fix: harden engine across casino, economy, concurrency, security, and content

1 files changed, 33 insertions, 3 deletions

diff --git a/internal/player/player.go b/internal/player/player.go
index 0a48b04..f8d9a68 100644
--- a/internal/player/player.go
+++ b/internal/player/player.go
@@ -43,6 +43,21 @@ var AllSkills = []SkillName{
 	Pharmacy, Thieving, Agility, Construction, Scavenging, Hacking, Assassin, Farming,
 }
 
+// ValidSkill reports whether name is a skill this game defines. A craft
+// recipe's declared skill is item.CraftDef.EffectiveSkill, which is the recipe
+// TYPE, and not every type is a skill: a combine recipe carries type "combine".
+// Level reads an undefined name as a map miss (level 1) and AddSkillXP would
+// persist a phantom entry under it, so callers that roll success or award XP
+// against a recipe type must check with this first.
+func ValidSkill(name SkillName) bool {
+	for _, s := range AllSkills {
+		if s == name {
+			return true
+		}
+	}
+	return false
+}
+
 var SkillAbbr = map[SkillName]string{
 	Accuracy:     "acc",
 	Strength:     "str",
@@ -353,8 +368,13 @@ func (p *Player) SetInvSlot(i int, slot *InventorySlot) {
 	}
 }
 
+// MaxInventorySlots is the inventory capacity: the valid slots are
+// 0..MaxInventorySlots-1. characterInventorySlots in store.go mirrors this
+// value for on-disk sanitization.
+const MaxInventorySlots = 28
+
 func (p *Player) FirstFreeSlot() int {
-	for i := 0; i < 28; i++ {
+	for i := 0; i < MaxInventorySlots; i++ {
 		if p.Inventory[i] == nil {
 			return i
 		}
@@ -362,9 +382,19 @@ func (p *Player) FirstFreeSlot() int {
 	return -1
 }
 
+// FreeSlots counts the empty inventory slots. Only valid slots (0..27) with a
+// non-nil entry count as used: a corrupt, hand-edited, or partially-migrated
+// save can carry out-of-range or nil-valued map entries that no gameplay path
+// can free, and counting those would understate the free space (or drive the
+// count negative). For a valid character the result is unchanged.
 func (p *Player) FreeSlots() int {
-	used := len(p.Inventory)
-	return 28 - used
+	used := 0
+	for i := 0; i < MaxInventorySlots; i++ {
+		if p.Inventory[i] != nil {
+			used++
+		}
+	}
+	return MaxInventorySlots - used
 }
 
 func New(name string) *Player {