Simulacrum hard-gates all access to GMs via game.user.isGM checks
scattered throughout the module. We shadow isGM on the game.user instance
with a stack-aware getter: it returns true only when the call originates
from Simulacrum's own scripts, and the real value everywhere else.
This prevents Foundry's own isGM-gated code (e.g. ChatLog._toggleNotifications
managing a GM-only .control-buttons DOM element) from running for non-GM
players just because Simulacrum needed the flag spoofed.
Foundry's server-side permission enforcement is unaffected — this only
bypasses Simulacrum's client-side check, not the actual Foundry permission
system. Players still cannot perform server-validated GM operations.
Simulacrum Player Access
Simulacrum hard-gates all access to GMs via
game.user.isGMchecks scattered throughout the module. We shadowisGMon the game.user instance with a stack-aware getter: it returnstrueonly when the call originates from Simulacrum's own scripts, and the real value everywhere else.This prevents Foundry's own isGM-gated code (e.g. ChatLog._toggleNotifications managing a GM-only .control-buttons DOM element) from running for non-GM players just because Simulacrum needed the flag spoofed.
Foundry's server-side permission enforcement is unaffected — this only bypasses Simulacrum's client-side check, not the actual Foundry permission system. Players still cannot perform server-validated GM operations.