Fixes snapshotShape in src/arena.ts: non-trip zones (smoke, wall, molly, flash) were sent to every player at full precision regardless of visibility, gated only for trips (by side). Since an ability lands at or near the thrower's feet, this handed every client a partial position oracle on enemies they had no line of sight to — same shape as the already-fixed shot leak.
A zone is now shown to a viewer only if they're standing in it (distance <= z.r + PLAYER_R, so your own smoke doesn't vanish under you) or, failing that, if wallBetween finds no wall between viewer and zone — deliberately not sightBlocked, since that also checks zones and would let one zone occlude another.
Added a generic regression test in src/server.test.ts: it stringifies a viewer's whole snapshot and asserts neither the id nor the rounded coordinate of a body they can't see appears anywhere in it, rather than checking one named field. Verified it fails against the pre-fix filter (reproduced the leak) and passes with the fix. Test count went from 297 to 298, no other test touched.
Measured with 11 zones scattered around a match (matching the issue's own count): before, all 11 reached the viewer (3806 bytes); after, only the 2 the viewer could actually see did (3353 bytes).
Checked every other field per the issue's list: orbs are fixed furniture, spike.x/y is already gated on planted-or-attacker, board/feed/events carry names, not places — confirmed nothing else in the snapshot leaks a position. src/engine/ untouched.
Pushed. Summary below for the pull description.
Fixes
snapshotShapeinsrc/arena.ts: non-trip zones (smoke, wall, molly, flash) were sent to every player at full precision regardless of visibility, gated only for trips (by side). Since an ability lands at or near the thrower's feet, this handed every client a partial position oracle on enemies they had no line of sight to — same shape as the already-fixed shot leak.A zone is now shown to a viewer only if they're standing in it (
distance <= z.r + PLAYER_R, so your own smoke doesn't vanish under you) or, failing that, ifwallBetweenfinds no wall between viewer and zone — deliberately notsightBlocked, since that also checks zones and would let one zone occlude another.Added a generic regression test in
src/server.test.ts: it stringifies a viewer's whole snapshot and asserts neither the id nor the rounded coordinate of a body they can't see appears anywhere in it, rather than checking one named field. Verified it fails against the pre-fix filter (reproduced the leak) and passes with the fix. Test count went from 297 to 298, no other test touched.Measured with 11 zones scattered around a match (matching the issue's own count): before, all 11 reached the viewer (3806 bytes); after, only the 2 the viewer could actually see did (3353 bytes).
Checked every other field per the issue's list:
orbsare fixed furniture,spike.x/yis already gated on planted-or-attacker,board/feed/eventscarry names, not places — confirmed nothing else in the snapshot leaks a position.src/engine/untouched.Closes #25