Bug fixes and QoL based on early Next Fest player reports. Thanks to super_aardvark, cas, Tanner07, vince_kully, Delta, and marvelous for the detailed feedback - some of this shipped directly from your reports.
shop ls and shop buy <id> - browse and purchase from the terminal without opening the browser. shop alone still opens the browser as before
Browser now accepts http:// and https:// prefixes and ip:port format - type URLs naturally and they resolve correctly
Browser now recognises web panels on non-standard ports (e.g. admin panels on 8080)
Browser form inputs: backspace works in input fields; entered values display on the page after submission; password fields show plaintext while typing, stars in the page render
import "x" as y alias syntax - import modules under a shorter name
New string methods: find() (index of substring), substr() (extract portion), trim() (strip whitespace)
Function display shows parameters - log(myFunc) now prints <function myFunc(arg1, arg2)>
Tutorial close now explicitly mentions help scripting and help api
mylib.myFunc() now works - calling imported module functions via dot notation was failing; had to assign to a local variable first
mv file .. no longer silently deletes the file - .. in paths is now resolved correctly
rm -r added for recursive directory deletion
Mixed-case script names work - userTest.bd can be run by typing userTest
connect() now accepts user@host format and an optional password argument
whoami(conn) and get_hostname(conn) now accept an optional conn argument
Tutorial: clicking in the file pane advances objectives - navigating into a directory or clicking to view a file counts the same as typing cd or cat
Tutorial improvements - static now explains the trace timer and disconnect during orientation; first SSH to any server shows a reminder the trace is running; mission_00 objectives show the exact commands to type; hello.bd points toward probe.bd and cracker.bd as next steps
help scripting now covers language basics: list literals, indexing, loops, conditionals, type conversion
~/docs/security_guide.txt updated to reference help scripting and help api
Editor sidebar reference expanded - variables, control flow, operators, list methods, string methods, and builtins all documented in the editor panel. Open the editor and check the right pane
Chicken Run trace time reduced - 300s → 120s. The intended path (find credentials in the filesystem) fits comfortably. Brute-forcing root at 0.9 security no longer does. Briefing now hints at credentials being faster than cracking
Trace bar snaps faster when time is low - under 15 seconds the bar catches up to the actual timer more quickly, so high-alert situations read correctly on screen
Trace no longer runs after a script finishes or is interrupted - if a script called connect() then was killed before reaching disconnect(), the trace kept running at the home terminal. Now cleaned up when any script exits
Delete/scrub missions no longer prompt you to upload to the drop server - completing a delete objective now ends the mission correctly
list_files() now returns a path field - f.path gives the full path, making recursive traversal straightforward
DictCracker rewritten - the previous version built a wordlist but never used it. Now does real noise-managed cracking with sleep() backoff and progress/hint logging
api.blackdoor.tools dead link removed from api_quickref.txt - replaced with help api
security_guide.txt updated - explains that cracker.bd calls connect() internally, starting the trace
Containment timer no longer fires after mission abandon - if a high-IDS-penalty disconnect triggered the HUNTED state right as you abandoned, consequences fired 30 seconds later while you were back at the terminal. Now cancelled cleanly on force-disconnect
Abandoned missions now return to the picker - dropping a mission with mission abandon previously removed it from the list permanently. It now reappears so you can re-accept it. Existing saves: just reload the game and any abandoned missions will be back
Numpad Enter now submits terminal commands correctly
Script usage string fixed - running a script without required arguments showed probe.bd <target> (wrong filename, wrong format). Now shows probe <target> to match how scripts are actually invoked
Tutorial hints corrected - referred to probe target=142.93.44.12; correct syntax is positional: probe 142.93.44.12
scan() on unknown host now fails immediately - an unrecognised IP was silently redirected to the current connected server, causing probe to run forever on a typo'd IP. Now errors with "host unreachable" straight away
QuietCrack ($200) - replaces DictCracker. Same noise-managed cracker, honest name. The old one claimed to use a dictionary; it didn't
Rockyou Pack ($50) - 1000 real leaked passwords delivered to ~/wordlists/rockyou.txt
Corporate Pack ($75) - 500 corporate-pattern passwords. Company names, years, policy patterns
Targeted Pack ($100) - 200 passwords pulled from the game world. Rewards players who explore
Wordlists are plain text files delivered to ~/wordlists/. Not wired into the default cracking flow yet - that mechanic is coming. Buy them now to be ready, or wait until it lands
A new shop item: Crack Source ($650). This shipped after players asked why the scripting mechanics feel like a black box.
Buying it delivers the source as an editable .bd file and a plain-English breakdown of how the system works. It also unlocks lower-level primitives for players who want to build their own tools.
crack() still works exactly as before. You don't need any of this. But if you want to understand it - or build something smarter - it's there.
Web attack vectors - SQL injection and command injection as attack paths are on the design board for 1.0
Tutorial - more hand-holding through the first hack. Work in progress
A proper roadmap post is coming. This is the short version.
- Static