v1.11.0

security

• cat /proc/1/environ in the playground printed your entire environment — bwrap's reaper keeps the environment bwrap started with, and --clearenv only covers the sandboxed command. Closed with --as-pid-1 and env -i.
• id, hostname, /etc/passwd and /proc/cmdline printed your real username, machine name, every account on the box and your kernel command line. The sandbox has its own synthetic identity now — which also makes those commands answer the same on every machine.

fixes

• a Turkish locale reset the profile on every launch: I sorts outside [A-Z] there, so the loader dropped PROFILE_VER. Level 6's case questions were unanswerable too.
• a profile with no trailing newline, or one round-tripped through CRLF, wiped progress the same way.
• an older build no longer resets a save written by a newer one.
• twelve level-23 git questions answered with a raw regex, which check() cannot match against itself — the practice loop repeated one question forever without bwrap.
• the progress bar drew one cell per question, so it ran 149 columns wide past level 12.
• the boss, gauntlet, scenario and placement headers printed prompts unwrapped, hard-wrapping mid-word in the four modes with no manpage.
• macOS printed flock: command not found on every save.
• binary command output no longer warns on screen mid-frame.

new

• vi visual mode: v, V, o, then d y c x s r ~ p.
• ACLs, file capabilities, sysctl, lsblk, getent, nice, ulimit, join, numfmt.
• audit.sh is 14 phases: a hostile-environment sweep (locales, corrupt saves, a stripped PATH, concurrent writes) and a full playthrough that plays level 1 to ROOT, all 13 scenarios, the playground, challenge, daily, practice and placement.