fix: harden engine across casino, economy, concurrency, security, and content

1 files changed, 19 insertions, 15 deletions

diff --git a/internal/game/cmd_option.go b/internal/game/cmd_option.go
index 294ed5e..1bfd1b5 100644
--- a/internal/game/cmd_option.go
+++ b/internal/game/cmd_option.go
@@ -85,24 +85,28 @@ func (g *Game) doOption(sess *net.Session, input string) {
 		p.Options["card_size"] = 5
 	}
 
-	if sess.Account.Options == nil {
-		sess.Account.Options = make(map[string]any)
-	}
-	sess.Account.Options[def.Name] = parsed
-	if def.Name == "unicode" && parsed == false {
-		sess.Account.Options["card_size"] = 5
-	}
-
-	acc, err := g.AccountStore.LoadAccount(sess.Account.Name)
-	if err == nil {
-		if acc.Options == nil {
-			acc.Options = make(map[string]any)
+	// The account can be gone (purged or republished from another session)
+	// while the player is still live: the option is applied to the player
+	// either way, but the account update needs a valid account.
+	if sess.Account != nil {
+		if sess.Account.Options == nil {
+			sess.Account.Options = make(map[string]any)
 		}
-		acc.Options[def.Name] = parsed
+		sess.Account.Options[def.Name] = parsed
 		if def.Name == "unicode" && parsed == false {
-			acc.Options["card_size"] = 5
+			sess.Account.Options["card_size"] = 5
+		}
+
+		if acc, err := g.AccountStore.LoadAccount(sess.Account.Name); err == nil {
+			if acc.Options == nil {
+				acc.Options = make(map[string]any)
+			}
+			acc.Options[def.Name] = parsed
+			if def.Name == "unicode" && parsed == false {
+				acc.Options["card_size"] = 5
+			}
+			g.saveAccount(acc)
 		}
-		g.saveAccount(acc)
 	}
 	sess.WriteLine(fmt.Sprintf("%s set to %s.", def.Name, formatOptionValue(p, def)))
 }