roblox-opencode 1.0.0 → 1.0.1

package/skills/roblox-networking/references/remote-validator.luau

@@ -1,193 +1,193 @@
---[[
-    RemoteValidator — Production-ready server-side validation module
-    Source: roblox-opencode/skills/roblox-networking (authored for this harness)
-    
-    Drop this into ServerScriptService/Modules/. Require it in every remote handler.
-    Covers: type checking, range validation, cooldowns, existence checks, distance,
-    authorization, and cleanup.
-    
-    ADAPT THIS: Add game-specific checks (e.g. team validation, game state checks).
-    The core patterns (validateArgs, checkCooldown, withinRange) are universal.
-]]
-
-local Players = game:GetService("Players")
-
-local RemoteValidator = {}
-
--------------------------------------------------------------------------------
--- Type Checking
--- Validates that arguments match expected types.
--------------------------------------------------------------------------------
-
-type TypeSpec = string | (value: any) -> boolean
-
-function RemoteValidator.checkType(value: any, expected: TypeSpec): boolean
-    if typeof(expected) == "function" then
-        return expected(value)
-    end
-    return typeof(value) == expected
-end
-
-function RemoteValidator.validateArgs(
-    args: { any },
-    schema: { { name: string, type: TypeSpec, optional: boolean? } }
-): (boolean, string?)
-    for i, spec in schema do
-        local value = args[i]
-
-        if value == nil then
-            if not spec.optional then
-                return false, `Missing required argument: {spec.name}`
-            end
-            continue
-        end
-
-        if not RemoteValidator.checkType(value, spec.type) then
-            return false, `Invalid type for {spec.name}: expected {tostring(spec.type)}, got {typeof(value)}`
-        end
-    end
-
-    -- Reject extra arguments not declared in schema
-    if #args > #schema then
-        return false, `Too many arguments: expected {#schema}, got {#args}`
-    end
-
-    return true, nil
-end
-
--------------------------------------------------------------------------------
--- Range Checking
--- Validates that numeric values fall within acceptable bounds.
--------------------------------------------------------------------------------
-
-function RemoteValidator.checkRange(value: number, min: number, max: number): boolean
-    return typeof(value) == "number"
-        and value == value -- NaN check
-        and value >= min
-        and value <= max
-end
-
-function RemoteValidator.checkIntegerRange(value: number, min: number, max: number): boolean
-    return RemoteValidator.checkRange(value, min, max)
-        and math.floor(value) == value
-end
-
--------------------------------------------------------------------------------
--- Cooldown Tracking
--- Per-player, per-action cooldown enforcement.
--------------------------------------------------------------------------------
-
-local cooldowns: { [Player]: { [string]: number } } = {}
-
-function RemoteValidator.checkCooldown(player: Player, action: string, cooldownSeconds: number): boolean
-    local now = os.clock()
-    local playerCooldowns = cooldowns[player]
-
-    if not playerCooldowns then
-        playerCooldowns = {}
-        cooldowns[player] = playerCooldowns
-    end
-
-    local lastUsed = playerCooldowns[action]
-    if lastUsed and (now - lastUsed) < cooldownSeconds then
-        return false
-    end
-
-    playerCooldowns[action] = now
-    return true
-end
-
-function RemoteValidator.clearPlayerCooldowns(player: Player)
-    cooldowns[player] = nil
-end
-
--------------------------------------------------------------------------------
--- Existence Checks
--- Validates that targets, objects, and instances actually exist.
--------------------------------------------------------------------------------
-
-function RemoteValidator.playerExists(playerName: string): Player?
-    return Players:FindFirstChild(playerName) :: Player?
-end
-
-function RemoteValidator.characterAlive(player: Player): boolean
-    local character = player.Character
-    if not character then
-        return false
-    end
-
-    local humanoid = character:FindFirstChildOfClass("Humanoid")
-    if not humanoid then
-        return false
-    end
-
-    return humanoid.Health > 0
-end
-
-function RemoteValidator.instanceExists(parent: Instance, name: string, className: string?): Instance?
-    local child = parent:FindFirstChild(name)
-    if not child then
-        return nil
-    end
-
-    if className and not child:IsA(className) then
-        return nil
-    end
-
-    return child
-end
-
--------------------------------------------------------------------------------
--- Authorization
--- Checks if a player is allowed to perform an action.
--------------------------------------------------------------------------------
-
-function RemoteValidator.playerOwnsItem(player: Player, itemId: string, inventoryFolder: Folder?): boolean
-    local folder = inventoryFolder or player:FindFirstChild("Inventory") :: Folder?
-    if not folder then
-        return false
-    end
-
-    return folder:FindFirstChild(itemId) ~= nil
-end
-
-function RemoteValidator.playerHasAttribute(player: Player, attribute: string, expectedValue: any?): boolean
-    local value = player:GetAttribute(attribute)
-    if expectedValue ~= nil then
-        return value == expectedValue
-    end
-    return value ~= nil
-end
-
--------------------------------------------------------------------------------
--- Distance Check
--- Validates that two positions are within an acceptable range.
--------------------------------------------------------------------------------
-
-function RemoteValidator.withinRange(posA: Vector3, posB: Vector3, maxDistance: number): boolean
-    return (posA - posB).Magnitude <= maxDistance
-end
-
-function RemoteValidator.playerWithinRange(player: Player, targetPos: Vector3, maxDistance: number): boolean
-    local character = player.Character
-    if not character then
-        return false
-    end
-
-    local root = character:FindFirstChild("HumanoidRootPart")
-    if not root then
-        return false
-    end
-
-    return RemoteValidator.withinRange(root.Position, targetPos, maxDistance)
-end
-
--------------------------------------------------------------------------------
--- Cleanup — prevent memory leaks from departed players
--------------------------------------------------------------------------------
-
-Players.PlayerRemoving:Connect(function(player)
-    RemoteValidator.clearPlayerCooldowns(player)
-end)
-
-return RemoteValidator
+--[[
+    RemoteValidator — Production-ready server-side validation module
+    Source: roblox-opencode/skills/roblox-networking (authored for this harness)
+    
+    Drop this into ServerScriptService/Modules/. Require it in every remote handler.
+    Covers: type checking, range validation, cooldowns, existence checks, distance,
+    authorization, and cleanup.
+    
+    ADAPT THIS: Add game-specific checks (e.g. team validation, game state checks).
+    The core patterns (validateArgs, checkCooldown, withinRange) are universal.
+]]
+
+local Players = game:GetService("Players")
+
+local RemoteValidator = {}
+
+-------------------------------------------------------------------------------
+-- Type Checking
+-- Validates that arguments match expected types.
+-------------------------------------------------------------------------------
+
+type TypeSpec = string | (value: any) -> boolean
+
+function RemoteValidator.checkType(value: any, expected: TypeSpec): boolean
+    if typeof(expected) == "function" then
+        return expected(value)
+    end
+    return typeof(value) == expected
+end
+
+function RemoteValidator.validateArgs(
+    args: { any },
+    schema: { { name: string, type: TypeSpec, optional: boolean? } }
+): (boolean, string?)
+    for i, spec in schema do
+        local value = args[i]
+
+        if value == nil then
+            if not spec.optional then
+                return false, `Missing required argument: {spec.name}`
+            end
+            continue
+        end
+
+        if not RemoteValidator.checkType(value, spec.type) then
+            return false, `Invalid type for {spec.name}: expected {tostring(spec.type)}, got {typeof(value)}`
+        end
+    end
+
+    -- Reject extra arguments not declared in schema
+    if #args > #schema then
+        return false, `Too many arguments: expected {#schema}, got {#args}`
+    end
+
+    return true, nil
+end
+
+-------------------------------------------------------------------------------
+-- Range Checking
+-- Validates that numeric values fall within acceptable bounds.
+-------------------------------------------------------------------------------
+
+function RemoteValidator.checkRange(value: number, min: number, max: number): boolean
+    return typeof(value) == "number"
+        and value == value -- NaN check
+        and value >= min
+        and value <= max
+end
+
+function RemoteValidator.checkIntegerRange(value: number, min: number, max: number): boolean
+    return RemoteValidator.checkRange(value, min, max)
+        and math.floor(value) == value
+end
+
+-------------------------------------------------------------------------------
+-- Cooldown Tracking
+-- Per-player, per-action cooldown enforcement.
+-------------------------------------------------------------------------------
+
+local cooldowns: { [Player]: { [string]: number } } = {}
+
+function RemoteValidator.checkCooldown(player: Player, action: string, cooldownSeconds: number): boolean
+    local now = os.clock()
+    local playerCooldowns = cooldowns[player]
+
+    if not playerCooldowns then
+        playerCooldowns = {}
+        cooldowns[player] = playerCooldowns
+    end
+
+    local lastUsed = playerCooldowns[action]
+    if lastUsed and (now - lastUsed) < cooldownSeconds then
+        return false
+    end
+
+    playerCooldowns[action] = now
+    return true
+end
+
+function RemoteValidator.clearPlayerCooldowns(player: Player)
+    cooldowns[player] = nil
+end
+
+-------------------------------------------------------------------------------
+-- Existence Checks
+-- Validates that targets, objects, and instances actually exist.
+-------------------------------------------------------------------------------
+
+function RemoteValidator.playerExists(playerName: string): Player?
+    return Players:FindFirstChild(playerName) :: Player?
+end
+
+function RemoteValidator.characterAlive(player: Player): boolean
+    local character = player.Character
+    if not character then
+        return false
+    end
+
+    local humanoid = character:FindFirstChildOfClass("Humanoid")
+    if not humanoid then
+        return false
+    end
+
+    return humanoid.Health > 0
+end
+
+function RemoteValidator.instanceExists(parent: Instance, name: string, className: string?): Instance?
+    local child = parent:FindFirstChild(name)
+    if not child then
+        return nil
+    end
+
+    if className and not child:IsA(className) then
+        return nil
+    end
+
+    return child
+end
+
+-------------------------------------------------------------------------------
+-- Authorization
+-- Checks if a player is allowed to perform an action.
+-------------------------------------------------------------------------------
+
+function RemoteValidator.playerOwnsItem(player: Player, itemId: string, inventoryFolder: Folder?): boolean
+    local folder = inventoryFolder or player:FindFirstChild("Inventory") :: Folder?
+    if not folder then
+        return false
+    end
+
+    return folder:FindFirstChild(itemId) ~= nil
+end
+
+function RemoteValidator.playerHasAttribute(player: Player, attribute: string, expectedValue: any?): boolean
+    local value = player:GetAttribute(attribute)
+    if expectedValue ~= nil then
+        return value == expectedValue
+    end
+    return value ~= nil
+end
+
+-------------------------------------------------------------------------------
+-- Distance Check
+-- Validates that two positions are within an acceptable range.
+-------------------------------------------------------------------------------
+
+function RemoteValidator.withinRange(posA: Vector3, posB: Vector3, maxDistance: number): boolean
+    return (posA - posB).Magnitude <= maxDistance
+end
+
+function RemoteValidator.playerWithinRange(player: Player, targetPos: Vector3, maxDistance: number): boolean
+    local character = player.Character
+    if not character then
+        return false
+    end
+
+    local root = character:FindFirstChild("HumanoidRootPart")
+    if not root then
+        return false
+    end
+
+    return RemoteValidator.withinRange(root.Position, targetPos, maxDistance)
+end
+
+-------------------------------------------------------------------------------
+-- Cleanup — prevent memory leaks from departed players
+-------------------------------------------------------------------------------
+
+Players.PlayerRemoving:Connect(function(player)
+    RemoteValidator.clearPlayerCooldowns(player)
+end)
+
+return RemoteValidator

package/skills/roblox-publish-checklist/SKILL.md

@@ -1,128 +1,128 @@
----
-name: roblox-publish-checklist
-description: "Pre-publish verification gauntlet for Roblox games"
-tags: [roblox, publish, checklist, verification]
----
-
-# /publish-checklist - Pre-Publish Verification
-
-You are verifying a Roblox game is ready to publish. Work through every category below. For each item, check it and note PASS/FAIL/SKIP with a brief explanation.
-
----
-
-## 1. Data & Persistence
-
-- [ ] **DataStore save/load tested** - Player data saves on leave and loads on rejoin correctly
-- [ ] **Session locking verified** - Using ProfileStore or equivalent; no concurrent data corruption
-- [ ] **BindToClose implemented** - Server saves data before shutdown (game close, server hop)
-- [ ] **Data migration plan** - If updating an existing game, schema migration handles old data formats
-- [ ] **Edge case: disconnect during save** - Data not lost if player disconnects mid-save
-- [ ] **Edge case: multiple DataStore calls** - No race conditions from parallel saves
-
----
-
-## 2. Security
-
-- [ ] **All remotes validated server-side** - Every RemoteEvent/RemoteFunction checks argument types, ranges, and ownership
-- [ ] **No sensitive data exposed** - ReplicatedStorage, StarterPlayer have no server-only logic or secrets
-- [ ] **Rate limiting on all remotes** - Per-player throttling prevents flooding/exploitation
-- [ ] **No client-trusted game logic** - Currency, inventory, damage, positions calculated server-side only
-- [ ] **ProcessReceipt handled correctly** - Grant item THEN return PurchaseGranted; NotProcessedYet on failure
-- [ ] **Anti-cheat basics** - Speed checks, teleport detection, inventory validation
-
----
-
-## 3. Performance
-
-- [ ] **Mobile tested** - Game runs on mobile devices without crashes or severe lag
-- [ ] **Part count within limits** - Workspace part count reasonable for target devices
-- [ ] **No memory leaks** - Events disconnected on cleanup, no orphaned instances accumulating
-- [ ] **MicroProfiler reviewed** - No scripts consistently over budget (>1ms per frame)
-- [ ] **StreamingEnabled considered** - If large map, StreamingEnabled is enabled and tested
-- [ ] **Signal cleanup** - No undisconnected BindableEvent/RemoteEvent connections leaking
-
----
-
-## 4. Monetization
-
-- [ ] **GamePasses work correctly** - Purchasing grants the correct benefit, idempotent on rejoin
-- [ ] **DevProducts grant properly** - Consumables delivered, ProcessReceipt handles edge cases
-- [ ] **Premium benefits functional** - Premium payout optimized, exclusive perks work
-- [ ] **Prices reviewed** - Competitive with similar games, clear value proposition
-- [ ] **No pay-to-win concerns** - Free players have reasonable experience
-- [ ] **Premium Payouts enabled** - Game is eligible and configured for Premium Payouts
-
----
-
-## 5. Mobile Compatibility
-
-- [ ] **Touch controls work** - All interactions accessible via tap
-- [ ] **UI scales properly** - Using Scale not Offset for UI elements; tested on small screens
-- [ ] **ContextActionService for input** - Game actions bound properly for mobile
-- [ ] **Small screen tested** - UI doesn't overlap, buttons are tappable, text is readable
-- [ ] **Landscape and portrait** - Orientation handled if applicable
-- [ ] **Performance on low-end devices** - Tested on minimum spec mobile device
-
----
-
-## 6. Gameplay
-
-- [ ] **Core loop tested end-to-end** - Play for 10+ minutes, full loop works
-- [ ] **Edge cases handled:**
-  - [ ] Disconnect during trade/transaction
-  - [ ] Death during cutscene
-  - [ ] Player leaves during multiplayer event
-  - [ ] Rapid button pressing
-  - [ ] Backfill/rejoin during active game
-- [ ] **Tutorial/FTUE works** - New player can learn the game without confusion
-- [ ] **Difficulty curve** - Early game engaging, progression feels rewarding
-- [ ] **Fun check** - Core loop is actually enjoyable to play repeatedly
-
----
-
-## 7. Metadata
-
-- [ ] **Game icon set** - 512x512, clear and representative
-- [ ] **Thumbnails uploaded** - At least 3 images showing gameplay
-- [ ] **Description written** - Clear, compelling, includes key features
-- [ ] **Genre selected** - Correct category for discovery
-- [ ] **Max players configured** - Appropriate for game type
-- [ ] **Game badges** - Achievement badges set up for milestones
-- [ ] **Game rating** - Age-appropriate settings configured
-
----
-
-## 8. Social
-
-- [ ] **Private servers configured** - Available and priced if applicable
-- [ ] **Social features tested** - Party system, chat, friending all work
-- [ ] **Report/block doesn't break game** - Reporting a player doesn't crash or corrupt game state
-- [ ] **Server browser** - Game appears in search with correct tags
-- [ ] **Team play** - If multiplayer, team assignment and switching work
-
----
-
-## 9. Analytics
-
-- [ ] **Key events instrumented:**
-  - [ ] Player joins / leaves
-  - [ ] Purchases (GamePass and DevProduct)
-  - [ ] Level/zone completions
-  - [ ] Session length tracking
-  - [ ] Error/crash reporting
-- [ ] **Basic funnel tracking** - New player → tutorial complete → first purchase → retention
-- [ ] **Dashboard configured** - Analytics visible in Roblox Creator Dashboard
-
----
-
-## Summary
-
-After checking all items, output:
-
-1. **Overall status:** READY / NOT READY
-2. **Critical blockers** (must fix before publish)
-3. **Warnings** (should fix, not blocking)
-4. **Passed items** - Count and percentage
-5. **Failed items** - List each with the fix needed
-
+---
+name: roblox-publish-checklist
+description: "Pre-publish verification gauntlet for Roblox games"
+tags: [roblox, publish, checklist, verification]
+---
+
+# /publish-checklist - Pre-Publish Verification
+
+You are verifying a Roblox game is ready to publish. Work through every category below. For each item, check it and note PASS/FAIL/SKIP with a brief explanation.
+
+---
+
+## 1. Data & Persistence
+
+- [ ] **DataStore save/load tested** - Player data saves on leave and loads on rejoin correctly
+- [ ] **Session locking verified** - Using ProfileStore or equivalent; no concurrent data corruption
+- [ ] **BindToClose implemented** - Server saves data before shutdown (game close, server hop)
+- [ ] **Data migration plan** - If updating an existing game, schema migration handles old data formats
+- [ ] **Edge case: disconnect during save** - Data not lost if player disconnects mid-save
+- [ ] **Edge case: multiple DataStore calls** - No race conditions from parallel saves
+
+---
+
+## 2. Security
+
+- [ ] **All remotes validated server-side** - Every RemoteEvent/RemoteFunction checks argument types, ranges, and ownership
+- [ ] **No sensitive data exposed** - ReplicatedStorage, StarterPlayer have no server-only logic or secrets
+- [ ] **Rate limiting on all remotes** - Per-player throttling prevents flooding/exploitation
+- [ ] **No client-trusted game logic** - Currency, inventory, damage, positions calculated server-side only
+- [ ] **ProcessReceipt handled correctly** - Grant item THEN return PurchaseGranted; NotProcessedYet on failure
+- [ ] **Anti-cheat basics** - Speed checks, teleport detection, inventory validation
+
+---
+
+## 3. Performance
+
+- [ ] **Mobile tested** - Game runs on mobile devices without crashes or severe lag
+- [ ] **Part count within limits** - Workspace part count reasonable for target devices
+- [ ] **No memory leaks** - Events disconnected on cleanup, no orphaned instances accumulating
+- [ ] **MicroProfiler reviewed** - No scripts consistently over budget (>1ms per frame)
+- [ ] **StreamingEnabled considered** - If large map, StreamingEnabled is enabled and tested
+- [ ] **Signal cleanup** - No undisconnected BindableEvent/RemoteEvent connections leaking
+
+---
+
+## 4. Monetization
+
+- [ ] **GamePasses work correctly** - Purchasing grants the correct benefit, idempotent on rejoin
+- [ ] **DevProducts grant properly** - Consumables delivered, ProcessReceipt handles edge cases
+- [ ] **Premium benefits functional** - Premium payout optimized, exclusive perks work
+- [ ] **Prices reviewed** - Competitive with similar games, clear value proposition
+- [ ] **No pay-to-win concerns** - Free players have reasonable experience
+- [ ] **Premium Payouts enabled** - Game is eligible and configured for Premium Payouts
+
+---
+
+## 5. Mobile Compatibility
+
+- [ ] **Touch controls work** - All interactions accessible via tap
+- [ ] **UI scales properly** - Using Scale not Offset for UI elements; tested on small screens
+- [ ] **ContextActionService for input** - Game actions bound properly for mobile
+- [ ] **Small screen tested** - UI doesn't overlap, buttons are tappable, text is readable
+- [ ] **Landscape and portrait** - Orientation handled if applicable
+- [ ] **Performance on low-end devices** - Tested on minimum spec mobile device
+
+---
+
+## 6. Gameplay
+
+- [ ] **Core loop tested end-to-end** - Play for 10+ minutes, full loop works
+- [ ] **Edge cases handled:**
+  - [ ] Disconnect during trade/transaction
+  - [ ] Death during cutscene
+  - [ ] Player leaves during multiplayer event
+  - [ ] Rapid button pressing
+  - [ ] Backfill/rejoin during active game
+- [ ] **Tutorial/FTUE works** - New player can learn the game without confusion
+- [ ] **Difficulty curve** - Early game engaging, progression feels rewarding
+- [ ] **Fun check** - Core loop is actually enjoyable to play repeatedly
+
+---
+
+## 7. Metadata
+
+- [ ] **Game icon set** - 512x512, clear and representative
+- [ ] **Thumbnails uploaded** - At least 3 images showing gameplay
+- [ ] **Description written** - Clear, compelling, includes key features
+- [ ] **Genre selected** - Correct category for discovery
+- [ ] **Max players configured** - Appropriate for game type
+- [ ] **Game badges** - Achievement badges set up for milestones
+- [ ] **Game rating** - Age-appropriate settings configured
+
+---
+
+## 8. Social
+
+- [ ] **Private servers configured** - Available and priced if applicable
+- [ ] **Social features tested** - Party system, chat, friending all work
+- [ ] **Report/block doesn't break game** - Reporting a player doesn't crash or corrupt game state
+- [ ] **Server browser** - Game appears in search with correct tags
+- [ ] **Team play** - If multiplayer, team assignment and switching work
+
+---
+
+## 9. Analytics
+
+- [ ] **Key events instrumented:**
+  - [ ] Player joins / leaves
+  - [ ] Purchases (GamePass and DevProduct)
+  - [ ] Level/zone completions
+  - [ ] Session length tracking
+  - [ ] Error/crash reporting
+- [ ] **Basic funnel tracking** - New player → tutorial complete → first purchase → retention
+- [ ] **Dashboard configured** - Analytics visible in Roblox Creator Dashboard
+
+---
+
+## Summary
+
+After checking all items, output:
+
+1. **Overall status:** READY / NOT READY
+2. **Critical blockers** (must fix before publish)
+3. **Warnings** (should fix, not blocking)
+4. **Passed items** - Count and percentage
+5. **Failed items** - List each with the fix needed
+
 If NOT READY, provide specific fixes for every failed item before the user publishes.