5 tiers selectable in Sim Lab config panel. Each tier scales enemy
wounds/BS/AP, adds check penalties, adjusts max combat rounds,
inter-scene healing chance, fear bonus, and adds a 3rd Elite Guard
enemy at Brutal+. Difficulty stored in DB (difficulty_level column)
and shown as a badge in the sidebar and report header.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Backend:
- Add `simulations` table to MariaDB (mission, players, result, XP,
roll feed, player cards, scene log, findings — all persisted as JSON)
- simulationHelpers: save / getAll / getById / delete
- simulationRoutes.js: POST /api/simulations (run engine + save),
GET /api/simulations (list), GET /:id (full report), DELETE /:id
- Simulation engine: d100 dice, fear tests, combat rounds with
initiative, conditions, damage, fate re-rolls, skill checks,
auto-assign checks to best-stat player, enemy pools from scene data,
per-player report cards with grade A-D, hero moments, shame list
Frontend:
- SimulationTab.jsx: GM-only tab with sidebar list of past runs,
"Run New Simulation" config panel (pick mission + players),
collapsible scene log, player report cards, filterable roll feed,
findings panel
- App.js: import SimulationTab, add "⚙ Sim Lab" nav button (GM only)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
All 11 issues from 4-player simulation of The Hunt for Fabius Bile:
1. Roll feed visible to all players (no GM auth guard)
2. Scene text gated by revealed flag; GM explicit reveal per scene
3. GM can add NPC/enemy entries to initiative tracker
4. Round counter synced to Dice Roller via localStorage + custom event
5. Check reward text hidden until player has rolled
6. Checks assignable to specific player via Scene Secrets ⚙ options
7. Fear test quick-roll panel with WP input appears when fearRating > 0
8. Decision checks show textarea/Declare instead of d100 roll button
9. Fate point re-roll: one per check per scene, resets on scene advance
10. Player poll reduced from 8s to 4s, combined mission + roll feed poll
11. Mission complete banner with scene stats and GM outcome notes field
4 follow-up findings from second simulation run:
- Finding #1: Activate mission now initialises revealed:false on all scenes
so players never see scene text before the GM narrates
- Finding #2: Fear penalty auto-applied to WP display; button shows
effective (penalised) target rather than raw WP input
- Finding #3: RollFeedRow moved outside component to avoid re-mount on
every render; onDelete passed as prop
- Finding #4: Removed duplicate "Open for Players" quick-button from
Scene Checks left panel — Scene Secrets is the sole entry point
New files:
- src/tests/missionPlaythrough.test.js — full GM+4-player simulation
test suite covering all 11 issues and 4 findings (39 test cases)
- src/tests/missionTab.test.js — player/GM view isolation tests
- src/utils/diceRoller.js — shared d100/degrees/clampTarget utilities
- tests/missionRoutes.test.js — backend mission route unit tests
- tests/playerRoutesLogin.test.js — player login route tests
- tests/sessionRoutes.test.js — session validation tests
Note: React unit tests require jsdom; segfaults on ARM64 (Raspberry Pi)
due to a known jsdom/Node 20 incompatibility on aarch64. Tests pass on
x86 CI. Backend integration tests (tests/) run normally.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- MariaDB missions table with scenes JSON
- /api/missions CRUD routes
- MissionTab saves completed missions to DB
- Mission history panel in UI
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Switch from localhost to Synology NAS (192.168.1.113:3307) for
centralized database hosting.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Replace hardcoded DB_PASSWORD 'dwroller2025' with process.env.DB_PASSWORD
- Replace hardcoded GM_SECRET 'bongo' with process.env.GM_SECRET
- Replace hardcoded GM_PASSWORD with process.env.GM_PASSWORD
- Replace hardcoded PLAYER_PASSWORD '1234' with process.env.PLAYER_PASSWORD
- Update .env.example to document required environment variables
- Apply changes to all backend routes, database modules, and React components
- Update test files to use environment variables for credentials
- Ensure .env remains in .gitignore for production safety
This fix addresses critical security vulnerabilities where database
credentials and authentication secrets were exposed in source code.
