Thanks to everyone posting on the discussions board — this entire patch comes from your reports, plus a full audit of every mission those reports prompted me to run. Keep them coming.
Fixed: missions that couldn't be completed
- SCORCHED EARTH (the "burn it all" ending) could not be finished — it asked you to activate Omega Protocol without telling you to reconnect to the server first. It now says so explicitly.
- RESCUE ZERO asked you to "scan every host" without naming any, and its failsafe step could not be completed with the command it printed. Both objectives now name exactly what they need.
- INSIDE JOB and FOLLOW THE MONEY told you to delete a log file that does not exist on those machines, so the objective could never complete.
- The corporate ending's packaging step printed a command the terminal rejects.
- "Buy a new identity on the darkweb" — there was no identity to buy. There is now.
- Voice phishing and several defensive tools refused to run unless you had bought a specific skill, which could dead-end the very missions that teach those tools. Skills now make these tools better instead of locking them.
Fixed: New Game+
- Starting a second run in the same session inherited files from your previous campaign, which auto-completed the finale and forced you into your previous ending. New campaigns now start with a clean filesystem.
Fixed: "Permission denied" as root
- Once you have compromised a host, you now actually have root on it. Deleting logs (rm /var/log/auth.log), kill and chmod all work over SSH instead of refusing you — the tutorial told you to do something the game would not let you do.
- Covering your tracks now works as taught, and a failed delete no longer silently ticks the objective off.
Fixed: confusing early missions
- PORT KNOCK no longer repeats THE AWAKENING — it now maps the gateway router instead of rescanning the same machine.
- SKELETON KEY targets a fresh machine. Its "SSH in" objective used to complete the moment the mission started, because you already owned that box.
- FIRST BLOOD now tells you which machine to attack.
- Fixed mission hints that suggested commands the terminal rejected (hydra ssh://..., hydra -w, firewall show, and others).
Fixed: SOC Dashboard alert spam
- Alerts were picked completely at random, so roughly one in six was CRITICAL, and a single unconfirmed false positive pinned the threat level to CRITICAL permanently — which is why it felt like it needed constant babysitting.
- Alerts are now weighted like a real SOC: mostly low-level noise, with genuine incidents rare. False positives no longer drive the threat level, but a confirmed intruder still raises CRITICAL immediately. When it is red now, it means something.
Fixed: trace advice that did not apply
- Trace warnings now match where you actually are. If you are not connected to anything, it tells you to run history -c and go quiet instead of telling you to delete a server log you cannot reach.
- history -c now reduces trace from your own machine too.
- The trace meter reads "TRACE: 18% (MAX 85%)" so the second number is clear.
- Being disconnected now tells you why instead of silently dropping you.
Fixed: SECURE CHANNEL scrolling
- You can scroll back through the comms log to re-read a briefing. It stays where you put it instead of snapping to the bottom, and you can select text to copy.
Audio
- The alarm when you are caught is much quieter — it was far louder than everything else and blew out the mix.
Commands are more forgiving
- curl http://<ip>, dirb http://<ip> and hydra ssh://<ip> now work — the game taught these forms but the terminal rejected them.
- arpspoof works with just a target IP and no longer requires an SSH session first.
- firewall show, ransomware deploy <ip>, usb <org> and darkweb buy <name> all work now.
- You can add your own aliases to ~/.bashrc and the terminal will load them (alias name='command' still works directly too).
Other fixes
- Phishing handed out passwords that never worked for 7 of the 14 targets. Successful phishing now gives you credentials that actually log in.
- searchsploit shows vulnerabilities for the service you searched for, instead of the same list every time.
- The CVE reported on securenews.com is now a real, exploitable vulnerability on the machines the article names.
- Objectives no longer complete off failed commands — a wrong SSH password no longer counts as breaking in, and a failed copy no longer counts as exfiltration.
- New players are now told that contracts come from the terminal (type jobs), not from a website in the browser.