Hey All, PICO-8 0.2.7 is now up on lexaloffle, Humble and itch.io. No CHIP/PocketCHIP build yet, sorry! (my last PocketCHIP died -- I'll come back to that later)

This update introduces some late additions to the API before freezing at 0.3, and improvements aimed at handheld devices. 0.2.7 also includes an important security patch for a vulnerability affecting untrusted carts running locally (see below).

RRECT

This feature was needed for Picotron but I think also feels at home in PICO-8 / Voxatron. rrect() and rrectfill() take x,y for the top left corner, a width and height of the rectangle, and a radius for the corners. When the radius is 0 (the default), rrect / rrectfill act as an alternative to rect / rectfill when it is more convenient to specify a width and height rather than x1, y1.

Outlines & Underlines

P8SCII in 0.2.7 has new commands for outlining and underlining text. To get an outline, use \^o followed by a single character for colour, and two hex characters that indicate which of the 8 neighbouring pixels to draw:

0x01    0x02    0x04
0x08     --     0x10
0x20    0x40    0x80

For example, to draw a dot with a red(8) outline of the lower neighbours (0x20+0x40+0x80) and the top left neighbour (0x1), the command would be: ?"\^o8e1."

The underline command \^u does not take any parameters; it draws a line in the foreground colour 1 pixel below the bottom of the character. See the manual for more details:
https://www.lexaloffle.com/dl/docs/pico-8_manual.html#P8SCII_Outlines

Cart Prefetching & Cache Surfing

Cartridges that are listed in SPLORE are now proactively fetched from the BBS in the background, instead of downloading a cart only once it is selected. This makes it easier to grab a bunch of cartridges from the BBS and then play them while offline. Simply list the carts you'd like to download (e.g. by scrolling through NEW and selecting [LOAD MORE]), and wait for a few seconds for them to finish downloading. There is a small colourful spinner animation in the top left corner that indicates batch downloading is in progress. It is visible when a cartridge is not selected (e.g. on the [more] or [update] menu items), which you can see in the gif below.

Prefetching can be disabled (or made more aggressive) in config.txt with:

max_prefetch_threads 0

Cartridges that are downloaded to the local cache can also be listed newest first from the local files list under [CACHE] in the root directory. In the gif, you can see prefetched cartridges showing up in the cache listing each time [REFRESH] is selected.

Note that BBS cartridges that are downloaded are never automatically deleted from the cache (they do not expire), so there is normally no need to manually download and copy cartridges if they can be found in splore (e.g. by adding them to your favourites).

Favourited cartridges in the cache do not necessarily have any metadata stored (author, full title), and show up as just the cart id. For such carts, metadata is fetched from the BBS the next time the cartridge is run while internet is available.

BBS Favourite Listings

To list cartridges that you have favourited via the website (while logged in), you can now use the search section in splore:

1. Set your favourites (or likes) to public on the settings page

2. In PICO-8, seach for: fav:username or like:username

Multicart Export Limit: 32 Cartridges

0.2.7 now allows up to 32 cartridges in a single HTML or binary export, an increase from the previous limit of 16. This is aimed at [groups of] authors who would like to release bundles of carts, and I think 32 is a cute size in that context. I've heard from several groups who are interested in creating "n-in-1 game" style collections, which PICO-8 is naturally suited for, and 16 cartridges isn't quite enough for that. I don't think I could stomache going as far as 64 though -- you'd need to start packing multiple tiny games per cart for that!

[The downside of course is that a 32 cart limit does introduce extra unwanted gravity towards Making Bigger Things. However, there have only been a handful of projects that have pushed the 16 cart limit in order to cram extra content into a single game, and I don't think any of them would have suffered from this new limit.]

Security Patch

When run un-sandboxed (i.e. as a local cart), ls() in 0.2.6b and earlier caused a buffer overrun for long input strings, allowing a hypothetical bad actor to construct an RCE attack. A proof of concept for such an attack that works under windows was posted 4 weeks ago, but the author kindly took it down soon after while I worked on this patch. In 0.2.7 I've fixed that particular case, audited the codebase for similar issues, and introduced some extra safeguards for string handling that is in code paths reachable by the userland api. I opted to release it along with 0.2.7 features to encourage as many users to update as possible.

This vulnerability does not impact cartridges that are run directly from splore or via load #foo, and I have been monitoring the BBS cartridge submissions for anything suspicious. In any case, please consider updating soon especially if you planning on running carts locally from un-trusted sources.

Changelog

v0.2.7

Added: rrect, rrectfill(x,y,w,h,corner_radius,col)
Added: ?"\^o8ff..." to print outlines (col, 2 hex values for neighbour bits)
Added: ?"\^uunderline"
Added: ?"\^;" and ?"\^," for one-off characters that respect padding
Added: browse cached carts via splore's local tab
Added: background cart downloading (any bbs cart visible in a splore list is fetched from cdn)
Added: splore: search publicly listed favourites, likes // fav:username or like:username
Added: splore: search for top-starred by time // t:month t:week t:20 for last n days, tr:2022 for time range
Added: sfx(n) returns the channel index it was played on
Added: config.txt: boot_to_splore 1 // always launch splore on startup. same as using the -splore commandline switch
Added: config.txt: accept_future 1  // allow loading cartridges created with future versions of PICO-8
Added: when multiple displays are present, fullscreen favours the display that the window is currenly inside
Changed: print"\^w\^t\^=..." draws horizontal stripes (used to be the same as \^p)
Changed: max multicart export is now 32 cartridges, max serial file size is 512k (was 16, 256k)
Changed: cartdata() can switch between up to 4 different ids per session
Changed: Mac build uses statically linked libcurl (used to make a system() call to curl for each request)
Fixed: ls(longstr) causes buffer overrun // dangerous, but doesn't apply to sandboxed (bbs) carts 
Fixed: circfill with a negative radius and inverted drawing bit set is a NOP (should fill entire screen)
Fixed: drawing filled shapes completely outside of clip rectangle sometimes crashes under web (illegal read)
Fixed: memory corruption when using remapped video memory after reboot
Fixed: ?"\^c" doesn't cost any cpu (should be same as cls())
Fixed: dset() not flushed on run() when data changes more than once in the last second
Fixed: ?"⁷s000" or ?"\as00" crashes on Mac OS X // bad assumption about null termination; explains #tomorrowswinds crash
Fixed: coresume() only returns first return value
Fixed: splore: while in fold-out cart menu, PAGEUP, PAGEDOWN, HOME, END apply to cart list instead of cart menu cursor
Fixed: merge_joysticks maps multiple players to a single controller instead of vice versa ._.
Fixed: import/drop a png: colourfitting secret colours fails when the display palette entries have any of bits 0x70 set
Fixed: katakana mode ltsu lya lyu lyo produces ッャュョ instead of っゃゅょ (also: added xtsu xya xyu xyo alternative) 
Fixed: first note of sfx 63 clobbered when previewing waveform instrument
Fixed: ctrl-c inside sfx data copies nothing when no notes are selected (should copy whole sfx as a [sfx] snippet)
Fixed: (rc3) print() with transparent colour followed by a memcpy to non-video memory area causes +0x10 on each value 
Fixed: (rc3) underline doesn't respect draw palette colour mapping
Fixed: (rc4) p8scii \^x, \^y values are clamped to 8 when drawing background (e.g. ?"\#5\^yafoo" background is too short)
Fixed: (rc4) cstore(..., "foo.p8.rom") is stored as a png named .p8.rom

Fabulous update. love the config.txt option to default to splore. Also this caching is great! Also love the new favorites and likes feature. Still trying to figure out how to manage it so that I can get quick access to my favorites. Probably use favorites for all my carts and Likes for my ultra favorites.

Time to go shave off a few tokens with rrect ;)

Thank you for the Update itself and the better Splore Cache and Fav Functions 🦍🖖🏼💋

Very cool, looking forward to using rrect.

Thank you for the update! Both rrect and text outlines are great additions.

corner radius all day!!

Thanks for an awesome update! Rrect seems like a great addition as well.

What kind of output is expected in splore when searching fav:<username>? I come up with a spinning activity icon but then no results and no error

Will this update download all carts in multi-cart games right on load or do we still need to pull those manually or have games load them?

Really great update

Awesome update!!! I still hope pico 8 will be available on iPadOS

@buckysrevenge try again now -- I fixed a server-side bug that was causing the public favourites settings flag to be ignored. You should get a list of carts that is the same as this one: https://www.lexaloffle.com/bbs/?uid=1&mode=carts&list=user_favourites#m

@aloven yeah, prefetching only applies to the listed carts so multi-cart games still need to be run while online first.

@buckysrevenge For me, it came back with my favorites list pretty quickly when I did fav:2bitchuck in Splore on my RGB30.

rrect! w and h params!!

@zep that did the trick, thanks!