World: add Fullbright visual feature

- New Visuals card with the usual Active + Bind; default off. Unbound+Active
  is always-on, a bind makes it hold-to-brighten.
- Resolve VEngineCvar004 and set mat_fullbright 1/0 through FindVar (slot 12)
  and ConVar::SetValue(int) (slot 11), bypassing the console cheat gate.
  Fall back to ClientCmd if the cvar interface is unavailable.
- Reapply after map loads/respawns and persist [fullbright] active/bind.
- Log on/off; show an error toast if the cvar cannot be applied.

5 files changed, 96 insertions, 3 deletions

diff --git a/CONTEXT.md b/CONTEXT.md
index 922ea98..283784f 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -269,6 +269,20 @@ vocabulary / decisions.
   assist deliberately writes only `m_vecAbsVelocity`; `SetAbsVelocity` syncs
   `m_vecVelocity` after the command.
 
+## World transformations
+
+### Fullbright
+
+- Visuals card with the usual Active + Bind. Unbound and Active means always
+  on; a bind makes it a hold-to-brighten key.
+- Applies the client `mat_fullbright` cvar to 1/0 through `VEngineCvar004`
+  (`FindVar` slot 12, `ConVar::SetValue(int)` slot 11), which bypasses the
+  console cheat gate. No server-side writes.
+- Re-applied after map loads/respawns (`fullbright_invalidate` on local entity
+  change) and saved as `[fullbright] active/bind`.
+- `fullbright: on/off` is logged; a missing cvar interface raises an error
+  toast instead of failing silently.
+
 ## Logging
 
 - `/tmp/hl2hake.log` is opened once at startup with `"w"` (so it only contains
diff --git a/src/gui.cpp b/src/gui.cpp
index b02e88a..3f1651d 100644
--- a/src/gui.cpp
+++ b/src/gui.cpp
@@ -372,6 +372,9 @@ static void build_cards() {
              10000, &g_item_max_dist);
   g_ctrls[g_nctrl - 1].zero_unlimited = true;
 
+  add_card(2, &g_fullbright, "Fullbright",
+           "Ignore world lighting so dark areas are visible.", true);
+
   int spread = add_card(3, &g_spread, "Spread control",
                         "Choose a server shot seed that tightens the cone.",
                         true);
diff --git a/src/hl2h.cpp b/src/hl2h.cpp
index f95f6ed..ebb9b14 100644
--- a/src/hl2h.cpp
+++ b/src/hl2h.cpp
@@ -123,6 +123,42 @@ float getfov(const QAngle &my_view, const QAngle &aim_ang) {
 
 static int g_modified_logged = 0;
 
+// VEngineCvar004 / ICvar vtable: IAppSystem has 5 slots, then
+// AllocateDLLIdentifier, RegisterConCommand, UnregisterConCommand,
+// UnregisterConCommands, GetCommandLineValue, FindCommandBase,
+// FindCommandBase const, FindVar -> slot 12.
+// ConCommandBase has two dtor slots, then IsCommand, IsFlagSet, AddFlags,
+// GetName, GetHelpText, IsRegistered, GetDLLIdentifier; ConVar then adds
+// SetValue(const char*), SetValue(float), SetValue(int) -> slot 11.
+bool cvar_set_int(const char *name, int value) {
+  if (!name)
+    return false;
+  if (g_iface.cvar) {
+    using FindVarFn = void *(*)(void *, const char *);
+    void *var = vfunc<FindVarFn>(g_iface.cvar, 12)(g_iface.cvar, name);
+    if (var) {
+      using GetNameFn = const char *(*)(void *);
+      const char *got = vfunc<GetNameFn>(var, 5)(var);
+      if (got && strcmp(got, name) == 0) {
+        using SetIntFn = void (*)(void *, int);
+        vfunc<SetIntFn>(var, 11)(var, value);
+        return true;
+      }
+    }
+  }
+  // Fallback for an engine that does not expose VEngineCvar004: ClientCmd
+  // slot 7. Cheat-protected cvars may still be rejected.
+  if (g_iface.engine) {
+    char cmd[96];
+    snprintf(cmd, sizeof(cmd), "%s %d", name, value);
+    using CmdFn = void (*)(void *, const char *);
+    vfunc<CmdFn>(g_iface.engine, 7)(g_iface.engine, cmd);
+    logd("cvar: fallback command '%s'", cmd);
+    return true;
+  }
+  return false;
+}
+
 void note_modified(const CUserCmd *cmd, int flags, const float *vel) {
   // recompute usercmd CRC after modification
   fix_verified_crc(cmd->command_number, usercmd_checksum(cmd));
@@ -563,6 +599,7 @@ static void do_move(int seq, float frametime) {
     bones_clear();
     aimbot_reset_lock();
     silentaim_reset_lock();
+    fullbright_invalidate();
   }
 
   if (feature_active(FEAT_SPREAD)) {
@@ -908,10 +945,36 @@ static void *setup_thread(void *) {
   g_iface.engineserver = ef("VEngineServer021", nullptr);
   g_iface.debugoverlay = ef("VDebugOverlay003", nullptr);
   g_iface.enginetrace = ef("EngineTraceClient003", nullptr);
+  static const char *cvar_names[] = {"VEngineCvar004", "VEngineCvar007",
+                                     "VEngineCvar003", "IVEngineCvar004",
+                                     nullptr};
+  for (int i = 0; cvar_names[i] && !g_iface.cvar; i++) {
+    g_iface.cvar = ef(cvar_names[i], nullptr);
+    if (!g_iface.cvar)
+      g_iface.cvar = cf(cvar_names[i], nullptr);
+  }
+  if (!g_iface.cvar) {
+    size_t slash = g_engine.path.find_last_of('/');
+    if (slash != std::string::npos) {
+      std::string path =
+          g_engine.path.substr(0, slash + 1) + "libvstdlib.so";
+      void *h = dlopen(path.c_str(), RTLD_NOLOAD | RTLD_LAZY | RTLD_GLOBAL);
+      if (!h)
+        h = dlopen(path.c_str(), RTLD_LAZY | RTLD_GLOBAL);
+      if (h) {
+        auto vf = (CreateInterfaceFn)dlsym(h, "CreateInterface");
+        if (vf) {
+          for (int i = 0; cvar_names[i] && !g_iface.cvar; i++)
+            g_iface.cvar = vf(cvar_names[i], nullptr);
+        }
+      }
+    }
+  }
   logf("modelinfo: %p (VModelInfoClient006)", g_iface.modelinfo);
   logf("engineserver: %p (VEngineServer021), debugoverlay: %p, "
        "enginetrace: %p (EngineTraceClient003)",
        g_iface.engineserver, g_iface.debugoverlay, g_iface.enginetrace);
+  logf("cvar: %p (VEngineCvar004)", g_iface.cvar);
 
   resolve_netvars();
   if (!g_net.ok())
diff --git a/src/hl2h.h b/src/hl2h.h
index 45a297e..e441167 100644
--- a/src/hl2h.h
+++ b/src/hl2h.h
@@ -67,6 +67,7 @@ struct GameInterfaces {
   void *engineserver = nullptr; // IVEngineServer021 (edict access, incl. server entities)
   void *debugoverlay = nullptr; // IVDebugOverlay003 (engine-accurate world->screen)
   void *enginetrace = nullptr;  // EngineTraceClient003 (world vischeck)
+  void *cvar = nullptr;         // VEngineCvar004 (mat_fullbright etc.)
 };
 extern GameInterfaces g_iface;
 
@@ -176,7 +177,8 @@ enum FeatureId {
   FEAT_MELEE = 7,
   FEAT_SPREAD = 8,
   FEAT_ITEM_ESP = 9,
-  FEAT_COUNT = 10
+  FEAT_FULLBRIGHT = 10,
+  FEAT_COUNT = 11
 };
 enum EspOption {
   ESP_OPT_SHOW_NEUTRAL = 0,
@@ -208,7 +210,7 @@ struct FeatureState {
 };
 
 extern FeatureState g_bhop, g_abh, g_jumpbug, g_melee, g_spread, g_esp,
-    g_aimbot, g_triggerbot, g_silentaim, g_item_esp;
+    g_aimbot, g_triggerbot, g_silentaim, g_item_esp, g_fullbright;
 extern bool g_bhop_autostrafe;
 extern bool g_jumpbug_assist;
 extern bool g_spread_no_spread;
@@ -243,6 +245,9 @@ void fix_verified_crc(int seq, uint32_t crc);
 uint32_t usercmd_checksum(const CUserCmd *c);
 bool find_input_global();
 void resolve_netvars();
+bool cvar_set_int(const char *name, int value);
+void fullbright_update();
+void fullbright_invalidate();
 bool resolve_server_netvars();
 int server_entity_health(int idx, int *maxhealth, int *lifestate, void **base_out);
 bool server_set_velocity_z(int idx, float vz);
diff --git a/src/menu.cpp b/src/menu.cpp
index 2d4c660..0c022e4 100644
--- a/src/menu.cpp
+++ b/src/menu.cpp
@@ -45,6 +45,7 @@ FeatureState g_aimbot{true, 604}; // default Mouse5, rebindable in the GUI
 FeatureState g_triggerbot{true, 603}; // default Mouse4
 FeatureState g_silentaim{true, 602}; // default Mouse3
 FeatureState g_item_esp{true, 0}; // valuable item tags, always-on by default
+FeatureState g_fullbright{false, 0}; // mat_fullbright world lighting
 bool g_item_health = true;
 bool g_item_ammo = true;
 bool g_item_armor = true;
@@ -184,6 +185,8 @@ void config_save() {
           g_triggerbot.bind);
   fprintf(f, "[silentaim]\nactive=%d\nbind=%d\nfov=%d\n", g_silentaim.active,
           g_silentaim.bind, g_silent_fov);
+  fprintf(f, "[fullbright]\nactive=%d\nbind=%d\n", g_fullbright.active,
+          g_fullbright.bind);
   fprintf(f, "[items]\nactive=%d\nbind=%d\nhealth=%d\nammo=%d\n"
              "armor=%d\nweapons=%d\ncrates=%d\ndistance=%d\nmax_dist=%d\n",
           g_item_esp.active, g_item_esp.bind, (int)g_item_health,
@@ -235,6 +238,8 @@ static bool config_load() {
         cur = &g_esp;
       else if (strstr(line, "[items]"))
         cur = &g_item_esp;
+      else if (strstr(line, "[fullbright]"))
+        cur = &g_fullbright;
       else if (strstr(line, "[aimbot]"))
         cur = &g_aimbot;
       else if (strstr(line, "[triggerbot]"))
@@ -372,6 +377,7 @@ void config_reset_defaults() {
   for (int i = 0; i < ESP_OPT_COUNT; i++)
     g_esp_opt[i] = true;
   g_item_esp = {true, 0};
+  g_fullbright = {false, 0};
   g_item_health = true;
   g_item_ammo = true;
   g_item_armor = true;
@@ -488,7 +494,8 @@ static bool key_held(int sc) {
 static FeatureState *feature_state(int feature) {
   static FeatureState *feats[FEAT_COUNT] = {
       &g_bhop,    &g_abh,        &g_esp,        &g_aimbot, &g_triggerbot,
-      &g_silentaim, &g_jumpbug,  &g_melee,      &g_spread, &g_item_esp};
+      &g_silentaim, &g_jumpbug,  &g_melee,      &g_spread, &g_item_esp,
+      &g_fullbright};
   if (feature < 0 || feature >= FEAT_COUNT)
     return nullptr;
   return feats[feature];
@@ -658,6 +665,7 @@ void draw_text_col(int x, int y, const char *text, int r, int g, int b) {
 // PushMakeCurrent/PopMakeCurrent so they are submitted with a clean clip.
 void outer_draw() {
   poll_keyboard();
+  fullbright_update();
   gui_handle_input();
   // HL2H_DRAW_TEST=1 draws a probe rect without needing the GUI open
   static bool draw_test = getenv("HL2H_DRAW_TEST") != nullptr;