spoint 0.1.608 → 0.1.609

package/client/app.js

@@ -643,7 +643,9 @@ if (deviceInfo.isMobile) { mobileControls = new MobileControls({ joystickRadius:
 installQualityPresets()
 QualityPresets.autoApplyPersisted({ renderer, deviceInfo })
 const cam = createCameraController(camera, scene)
-cam.restore(JSON.parse(sessionStorage.getItem('cam') || 'null')); sessionStorage.removeItem('cam')
+let _savedCam = null
+try { _savedCam = JSON.parse(sessionStorage.getItem('cam') || 'null') } catch (e) { console.warn('[boot] discarding malformed sessionStorage.cam:', e?.message || e) }
+cam.restore(_savedCam); sessionStorage.removeItem('cam')
 let xrSystem = null
 // Floating-origin: rebases the whole render-space scene graph (camera + every top-level scene
 // child) toward (0,0,0) whenever the camera drifts REBASE_THRESHOLD_M from the last rebase point, so

package/client/core/PlayerLOD.js

@@ -52,7 +52,16 @@ export const TIER_FULL = 0
 export const TIER_REDUCED = 1
 export const TIER_DOT = 2
 
-const _dScratch = []
+let _idxScratch = new Int32Array(0)
+let _d2Scratch = new Float64Array(0)
+const _full = new Set(), _reduced = new Set(), _dot = new Set()
+const _order = []
+
+function ensureScratchCapacity(n) {
+  if (_idxScratch.length >= n) return
+  _idxScratch = new Int32Array(n)
+  _d2Scratch = new Float64Array(n)
+}
 
 /**
  * Classifies every remote player id in `entries` (array of {id, x, y, z}) into FULL/REDUCED/DOT tiers
@@ -60,26 +69,31 @@ const _dScratch = []
  * THREE scene access, no side effects -- so it is directly unit-exercisable against real player position
  * arrays (see the live witness in the task's verification pass). Returns { full: Set<id>, reduced:
  * Set<id>, dot: Set<id> } plus `order` (the same ids sorted nearest-first, useful for a caller wanting a
- * stable "top N" without re-sorting).
+ * stable "top N" without re-sorting). The returned Sets/array are module-level scratch, reused every call.
  */
 export function classifyPlayerTiers(entries, viewerPos, fullCount = PLAYER_LOD_FULL_COUNT, reducedD2 = PLAYER_LOD_REDUCED_D2) {
   const vx = viewerPos.x, vy = viewerPos.y, vz = viewerPos.z
-  _dScratch.length = 0
-  for (let i = 0; i < entries.length; i++) {
+  const n = entries.length
+  ensureScratchCapacity(n)
+  for (let i = 0; i < n; i++) {
     const e = entries[i]
     const dx = e.x - vx, dy = e.y - vy, dz = e.z - vz
-    _dScratch.push({ id: e.id, d2: dx * dx + dy * dy + dz * dz })
+    _idxScratch[i] = i
+    _d2Scratch[i] = dx * dx + dy * dy + dz * dz
   }
-  _dScratch.sort((a, b) => a.d2 - b.d2)
-  const full = new Set(), reduced = new Set(), dot = new Set(), order = []
-  for (let i = 0; i < _dScratch.length; i++) {
-    const { id, d2 } = _dScratch[i]
-    order.push(id)
-    if (i < fullCount) full.add(id)
-    else if (d2 < reducedD2) reduced.add(id)
-    else dot.add(id)
+  const idxView = _idxScratch.subarray(0, n)
+  idxView.sort((a, b) => _d2Scratch[a] - _d2Scratch[b])
+  _full.clear(); _reduced.clear(); _dot.clear(); _order.length = 0
+  for (let i = 0; i < n; i++) {
+    const srcIdx = idxView[i]
+    const id = entries[srcIdx].id
+    const d2 = _d2Scratch[srcIdx]
+    _order.push(id)
+    if (i < fullCount) _full.add(id)
+    else if (d2 < reducedD2) _reduced.add(id)
+    else _dot.add(id)
   }
-  return { full, reduced, dot, order }
+  return { full: _full, reduced: _reduced, dot: _dot, order: _order }
 }
 
 /** Single-entity tier classification (no sort/allocation) -- for a caller that already knows a player's
@@ -202,6 +216,8 @@ export function createCrowdDotRenderer(scene, opts = {}) {
 // owns that per-frame loop (tickPlayerAnimators) and is the correct place to apply the verdict, keeping
 // this module a pure classifier + the crowd-dot renderer, not a second render-loop owner.
 
+const _dotFallbackScratch = []
+
 export function installPlayerLOD(scene, opts = {}) {
   const dots = createCrowdDotRenderer(scene, opts)
   let lastTiers = { full: new Set(), reduced: new Set(), dot: new Set(), order: [] }
@@ -225,10 +241,12 @@ export function installPlayerLOD(scene, opts = {}) {
     if (serverDots && serverDots.length) {
       dots.update(serverDots, viewerPos.y, groundHeightFn)
     } else if (tiers.dot.size > 0) {
-      const byId = new Map(remoteEntries.map(e => [e.id, e]))
-      const arr = []
-      for (const id of tiers.dot) { const e = byId.get(id); if (e) arr.push(e) }
-      dots.update(arr, viewerPos.y, groundHeightFn)
+      _dotFallbackScratch.length = 0
+      for (let i = 0; i < remoteEntries.length; i++) {
+        const e = remoteEntries[i]
+        if (tiers.dot.has(e.id)) _dotFallbackScratch.push(e)
+      }
+      dots.update(_dotFallbackScratch, viewerPos.y, groundHeightFn)
     } else {
       dots.update(null)
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spoint",
-  "version": "0.1.608",
+  "version": "0.1.609",
   "description": "Physics and netcode SDK for multiplayer game servers",
   "type": "module",
   "workspaces": [

package/src/apps/AppRuntime.js

@@ -4,8 +4,18 @@ import { EventBus } from './EventBus.js'
 import { createEcsEntityMap } from './EcsEntityMap.js'
 import { mulQuat, rotVec } from '../math.js'
 import { MSG } from '../protocol/MessageTypes.js'
-let _existsSync = null, _resolve = null
-try { if (typeof process !== 'undefined' && process.versions?.node) { const fs = await import('node:fs'); const path = await import('node:path'); _existsSync = fs.existsSync; _resolve = path.resolve } } catch {}
+let _existsSync = null, _resolve = null, _realpathSync = null, _sep = '/'
+try { if (typeof process !== 'undefined' && process.versions?.node) { const fs = await import('node:fs'); const path = await import('node:path'); _existsSync = fs.existsSync; _resolve = path.resolve; _realpathSync = fs.realpathSync; _sep = path.sep } } catch {}
+
+function containedAssetPath(filePath, rootDir) {
+  if (!_realpathSync || !rootDir) return null
+  let rootReal
+  try { rootReal = _realpathSync(rootDir) } catch { return null }
+  const prefix = rootReal.endsWith(_sep) ? rootReal : rootReal + _sep
+  let real
+  try { real = _realpathSync(filePath) } catch { return null }
+  return (real === rootReal || real.startsWith(prefix)) ? real : null
+}
 import { SpatialIndex } from '../spatial/Octree.js'
 import { vecOK } from '../shared/vecGuard.js'
 import { weaponNameToCode } from '../shared/WeaponCodes.js'
@@ -142,8 +152,22 @@ export class AppRuntime {
     if (!p) return p
     // non-Node (Worker, no fs): must return an origin-absolute path or fetch() resolves against the worker script's own URL, not the page origin
     if (!_resolve) { const rel = p.startsWith('./') ? p.slice(1) : p; return rel.startsWith('/') ? rel : '/' + rel }
-    const local = _resolve(p); if (_existsSync(local)) return local
-    if (this._sdkRoot) { const sdk=_resolve(this._sdkRoot,p); if (_existsSync(sdk)) { console.debug(`[SDK-DEFAULT] using bundled asset: ${p}`); return sdk } }
+    const cwdRoot = _resolve(process.cwd())
+    const local = _resolve(p)
+    if (_existsSync(local)) {
+      const contained = containedAssetPath(local, cwdRoot)
+      if (!contained) { console.warn(`[AppRuntime] resolveAssetPath rejected '${p}' -- resolves outside the server root`); return null }
+      return contained
+    }
+    if (this._sdkRoot) {
+      const sdk = _resolve(this._sdkRoot, p)
+      if (_existsSync(sdk)) {
+        const contained = containedAssetPath(sdk, _resolve(this._sdkRoot))
+        if (!contained) { console.warn(`[AppRuntime] resolveAssetPath rejected '${p}' -- resolves outside the SDK root`); return null }
+        console.debug(`[SDK-DEFAULT] using bundled asset: ${p}`)
+        return contained
+      }
+    }
     return local
   }
 

package/src/client/BaseClient.js

@@ -69,6 +69,7 @@ export class BaseClient {
     try {
       msg = unpack(bytes)
     } catch (e) { console.error('[client] wire decode failed (corrupt message dropped):', e?.message || e); this.callbacks.onMessageError('decode', e); return }
+    if (msg.type === MSG.NOSTR_AUTH_CHALLENGE) { this._handleNostrAuthChallenge(msg.payload || {}); return }
     try {
       const result = this._msgHandler.handleMessage(msg.type, msg.payload || {}, this._snapProc)
       this._handleSessionTokens(msg.type, result)
@@ -77,6 +78,26 @@ export class BaseClient {
     } catch (e) { console.error('[client] message handler failed (type ' + msg?.type + '):', e?.message || e); this.callbacks.onMessageError('handler', e, msg?.type) }
   }
 
+  async _handleNostrAuthChallenge(payload) {
+    if (payload.error) { console.error('[client] nostr auth failed:', payload.error); this.callbacks.onMessageError('nostrAuth', new Error(payload.error)); return }
+    const challenge = payload.challenge
+    if (!challenge) return
+    try {
+      const NostrTools = await import('nostr-tools')
+      const storage = typeof localStorage !== 'undefined' ? localStorage : null
+      const skHex = storage?.getItem('zn_sk')
+      let sk = skHex ? Uint8Array.from(skHex.match(/.{2}/g).map(b => parseInt(b, 16))) : null
+      if (!sk) {
+        sk = NostrTools.generateSecretKey()
+        storage?.setItem('zn_sk', Array.from(sk).map(b => b.toString(16).padStart(2, '0')).join(''))
+        storage?.setItem('zn_pk', NostrTools.getPublicKey(sk))
+      }
+      const pubkey = NostrTools.getPublicKey(sk)
+      const event = NostrTools.finalizeEvent({ kind: 27235, created_at: Math.floor(Date.now() / 1000), tags: [], content: challenge }, sk)
+      this.send(MSG.NOSTR_AUTH_RESPONSE, { pubkey, sig: event.sig, id: event.id, created_at: event.created_at, kind: event.kind, tags: event.tags })
+    } catch (e) { console.error('[client] nostr auth challenge response failed:', e?.message || e); this.callbacks.onMessageError('nostrAuth', e) }
+  }
+
   _handleSessionTokens(type, result) {}
 
   _onSnapshot(data, msgType) {

package/src/physics/GLBLoader.js

@@ -8,6 +8,7 @@ let _readFileSync = null
 try { if (typeof process !== 'undefined' && process.versions?.node) { const m = await import('node:fs'); _readFileSync = m.readFileSync } } catch {}
 
 function readGLBSync(filepath) {
+  if (!filepath) throw new Error('GLBLoader: no filepath given (resolveAssetPath rejected or returned an empty path)')
   if (!_readFileSync) throw new Error('readFileSync not available — use URL-based async methods in browser')
   const buf = _readFileSync(filepath)
   if (buf.toString('ascii', 0, 4) !== 'glTF') throw new Error('Not a GLB file')
@@ -17,6 +18,7 @@ function readGLBSync(filepath) {
 }
 
 async function readGLBAsync(pathOrUrl) {
+  if (!pathOrUrl) throw new Error('GLBLoader: no path given (resolveAssetPath rejected or returned an empty path)')
   if (_readFileSync && !pathOrUrl.startsWith('http') && !pathOrUrl.startsWith('/')) {
     return readGLBSync(pathOrUrl)
   }

package/src/physics/World.js

@@ -243,6 +243,7 @@ export class PhysicsWorld {
   // In-flight dedupe (_trimeshInflight) additionally prevents two concurrent placements of the same
   // model+scale from racing two independent cook operations before either populates the cache.
   async addStaticTrimeshAsync(glbPath, meshIndex = 0, position = [0, 0, 0], scale = [1, 1, 1], rotation = [0, 0, 0, 1]) {
+    if (!glbPath) throw new Error('addStaticTrimeshAsync: no glbPath (resolveAssetPath rejected or returned an empty path)')
     const J = this.Jolt
     const key = `${glbPath}|${scale[0]},${scale[1]},${scale[2]}`
     let shape = this._trimeshCache.get(key)

package/src/sdk/FreddieBridge.js

@@ -115,6 +115,7 @@ export function validateMessage(msg) {
     if (typeof p.entityId !== 'string' || !p.entityId) errors.push('payload.entityId is required')
     if (!PRIMITIVES.includes(p.primitive)) errors.push(`payload.primitive must be one of: ${PRIMITIVES.join(', ')}`)
     if (p.primitive === 'model' && typeof p.model !== 'string') errors.push('payload.model is required when primitive is "model"')
+    if (p.primitive === 'model' && typeof p.model === 'string' && (!p.model || p.model.split(/[\\/]/).includes('..') || /^[a-zA-Z]:[\\/]/.test(p.model) || p.model.startsWith('/') || p.model.startsWith('\\'))) errors.push('payload.model must be a non-empty relative path with no ".." segments and no drive-absolute or root-absolute prefix')
     if (p.position && (!Array.isArray(p.position) || p.position.length !== 3)) errors.push('payload.position must be [x,y,z]')
     if (p.scale && (!Array.isArray(p.scale) || p.scale.length !== 3)) errors.push('payload.scale must be [sx,sy,sz]')
   }