From 1f35784c524e8ecccc0670c03ebfec51250feb4e Mon Sep 17 00:00:00 2001
From: Frank <frank.van.den.berg@eleaf.com>
Date: Tue, 18 Aug 2026 21:47:21 +0200
Subject: [PATCH] Don't regenerate a verify code when sent privately to its
 rightful owner

checkAndRegenerateVerifyCodes() regenerated a code on any message
containing it, regardless of who the message was sent to - so sharing
a code exactly as intended, via /chat {agent-id} {code} to the
correct recipient, still burned it immediately, making the puzzle
unsolvable. Now only broadcasts and messages sent to the wrong player
count as a leak.
---
 src/Game/Service/GameResponseService.php | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/src/Game/Service/GameResponseService.php b/src/Game/Service/GameResponseService.php
index 5c80806..dd8fb7c 100644
--- a/src/Game/Service/GameResponseService.php
+++ b/src/Game/Service/GameResponseService.php
@@ -431,12 +431,12 @@ class GameResponseService
 
         $this->updateChatTracking($player, (int)$sendTo);
 
-        $this->checkAndRegenerateVerifyCodes($player, $chatMessage . ' ' . implode(' ', $messageParts));
+        $this->checkAndRegenerateVerifyCodes($player, $chatMessage . ' ' . implode(' ', $messageParts), (int)$sendTo);
 
         return true;
     }
 
-    private function checkAndRegenerateVerifyCodes(Player $player, string $messageContent): void
+    private function checkAndRegenerateVerifyCodes(Player $player, string $messageContent, int $sendTo): void
     {
         $screen = $player->getScreen();
         $session = $player->getSession();
@@ -456,10 +456,19 @@ class GameResponseService
         $regenerated = false;
 
         foreach ($codes as $targetPlayerScreen => $code) {
-            if (str_contains($messageContent, (string)$code)) {
-                $codes[$targetPlayerScreen] = bin2hex(random_bytes(3));
-                $regenerated = true;
+            if (!str_contains($messageContent, (string)$code)) {
+                continue;
             }
+
+            // Sending a code privately to its rightful recipient via /chat {agent-id}
+            // is the whole point of this puzzle - only a leak (broadcast, or sent to
+            // the wrong player) should regenerate it.
+            if ($sendTo === (int)$targetPlayerScreen) {
+                continue;
+            }
+
+            $codes[$targetPlayerScreen] = bin2hex(random_bytes(3));
+            $regenerated = true;
         }
 
         if ($regenerated) {