A package is code someone else wrote, running with your bot's game session. Before you play a package you didn't write, know what it can reach.
What a package can do
When a bot plays a package, its script can do the following. Everything here also applies to the packages it depends on, since their code runs in the same script.
| It can | What that means for you |
|---|---|
| Send any message to the game server | It acts as your character: move, fight, talk in chat, trade, sell, delete items. Anything the Dofus client can ask the server for, the script can ask for too. |
| Read what the game sends | Your chat, your inventory, the players and monsters around you, and everything else the server sends to the bot. |
| Change or block messages on a MITM bot | In MITM mode, short for man-in-the-middle, the bot sits between your Dofus client and the server. The script can change or drop what your client sends before the server gets it, and what the server sends before your client shows it. It can also send messages to your client as if they came from the server. |
| Read the session's game ticket | That ticket is what a stranger would need to take over the game session. |
| Close the game connection | On a MITM bot, that disconnects the game you're playing. |
| Read game data | Items, monsters, maps and texts of the bot's game version. |
| Write to the bot's console and to Asterobot's own log | Lines you read on the bot's Console tab or on Server > Console. |
| Add settings and actions | Fields and buttons on the bot's Settings tab. |
Caution
Whatever a package does in the game, it does with your Ankama account. Only play packages from authors you trust, and remember that using bots breaks Ankama's terms of use. See Accounts and safety.
What a package can't do
| It can't | Details |
|---|---|
| Use files | A script can't read or write anything on your computer: not your settings, not your stored Ankama accounts, not other packages. The only code it can load is its own package's and that of the packages it depends on. |
| Use the internet | No web requests and no connections of its own. The bot's game connection is the only one it talks through. |
| Reach other bots | Each bot runs its own copy of the script. A script can't see or control another bot. |
| Read your Ankama login | A script gets the game session, not the account. It never receives the login or password stored in Account Manager. |
| Control Asterobot | It can't install packages, change the bot's settings or package settings, or connect and disconnect other bots. |
Installing a package runs none of its code. The package runs when a bot plays it. Its top-level code also runs, without any access to the game, each time Asterobot reads the package's settings: in Add a bot, on a bot's Settings tab, and when a bot starts it.
A script also runs within limits. For example, code that works for more than 250 ms without pausing ends the script. Authors will find the list in Limits and the details of what scripts can reach in What scripts can do.
How Asterobot checks marketplace packages
When Asterobot installs a package from the marketplace, it records a fingerprint of the package's files. Each time the package is loaded after that, when a bot starts it, when you load it, when its settings are read and when a package that depends on it is loaded, Asterobot compares the files with that fingerprint. If anything changed, it refuses the package with package source integrity mismatch.
So a marketplace package on your computer stays exactly as it was downloaded. Changing its files by hand makes it unusable, and Asteroboard doesn't let you edit it either: Edit code and Copy to a new version aren't offered for it.
When the check fails, Play only says Couldn't start the behavior. The bot's Settings tab, under Package settings, shows the full error. To fix it, remove the package and install it again from the marketplace.
The check proves the files are the ones you downloaded. It says nothing about whether the author's code is safe. Packages you create, copy or import from a .zip file have no fingerprint.
Permissions are listed, not enforced
A package can list permissions in its manifest, such as gamedata. They appear on the package's page, under Permissions in the Manifest card, or "No permissions declared." when there are none.
For now they're the author's own description of what the package uses. Asterobot doesn't enforce them: a package that lists no permission can still do everything in the table above.
Note
Coming soon. Asterobot will enforce the permissions a package lists. Until then, don't rely on them to limit what a package does.
Authors can read Permissions.
Official and community
Official packages come from marketplace files that asterobot.net marks as official, and install under a name that starts with @asterobot:. Community packages come from files published by asterobot.net members, under a name made of the author's name and the file's title.
Both badges come from the package's name, and a package imported from a .zip file gets the name you type. Such a package can show Official or Community without ever coming from the marketplace. To be sure where a package comes from, open its page: only a package installed from the marketplace has a Source row, and its View on asterobot.net button opens the file it was downloaded from.
Before you play a package
- Read the file's page on asterobot.net: who published it and what it says the package does.
- On the package's page in Library Manager, look at its Dependencies. Their code runs too.
- Read the code if you can. Edit code opens a local package, and Export gives you the files of any package as a
.zip. - Play it while you watch: keep the bot's Console open, and click Stop as soon as the bot does something you didn't expect.