I grew up coding MUDs (in college) and every year I try to recreate that glory, so I start a fresh MUD code base from scratch.

This year, I am creating a nodejs MUD, well closer to a MUSH actually.

* Everything is an Entity with Attributes * A player is an Entity with its client property set * There's a handful of built-in commands, but the important ones are @eval and @set-attribute * The soft-code language is ... JavaScript. * It uses the vm module from nodejs[0] to execute stuff. * It has separate clients (so far) for Discord, Slack, and local console. It's easy to add more and will be easier after I do this one refactor.

Each time an soft-code command or function or what have you executes, it creates a new context to isolate the soft-code from the rest of the application and uses Proxy objects to isolate the database Entity from the soft-code Entity. As an example, this is the look command (placed on the global registry object):

      if (!me.location) {
        me.send("You are nowhere.");
      } else {
        me.send("**" + me.location.name + "**");
        const contents = me.location.contents;
        if (!contents?.length) {
          me.send("You see nothing here.");
        } else {
          me.emit("You see:\\n" + contents.map(thing => "* " + thing.name).join("\\n"));
        }
      }

The Proxy manages access to Entities and Attributes (for example, Attributes can only normally be accessed by their owners).

The MUSH outputs markdown for everything, so each client can format it however it likes.

I know the security is not nearly close to perfect, but it's mostly a proof of concept that I will make public one day. I did do a few things, like disable eval and Function and Promise but there's probably plenty of ways to get around it.