feat: web client, get/drop updates and fixes

1 files changed, 44 insertions, 14 deletions

diff --git a/TODO.md b/TODO.md
index 833f6ed..244fdf4 100644
--- a/TODO.md
+++ b/TODO.md
@@ -6,28 +6,29 @@ A low-tech sci-fi MUD set on a terraformed asteroid. Runescape-style combat and
 
 Not generic fantasy. Takes place on a terraformed asteroid. Technology has regressed — people scrap and scavenge remnants of the old world. "Science" replaces Prayer, "Technology" replaces Magic. Scavenging replaces Runecrafting.
 
-## Skills (22 total, all go from 1-99)
+## Skills (23 total, all go from 1-99)
 
 ```
 Combat:    Attack, Strength, Defense, Hitpoints, Ranged, Science, Technology
 Gathering: Fishing, Woodcutting, Mining, Hacking, Scavenging, Farming
-Production: Cooking, Smithing, Crafting, Fletching, Alchemy, Construction
+Production: Cooking, Smithing, Crafting, Fletching, Alchemy, Construction, Firemaking
 Utility:    Thieving, Agility, Assassin
 ```
 
 ## Architecture
 
 ```
-cmd/mud/              Entry point
+cmd/mud/              Entry point (--config flag, multi-listener)
 internal/
+  config/             YAML config loading (telnet, http, https listeners)
   action/             Behavior system: gather/talk/use/toggle types, drop tables
   engine/             Tick scheduler (600ms)
   world/              Rooms, exits, ground items, mobs, object instance state
-  player/             Character sheet, skills, XP, inventory, equipment
+  player/             Character sheet, skills, XP, inventory, equipment, validation
   combat/             Combat formulas, combat state tracking
   object/             ItemDef, ObjectDef, item/object stores
-  net/                Telnet server, sessions, room-based player hub
-  game/               Session handler, login flow, command dispatch, action tick
+  net/                Telnet + HTTPS/WebSocket server, sessions, Conn interface, echo control
+  game/               Session handler, login flow, command dispatch, action tick, input sanitization
 data/
   behaviors/          Behavior YAML files (gather, talk, use, toggle)
   drops/              Shared drop table YAML files
@@ -47,13 +48,23 @@ Objects and mobs in rooms can have behaviors. Four types exist:
 
 | Type | Verbs | Use |
 |------|-------|-----|
-| `gather` | mine, chop, fish | Resource gathering with skill checks, tool requirements, depletion/respawn |
+| `gather` | mine, chop, cut, fish | Resource gathering with skill checks, tool requirements, depletion/respawn |
 | `use` | use | Crafting stations — consume items, produce output, optional skill checks |
 | `talk` | talk, speak, ask | NPC conversation trees with choices, conditions, actions |
 | `toggle` | pull, push | Levers, switches, gates — set world flags, conditional on existing values |
 
 Behaviors are defined in `data/behaviors/<id>.yaml`. Objects reference them with `behavior: <id>`. Mobs can also carry `behavior: <id>` — StartAction falls back to mob lookup when no object matches.
 
+### Two Depletion Mechanics
+
+**Per-drop depletion** (mining, regular trees): Set `depletes: true` on a drop entry. The resource depletes on first successful gather of that drop.
+
+**Shared depletion** (higher-tier trees): Set `shared_deplete: <ticks>` on the behavior. A shared timer counts down while anyone is chopping; when it hits 0, the next successful gather depletes the tree for all players. The timer regenerates back to max when no one is chopping.
+
+### Bird's Nests
+
+Set `nest_chance: 256` on a gather behavior to give a 1/256 independent chance to find a bird's nest alongside the normal drop. Bird's nests are searched with the `search` command, rolling on the `birds_nest_drop` drop table.
+
 ### Condition System
 
 Used by exits, talk options, on-enter scripts, and toggle checks:
@@ -98,15 +109,28 @@ Aliases resolve before built-in commands and support argument passthrough (`alia
 - Exits support conditions (world flags, player flags, items, compound)
 - Rooms support `on_enter` scripts with per-step conditions
 - Objects can be `hidden: true` (interactable but not listed in room)
+- Mobs wander via legal room exits (unconditioned), not hardcoded room lists
+- Mob wander config (`wander_rooms`, `wander_interval`) set per-instance in room YAML
+- Object wander config same format — objects teleport between listed rooms
 
 ## Implemented
 
 ### Core Systems
 - [x] Telnet server, account creation, hashed passwords, account/character management
+- [x] HTTPS/WebSocket server with embedded web terminal client
+- [x] Multi-listener config (telnet + http + https, any combination)
+- [x] YAML config file (`config.yaml`) with `--config` flag and runtime defaults
 - [x] 600ms tick engine driving all world simulation
 - [x] Room-based player hub with enter/exit/action notifications
 - [x] Single-login enforcement, disconnect timer
 - [x] Player YAML persistence on every state change
+- [x] Transport-agnostic Conn interface (tcpConn + wsConn)
+- [x] Password echo suppression (telnet IAC ECHO, web OSC sequences)
+- [x] Input sanitization (control character stripping at HandleSession)
+- [x] Name validation (alphanumeric+spaces, 3-30 chars)
+- [x] Max input line length (1024 bytes)
+- [x] WebSocket origin checking (same-origin + loopback)
+- [x] Ground item spawn stacking fix (Tick + SeedGroundItems)
 
 ### Commands
 - [x] `look / l` — room rendering (mobs, objects, ground items, exits, players)
@@ -117,13 +141,14 @@ Aliases resolve before built-in commands and support argument passthrough (`alia
 - [x] `score / inventory / equipment / exits` — character and world info
 - [x] `style` — combat style selection (prefix matching)
 - [x] `attack / kill <mob>` — combat with numbered targeting
-- [x] `mine / chop / fish <object>` — gathering with numbered targeting
+- [x] `mine / chop / cut / fish <object>` — gathering with numbered targeting
 - [x] `use <object>` — crafting station interaction
 - [x] `talk / speak / ask <target>` — NPC conversations (objects or mobs)
 - [x] `pull / push <object>` — toggle interactions (levers, gates)
 - [x] `alias <name> <cmd> / unalias <name>` — account-wide command aliases
-- [x] `toggle [name]` — 8 character settings
+- [x] `toggle [name]` — 9 character settings
 - [x] `description / desc / help [topic] / quit`
+- [x] `search <item>` — search bird's nests for loot
 
 ### Combat
 - [x] RSC-based formulas (attack/defense rolls, max hit)
@@ -131,27 +156,32 @@ Aliases resolve before built-in commands and support argument passthrough (`alia
 - [x] Equipment bonuses, HP tracking, death mechanics
 - [x] Combat lock timer, movement interrupts combat
 - [x] Mob/player regen (1 HP per 100 ticks)
-- [x] Mob wandering, enter/leave/spawn notifications
+- [x] Mob exit-based wandering, enter/leave/spawn notifications
 - [x] Drop reservation system (100-tick owner lock on loot)
 
 ### Skills & Gathering
 - [x] Mining (copper rocks, pickaxe, depletion/respawn, gem sub-table)
 - [x] Fishing (wandering spots, non-depleting, fishing rod)
+- [x] Woodcutting (9 tree types, axes, shared depletion, bird's nests)
 - [x] Tool system (tool_type + tool_speed on items, tool requirement on behaviors)
 - [x] Shared drop tables (referenced by multiple behaviors)
-- [x] 21 skill definitions with RSC XP table
+- [x] XP drops for all skill actions (combat, gathering, use)
+- [x] 23 skill definitions with RSC XP table (3 implemented: Mining, Fishing, Woodcutting)
 
 ### World & Data
 - [x] Room, item, object, mob, behavior, drop table YAML loaders
 - [x] Object instance tracking (depletion, wandering, respawn, broadcast)
-- [x] 11 playable rooms with mobs, objects, spawns, and conditional exits
+- [x] 21 structured rooms (west gathering wing, east production/utility/combat wing)
 - [x] Conditional exits (world flags, player flags, items, compound conditions)
 - [x] Room on_enter scripts with conditions
 - [x] Hidden objects (interactable but not listed in room output)
 - [x] Player-local flags vs world flags for multiplayer state separation
 - [x] Compound conditions: all_of / any_of
 - [x] Aligned ground item reservation display
-- [x] Hidden object support (referenced in room descriptions, not auto-listed)
+- [x] Mob wander config per-instance in room YAML (not on MobDef)
+- [x] Object depletion timer display (depletion toggle)
+- [x] Bidirectional prefix matching for get/drop/attack/gather commands
+- [x] Ambiguity detection when multiple object types match a command
 
 ### Documentation
 - [x] WORLDBUILDING.md — comprehensive guide with examples
@@ -164,7 +194,7 @@ See WORLDBUILDING.md for full examples of every data type with explanations.
 ## Action Plan
 
 ### Phase 1: Core Skill Chains (breadth over depth)
-- [ ] Woodcutting — tree objects + axes, same pattern as mining
+- [x] Woodcutting — tree objects + axes, shared depletion, bird's nests
 - [ ] Cooking — fire/range object (`use` type), raw fish/meat → cooked food
 - [ ] Smithing — furnace + anvil objects (`use` type), ore → bars → weapons/armor
 - [ ] Fletching — fletching table object (`use` type), logs → arrow shafts/bows