Fixes

agents/greed.rhai

@@ -1,5 +1,3 @@
-
-
 // Return a random valid action on the given board.
 // Used as a last resort.
 fn random_action(board) {
@@ -59,8 +57,8 @@ fn compute_influence(board) {
 	}
 
 
-   // Sort by increasing absolute score
+	// Sort by increasing absolute score
-   influence.sort(|a, b| {
+	influence.sort(|a, b| {
 		let a_abs = a[1].abs();
 		let b_abs = b[1].abs();
 
@@ -85,7 +83,6 @@ fn place_number(board, minimize) {
 		return random_action(board);
 	}
 
-
 	// Get the most influential position
 	let pos = influence[-1][0];
 	let val = influence[-1][1];
@@ -104,7 +101,7 @@ fn place_number(board, minimize) {
 		if val > 0 {
 			symbol = available_numbers[-1];
 		} else {
-		  	symbol = available_numbers[0];
+			symbol = available_numbers[0];
 		}
 	}
 
@@ -139,25 +136,20 @@ fn place_op(board, minimize) {
 	return ();
 }
 
-
 // Main step function (shared between min and max)
 fn greed_step(board, minimize) {
-
 	let action = place_op(board, minimize);
+
+	// We could not place an op, so place a number
 	if action == () {
 		action = place_number(board, minimize);
 	}
 
-	if board.can_play(action) {
-		return action;
-	}
-
 	// Prevent invalid moves, random fallback
+	if board.can_play(action) { return action; }
 	return random_action(board);
 }
 
-
-
 // Minimizer step
 fn step_min(board) {
 	greed_step(board, true)

webui/src/app/api/get-script/route.ts

@@ -2,10 +2,10 @@ import { NextRequest, NextResponse } from "next/server";
 import { readFile } from "fs/promises";
 import { join } from "path";
 import { existsSync } from "fs";
-import { SAVE_CONFIG } from "@/lib/saveConfig";
+import { CONFIG } from "@/lib/config";
 
 // Force dynamic rendering for this API route
-export const dynamic = 'force-dynamic';
+export const dynamic = "force-dynamic";
 
 export async function GET(request: NextRequest) {
 	try {
@@ -20,14 +20,14 @@ export async function GET(request: NextRequest) {
 		}
 
 		// Validate filename (same validation as save)
-		if (!SAVE_CONFIG.FILENAME_REGEX.test(name)) {
+		if (!CONFIG.FILENAME_REGEX.test(name)) {
 			return NextResponse.json(
 				{ error: "Invalid script name" },
 				{ status: 400 }
 			);
 		}
 
-		const saveDir = SAVE_CONFIG.SAVE_DIRECTORY;
+		const saveDir = CONFIG.SAVE_DIRECTORY;
 		const filename = `${name}.rhai`;
 		const filepath = join(saveDir, filename);
 
@@ -38,7 +38,11 @@ export async function GET(request: NextRequest) {
 			);
 		}
 
-		const content = await readFile(filepath, "utf8");
+		let content = await readFile(filepath, "utf8");
+
+		if (content.trim().startsWith("// SECRET")) {
+			content = "// This script is hidden :)";
+		}
 
 		return NextResponse.json({
 			name,

webui/src/app/api/list-scripts/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { readdir } from "fs/promises";
 import { existsSync } from "fs";
-import { SAVE_CONFIG } from "@/lib/saveConfig";
+import { CONFIG } from "@/lib/config";
 
 // Force dynamic rendering for this API route
 export const dynamic = "force-dynamic";
@@ -14,7 +14,7 @@ const headers = {
 
 export async function GET(_request: NextRequest) {
 	try {
-		const saveDir = SAVE_CONFIG.SAVE_DIRECTORY;
+		const saveDir = CONFIG.SAVE_DIRECTORY;
 
 		// If save directory doesn't exist, return empty array
 		if (!existsSync(saveDir)) {

webui/src/app/api/save-script/route.ts

@@ -2,12 +2,12 @@ import { NextRequest, NextResponse } from "next/server";
 import { writeFile, mkdir } from "fs/promises";
 import { join } from "path";
 import { existsSync } from "fs";
-import { SAVE_CONFIG } from "@/lib/saveConfig";
+import { CONFIG } from "@/lib/config";
 
 export async function POST(request: NextRequest) {
 	try {
 		// Check if saving is enabled
-		if (!SAVE_CONFIG.ENABLE_SAVE) {
+		if (!CONFIG.ENABLE_SAVE) {
 			return NextResponse.json(
 				{ error: "Script saving is disabled" },
 				{ status: 403 }
@@ -16,15 +16,13 @@ export async function POST(request: NextRequest) {
 
 		const { name, content, secret } = await request.json();
 
-		// Validate secret
+		if (secret !== CONFIG.SAVE_SECRET) {
-		if (secret !== SAVE_CONFIG.SAVE_SECRET) {
 			return NextResponse.json(
-				{ error: "Invalid save secret" },
+				{ error: "Invalid secret" },
 				{ status: 401 }
 			);
 		}
 
-		// Validate required fields
 		if (!name || !content) {
 			return NextResponse.json(
 				{ error: "Name and content are required" },
@@ -32,17 +30,25 @@ export async function POST(request: NextRequest) {
 			);
 		}
 
-		// Validate filename
+		if (name.length > CONFIG.MAX_FILENAME_LENGTH) {
-		if (name.length > SAVE_CONFIG.MAX_FILENAME_LENGTH) {
 			return NextResponse.json(
 				{
-					error: `Filename must be ${SAVE_CONFIG.MAX_FILENAME_LENGTH} characters or less`,
+					error: `Filename must be ${CONFIG.MAX_FILENAME_LENGTH} characters or less`,
 				},
 				{ status: 400 }
 			);
 		}
 
-		if (!SAVE_CONFIG.FILENAME_REGEX.test(name)) {
+		if (content.length > CONFIG.MAX_FILE_SIZE) {
+			return NextResponse.json(
+				{
+					error: `File is too large`,
+				},
+				{ status: 400 }
+			);
+		}
+
+		if (!CONFIG.FILENAME_REGEX.test(name)) {
 			return NextResponse.json(
 				{
 					error: "Filename can only contain alphanumerics, underscores, spaces, and hyphens",
@@ -52,7 +58,7 @@ export async function POST(request: NextRequest) {
 		}
 
 		// Ensure save directory exists
-		const saveDir = SAVE_CONFIG.SAVE_DIRECTORY;
+		const saveDir = CONFIG.SAVE_DIRECTORY;
 		if (!existsSync(saveDir)) {
 			await mkdir(saveDir, { recursive: true });
 		}

webui/src/components/Playground.tsx

@@ -240,7 +240,7 @@ export default function Playground() {
 		}
 
 		if (!saveSecret.trim()) {
-			alert("Please enter the save secret");
+			alert("Please enter a secret");
 			return;
 		}
 
@@ -408,11 +408,11 @@ export default function Playground() {
 										</div>
 
 										<div className={styles.configField}>
-											<label>Save secret</label>
+											<label>Secret</label>
 											<input
 												type="password"
 												className={styles.saveInput}
-												placeholder="Enter save secret..."
+												placeholder="Enter secret..."
 												value={saveSecret}
 												onChange={(e) =>
 													setSaveSecret(

webui/src/lib/config.ts

@@ -1,8 +1,9 @@
-export const SAVE_CONFIG = {
+export const CONFIG = {
-	ENABLE_SAVE: process.env.ENABLE_SAVE === 'true' || true,
+	ENABLE_SAVE: process.env.ENABLE_SAVE === "true" || true,
 	SAVE_SECRET: process.env.SAVE_SECRET || "save",
 
 	SAVE_DIRECTORY: process.env.SAVE_DIRECTORY || "./data/scripts",
 	MAX_FILENAME_LENGTH: parseInt(process.env.MAX_FILENAME_LENGTH || "32"),
+	MAX_FILE_SIZE: parseInt(process.env.MAX_FILE_SIZE || "1048576"),
 	FILENAME_REGEX: /^[a-zA-Z0-9_\s-]+$/,
 } as const;