per-site, not global).
-    if (isWatched(room) && !room.camerasSpottedBy.has(viewer.name)) {
+    if (isWatched(room) && !room.camerasSpottedFor(viewer.name, inside)) {
         // THE THIRD CUT, and the reporter found it by doing the arithmetic
         // out loud: "Device Rating + Firewall on the Camera is 2d6? so, the
         // firewall of the host is a 1?" No -- Firewall was never the right
@@ -70,13 +75,15 @@ export function hiddenIconsIn(scene, room, viewer) {
         // stray one is easy -- one rule, not a balance knob (reporter's
         // ruling 2026-09-16).
         const masterRoom = scene ? cameraMasterHost(scene.getRooms(), room) : undefined;
-        const master = viewer.hostInside ? undefined : masterRoom?.host;
+        const master = inside ? undefined : masterRoom?.host;
         const lens = { rating: room.cameraRating };
         const hide = master ? wanHidePool(lens, master) : deviceHidePool(lens);
         out.push({
             name: 'Camera cluster',
             hide: { pool: hide.pool, label: hide.label },
-            reveal: (v) => { room.camerasSpottedBy.add(v); },
+            // Banked on the side of the wall it was won (p.246), like the
+            // devices above.
+            reveal: (v) => { (inside ? room.camerasSpottedInsideBy : room.camerasSpottedBy).add(v); },
         });
     }
     for (const a of scene?.allActors ?? []) {

package/bundle/typescript/src/commands/game/sideQuest/utilities/surveillance.js

@@ -60,9 +60,16 @@ export function cameraMasterHost(rooms, room) {
  * the rules allowed this at all, so a refusal that teaches the rule is
  * worth more than a refusal that just says no.
  */
-export function directConnectionBlocker(actor, room) {
+export function directConnectionBlocker(actor, room, target) {
+    // WHAT THE CABLE GOES INTO. The refusals name it, because a player who
+    // typed `tap keypad` and is told about "the lens" has been answered
+    // about a different object (eJANPpm7qCaCAJBJw). Cameras stay the
+    // default: this function was written for them and every existing
+    // caller means them.
+    const thing = target ?? 'the lens';
+    const its = target ? target : 'its cameras';
     if (actor.plane === 'matrix') {
-        return `Your persona is out on the grid -- and a direct connection is a CABLE, not a route. You cannot plug a cable in from inside the Matrix (p.232): it takes your body, standing next to the lens, with a hand free. "jack out", walk to ${room.name}, and tap it in the flesh.`;
+        return `Your persona is out on the grid -- and a direct connection is a CABLE, not a route. You cannot plug a cable in from inside the Matrix (p.232): it takes your body, standing next to ${thing}, with a hand free. "jack out", walk to ${room.name}, and tap it in the flesh.`;
     }
     if (actor.plane === 'astral') {
         return `A spirit has no hands and no data connector. The Matrix doesn't answer to the astral.`;
@@ -71,13 +78,13 @@ export function directConnectionBlocker(actor, room) {
         return `Not from here -- a direct connection takes your own body, and yours is somewhere else.`;
     }
     if (actor.currentLocation !== room) {
-        return `You'd have to be standing in ${room.name} to get a cable into its cameras.`;
+        return `You'd have to be standing in ${room.name} to get a cable into ${its}.`;
     }
     // A cyberdeck (or a datajack, which a technomancer is assumed to run
     // on) carries the microfilament cable; a bare commlink has the port
     // but nothing to hack WITH.
     if (!actor.getCyberdeck() && !actor.isTechnomancer()) {
-        return `You have no deck to plug in. A commlink can talk to a camera; it can't crack one -- that takes a cyberdeck in hand.`;
+        return `You have no deck to plug in. A commlink can talk to ${target ? thing : 'a camera'}; it can't crack ${target ? 'it' : 'one'} -- that takes a cyberdeck in hand.`;
     }
     return undefined;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maka/maka-cli",
-  "version": "5.235.0",
+  "version": "5.237.0",
   "type": "module",
   "summary": "A command line tool for scaffolding Meteor 3.x applications using either React.",
   "description": "A command line tool for scaffolding Meteor 3.x applications using React.",