god-code 0.6.1__tar.gz → 1.0.0__tar.gz

god_code-1.0.0/.codetape/component-map.json

@@ -0,0 +1,208 @@
+{
+  "last_scan": "2026-04-05",
+  "components": {
+    "cli": {
+      "path": "godot_agent/cli/",
+      "type": "entrypoint",
+      "description": "CLI package (Click) — commands, menus, engine wiring, helpers. Split from monolithic cli.py in v0.8.",
+      "last_modified": "2026-04-05",
+      "trace_refs": [
+        "2026-04-04_00-55_runtime-harness-skills-computer-use.md",
+        "2026-04-05_22-50_v08-implementation.md"
+      ],
+      "children": [
+        "godot_agent/cli/__init__.py",
+        "godot_agent/cli/__main__.py",
+        "godot_agent/cli/commands.py",
+        "godot_agent/cli/menus.py",
+        "godot_agent/cli/engine_wiring.py",
+        "godot_agent/cli/helpers.py"
+      ]
+    },
+    "mcp_server": {
+      "path": "godot_agent/mcp_server.py",
+      "type": "entrypoint",
+      "description": "MCP server for Claude Code integration (40+ tools)",
+      "last_modified": "2026-04-04",
+      "trace_refs": ["2026-04-04_00-55_runtime-harness-skills-computer-use.md"]
+    },
+    "tools": {
+      "path": "godot_agent/tools/",
+      "type": "module",
+      "description": "Tool implementations (41 tools: file_ops, search, shell, git, godot_cli, scene_tools, script_tools, vision_analysis, vision_scoring, sprite_qa, etc.)",
+      "last_modified": "2026-04-05",
+      "trace_refs": [
+        "2026-04-04_00-55_runtime-harness-skills-computer-use.md",
+        "2026-04-05_22-50_v08-implementation.md"
+      ],
+      "children": [
+        "godot_agent/tools/base.py",
+        "godot_agent/tools/registry.py",
+        "godot_agent/tools/file_ops.py",
+        "godot_agent/tools/search.py",
+        "godot_agent/tools/shell.py",
+        "godot_agent/tools/git.py",
+        "godot_agent/tools/list_dir.py",
+        "godot_agent/tools/godot_cli.py",
+        "godot_agent/tools/scene_tools.py",
+        "godot_agent/tools/script_tools.py",
+        "godot_agent/tools/analysis_tools.py",
+        "godot_agent/tools/editor_bridge.py",
+        "godot_agent/tools/memory_tool.py",
+        "godot_agent/tools/image_gen.py",
+        "godot_agent/tools/screenshot.py",
+        "godot_agent/tools/sprite_pipeline.py",
+        "godot_agent/tools/sprite_qa.py",
+        "godot_agent/tools/runtime_harness.py",
+        "godot_agent/tools/web_search.py",
+        "godot_agent/tools/vision_analysis.py",
+        "godot_agent/tools/vision_scoring.py"
+      ]
+    },
+    "llm": {
+      "path": "godot_agent/llm/",
+      "type": "module",
+      "description": "LLM client layer with provider adapters (Anthropic, OpenAI) + dual-path backend support + vision encoding",
+      "last_modified": "2026-04-05",
+      "trace_refs": [
+        "2026-04-04_00-55_runtime-harness-skills-computer-use.md",
+        "2026-04-05_22-50_v08-implementation.md"
+      ],
+      "children": [
+        "godot_agent/llm/client.py",
+        "godot_agent/llm/types.py",
+        "godot_agent/llm/streaming.py",
+        "godot_agent/llm/vision.py",
+        "godot_agent/llm/adapters/base.py",
+        "godot_agent/llm/adapters/anthropic.py",
+        "godot_agent/llm/adapters/openai.py"
+      ]
+    },
+    "godot": {
+      "path": "godot_agent/godot/",
+      "type": "module",
+      "description": "Godot engine integration (parsers, validators, linter, collision planner)",
+      "children": [
+        "godot_agent/godot/project.py",
+        "godot_agent/godot/scene_parser.py",
+        "godot_agent/godot/scene_writer.py",
+        "godot_agent/godot/resource_validator.py",
+        "godot_agent/godot/tscn_validator.py",
+        "godot_agent/godot/gdscript_linter.py",
+        "godot_agent/godot/collision_planner.py",
+        "godot_agent/godot/consistency_checker.py",
+        "godot_agent/godot/dependency_graph.py",
+        "godot_agent/godot/pattern_advisor.py",
+        "godot_agent/godot/impact_analysis.py"
+      ]
+    },
+    "runtime": {
+      "path": "godot_agent/runtime/",
+      "type": "module",
+      "description": "Agent runtime engine (session, config, modes, quality gates, reviewers, validation suite, visual regression, live bridge, playtest harness)",
+      "last_modified": "2026-04-05",
+      "trace_refs": [
+        "2026-04-04_00-55_runtime-harness-skills-computer-use.md",
+        "2026-04-05_22-50_v08-implementation.md"
+      ],
+      "children": [
+        "godot_agent/runtime/engine.py",
+        "godot_agent/runtime/session.py",
+        "godot_agent/runtime/config.py",
+        "godot_agent/runtime/modes.py",
+        "godot_agent/runtime/providers.py",
+        "godot_agent/runtime/events.py",
+        "godot_agent/runtime/context_manager.py",
+        "godot_agent/runtime/runtime_bridge.py",
+        "godot_agent/runtime/error_loop.py",
+        "godot_agent/runtime/quality_gate.py",
+        "godot_agent/runtime/design_memory.py",
+        "godot_agent/runtime/reviewer.py",
+        "godot_agent/runtime/gameplay_reviewer.py",
+        "godot_agent/runtime/playtest_harness.py",
+        "godot_agent/runtime/visual_regression.py",
+        "godot_agent/runtime/validation_checks.py",
+        "godot_agent/runtime/live_client.py",
+        "godot_agent/runtime/intent_resolver.py",
+        "godot_agent/runtime/auth.py",
+        "godot_agent/runtime/oauth.py"
+      ]
+    },
+    "prompts": {
+      "path": "godot_agent/prompts/",
+      "type": "module",
+      "description": "Prompt assembly, skill library, skill selector, vision templates",
+      "last_modified": "2026-04-05",
+      "trace_refs": [
+        "2026-04-04_00-55_runtime-harness-skills-computer-use.md",
+        "2026-04-05_22-50_v08-implementation.md"
+      ],
+      "children": [
+        "godot_agent/prompts/system.py",
+        "godot_agent/prompts/assembler.py",
+        "godot_agent/prompts/knowledge_selector.py",
+        "godot_agent/prompts/skill_selector.py",
+        "godot_agent/prompts/skill_library.py",
+        "godot_agent/prompts/godot_playbook.py",
+        "godot_agent/prompts/build_discipline.py",
+        "godot_agent/prompts/image_templates.py",
+        "godot_agent/prompts/vision_templates.py"
+      ]
+    },
+    "addons": {
+      "path": "godot_agent/addons/",
+      "type": "module",
+      "description": "Godot EditorPlugin addons (GodCodeBridge TCP JSON-RPC server)",
+      "last_modified": "2026-04-05",
+      "trace_refs": ["2026-04-05_22-50_v08-implementation.md"],
+      "children": [
+        "godot_agent/addons/god_code_bridge/god_code_bridge.gd",
+        "godot_agent/addons/god_code_bridge/plugin.cfg"
+      ]
+    },
+    "security": {
+      "path": "godot_agent/security/",
+      "type": "module",
+      "description": "Security layer (path protection, tool pipeline, policies, classifier)",
+      "children": [
+        "godot_agent/security/protected_paths.py",
+        "godot_agent/security/hooks.py",
+        "godot_agent/security/policies.py",
+        "godot_agent/security/tool_pipeline.py",
+        "godot_agent/security/classifier.py"
+      ]
+    },
+    "tui": {
+      "path": "godot_agent/tui/",
+      "type": "module",
+      "description": "Terminal UI (Rich display, input handling, skills panel)",
+      "last_modified": "2026-04-04",
+      "trace_refs": ["2026-04-04_00-55_runtime-harness-skills-computer-use.md"]
+    },
+    "agents": {
+      "path": "godot_agent/agents/",
+      "type": "module",
+      "description": "Multi-agent dispatcher and configs"
+    },
+    "testing": {
+      "path": "godot_agent/testing/",
+      "type": "module",
+      "description": "Scenario runner for automated testing",
+      "last_modified": "2026-04-04",
+      "trace_refs": ["2026-04-04_00-55_runtime-harness-skills-computer-use.md"]
+    }
+  },
+  "relationships": {
+    "cli -> prompts": "skill_selector imports for /skills command",
+    "cli -> tools": "engine_wiring registers all tools including vision tools",
+    "cli -> runtime": "engine_wiring builds engine, passes ValidationSuite config",
+    "runtime -> llm": "engine uses LLMClient dual-path (direct + backend)",
+    "runtime -> tools": "engine calls vision tools in RUN_VISUAL_ITERATION phase",
+    "runtime -> validation_checks": "quality_gate and reviewer share ValidationSuite cache",
+    "runtime -> live_client": "engine calls _try_live_bridge in PREPARE_CONTEXT",
+    "llm -> runtime": "adapters use providers.supports_computer_use()",
+    "prompts -> tools": "skill_selector narrows tool scope per active skill",
+    "addons -> runtime": "GodCodeBridge.gd serves data to LiveRuntimeClient via TCP",
+    "tools/vision -> prompts": "vision_analysis and vision_scoring use vision_templates"
+  }
+}

god_code-1.0.0/.codetape/config.json

@@ -0,0 +1,18 @@
+{
+  "project": "god-code",
+  "version": "0.8.1",
+  "language": "python",
+  "framework": "click+mcp+pydantic",
+  "component_roots": ["godot_agent"],
+  "test_roots": ["tests"],
+  "ignore_patterns": [
+    "__pycache__",
+    "*.pyc",
+    ".venv",
+    "dist",
+    "*.egg-info",
+    ".pytest_cache"
+  ],
+  "trace_format": "markdown",
+  "archive_after_days": 30
+}

god_code-1.0.0/.github/FUNDING.yml

@@ -0,0 +1,3 @@
+github: 888wing
+custom:
+  - https://buymeacoffee.com/nano122090n

god_code-1.0.0/.github/workflows/docs.yml

@@ -0,0 +1,41 @@
+name: Deploy Docs
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: pip install -e ".[docs]"
+      - run: mkdocs build --strict
+      - uses: actions/configure-pages@v5
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

{god_code-0.6.1 → god_code-1.0.0}/.gitignore

@@ -10,3 +10,8 @@ auth.json
 *.pem
 .idea/
 .vscode/
+.codetape/traces/
+.codetape/drift.json
+site/
+.audit/
+.worktrees/

god_code-1.0.0/.gitleaks.toml

@@ -0,0 +1,30 @@
+# Gitleaks config for god-code
+#
+# Purpose: local pre-commit regression prevention against accidental
+# secret commits. Extends gitleaks default ruleset, plus allowlists
+# for known false positives (docs with example tokens, tests of the
+# secret-masking utility).
+#
+# See https://github.com/gitleaks/gitleaks for config reference.
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "god-code global allowlist"
+
+paths = [
+  # Audit artifacts (local only, gitignored)
+  '''\.audit/''',
+
+  # Design docs may contain example API keys in code blocks
+  # (e.g. "backend_api_key=gc_live_testkey123" as documentation).
+  # Reviewers must still visually scan any new docs/plans/ additions.
+  '''docs/plans/.*\.md''',
+
+  # Tests for the secret-masking utility. These files exist to verify
+  # that secret-shaped strings are properly masked for display, so
+  # they intentionally contain fake-but-realistic token literals.
+  # If you add NEW files that test masking, extend this list.
+  '''tests/test_runtime_switch_commands\.py''',
+]

god_code-1.0.0/CHANGELOG.md

@@ -0,0 +1,131 @@
+# Changelog
+
+All notable changes to God Code will be documented in this file.
+
+## [1.0.0] — 2026-04-07
+
+**Promoted from 1.0.0rc1 with no code changes** after Starfall workflow dogfood verification. See the `[1.0.0rc1]` section below for the full list of fixes and design rationale.
+
+This is the first stable v1.x release of god-code.
+
+## [1.0.0rc1] — 2026-04-07
+
+**v1.0 is the first release where god-code is comfortable to use day-to-day without needing to know its quirks.** This is a coordinated UX overhaul. No new features, no breaking API changes — every change makes the existing tool feel less broken in everyday use.
+
+This release closes 27 of 28 UX issues identified in the v1.0 audit (see `docs/plans/2026-04-07-v1.0.0-ux-upgrade-design.md`). The 28th was already fixed in v0.9.2.
+
+### Headline fixes
+
+- **Streaming "thinking" indicator** — gpt-5.4 with `reasoning_effort=high` has a 30-60s silent reasoning phase before any token streams. Previously you saw an empty cyan panel and assumed god-code was frozen. Now you see a `thinking…` spinner that animates until the first token arrives. (A1)
+- **`max_tokens` default raised from 16384 → 65536** — long technical reports were silently truncated mid-section because the cap was way below gpt-5.4's 128K output capability. Override with `/set max_tokens 16384` if you prefer the old conservative limit. (B1)
+- **Token count works in backend mode** — `_stream_via_backend` was missing `stream_options.include_usage`, so backend-mode users (anyone with `backend_url` + `gc_live_*`) saw `0 tokens / $0.00` after every turn. Now matches direct-mode behaviour. (B5)
+- **Real Ctrl+C cleanup** — cancelled turns no longer leave their partial messages polluting the next turn's context. New `engine.rollback_current_turn()` drops everything appended since the most recent `submit()` began. (C2)
+- **Tool progress spinner** — long-running tools (validation, sprite generation, screenshot — typically 10-60s) now show an auto-animating spinner via `rich.console.status` instead of going silent between `tool: started` and `tool: ok`. (A2)
+- **Planner agent stops claiming "I'm in PLAN mode"** — the planner sub-agent system prompt was triggering an LLM hallucination where the model would announce "我目前是 PLAN 模式" / "I am in plan mode" in its response, confusing users into thinking the CLI was stuck in plan interaction mode. Prompt rewritten to explicitly disavow that wording and clarify the planner is a sub-agent inside god-code. (F1)
+
+### Fixed (full list — 27 issues across 11 commits)
+
+- **A1** Streaming thinking spinner (`tui/display.py`)
+- **A2** Tool execution status spinner
+- **A3** Blank line between successive streamed turns
+- **A4** Planner sub-agent output bracketed with `Rule` separators
+- **A5** Autosave success/failure events + activity log entries
+- **B1** `max_tokens` default 16384 → 65536
+- **B2 / G2** `tool_result_truncated` event when tool output is silently capped
+- **B3** API error detail bumped 200 → 500 chars with `[…truncated]` marker
+- **B4** Tool args truncated at 100 chars to prevent terminal overflow
+- **B5** Backend streaming now sends `stream_options.include_usage`
+- **C1** Diff read failures emit `diff_failed` event instead of `except: pass`
+- **C2** `rollback_current_turn()` cleans message state after Ctrl+C
+- **C4** Version check offline state surfaced as dim activity line
+- **C5** `is_known_model_pricing()` helper; usage line shows `~$unknown` for unknown models
+- **C6** `/resume <invalid_id>` now actionable error
+- **D1** `god-code setup` confirmation prompt before overwriting existing config
+- **D2** Loud yellow warning when Godot binary auto-detection fails
+- **D3** Welcome panel reduced to 4 essential fields
+- **D4** Multiline continuation prompt cancel hint
+- **E1** `/help` table reorganized into 6 sections
+- **E2** Activity log slice mismatch (10 vs 8) fixed
+- **E4** Mode embedded in input prompt with mode-specific colour
+- **F1** Planner prompt rewrite — disavows "PLAN mode" wording
+- **F2** Planner prompt enforces structured output format
+- **G3** New events: `session_autosaved`, `session_autosave_failed`, `diff_failed`, `version_check_offline`, `turn_cancelled`
+- **H2** Tab-completion hint added to welcome banner
+
+### Test count
+
+665 → 681 (+16 regression tests across 5 test files)
+
+### Known scope notes
+
+- **C2 partial implementation** — `rollback_current_turn()` cleans up message state but the full `asyncio.create_task` cancellation pattern (true task termination of in-flight HTTP streams and subprocess tools) is deferred to v1.0.1. The existing CLI flow tests depend on the simpler synchronous-await pattern. In practice CPython's signal handling unwinds the await stack on Ctrl+C correctly, so the user-visible behaviour is fixed even without true task termination.
+- **A2 layer 2 deferred** — universal spinner (Layer 1) ships in v1.0.0; per-tool `tool_progress` events for finer-grained reporting (Layer 2) deferred since they require per-tool instrumentation.
+- **Subprocess termination on cancel deferred** — if a tool has already spawned a subprocess (Godot validation, sprite generation), cancelling the Python coroutine doesn't kill the subprocess. v1.0.1 will add per-tool subprocess registration + termination.
+
+### What changed since v0.6.1 (the last PyPI release before v0.9.2)
+
+> **PyPI was stuck at v0.6.1 from early April 2026 until v0.9.2 in this same release cycle.** Anyone who installed god-code via `pipx install god-code` between v0.6.1 and v0.9.2 was on a version that predates everything below. v1.0.0rc1 is the first PyPI release that includes all v0.7 / v0.8 / v0.9 / v1.0 work.
+
+- **v0.7** — Demo-ready foundation: genre detection (`runtime/intent_resolver.py`), sprite QA pipeline (`tools/sprite_qa.py`), polish rubric, scenario engine (`testing/scenario_runner.py`)
+- **v0.8** — Vision iteration loop (screenshot → analyze → fix → score), live runtime bridge to Godot 4.4 over TCP 9394, backend dual-path LLM client, platform API key auth (`gc_live_*`), CLI package split, ImageChops perf, ValidationSuite
+- **v0.9** — Pre-launch security audit (shell hardening, session paths, MCP path containment, log redaction), OpenAI strict-mode pydantic compatibility, hatch wheel cleanup
+- **v0.9.1** — `assistant_preview` extraction guard against empty LLM responses (was crashing the planner pass)
+- **v0.9.2** — `AgentDispatcher` propagates streaming callbacks to sub-engines (planner pass now streams to TUI instead of blocking 60-120s)
+- **v1.0.0rc1** — this release; the full 27-fix UX overhaul above
+
+## [Unreleased]
+
+### Security
+- **run_shell hardened** against credential exfiltration: subprocess environment is now filtered to drop any variable whose name contains KEY/TOKEN/SECRET/PASSWORD/PASSWD/CREDENTIAL/AUTH/PRIVATE/CERT, and `env`, `printenv`, `set`, `export`, and reads of `.config/god-code`, `.codex/auth`, `.aws/credentials`, `.ssh/id_*`, `.ssh/authorized_keys`, `.netrc`, `.npmrc`, `.pypirc` are now blocked at all safety levels.
+- **Session files** (`~/.agent_sessions/*.json`) are now `chmod 0o600` on write so tool outputs captured in conversation history are not world-readable.
+- **Atomic secure writes** for `~/.config/god-code/config.json` and `~/.config/god-code/auth.json`: files are created via `tempfile` + `os.fchmod(0o600)` + `os.replace`, eliminating the TOCTOU window where an earlier `write_text` produced a briefly 0o644 file.
+- **MCP server path containment**: every `file_path` argument to MCP tools is validated against the active project root with `Path.relative_to`, and a `.gd/.tscn/.tres/.cfg/.gdshader/.json/.md/.txt/.import` extension allowlist, preventing a misbehaving MCP client from reading or writing arbitrary files such as `~/.config/god-code/config.json`.
+- **Prefix confusion fix** in `file_ops._validate_path`: `startswith` replaced with `Path.relative_to`, so a project rooted at `/proj/my-game` no longer accidentally permits access to `/proj/my-game-secrets/`.
+- **Log redaction** (`godot_agent/llm/redact.py`): a new `redact_secrets` helper masks Bearer tokens, `sk-*` keys, `gc_live_*` keys, and JWT triples in any error string before it is handed to `log.error`/`log.warning`. Applied to backend, streaming, and computer-use error paths in `llm/client.py` and `llm/streaming.py`.
+
+### Added
+- Workspace-style chat TUI with session snapshot, recent activity, and live streaming panels
+- Interaction modes (`apply`, `plan`, `explain`, `review`, `fix`) with mode-aware tool availability
+- Autosaved session metadata with `/sessions`, `/resume`, `/new`, and project-aware restore flow
+- Gameplay intent resolver with persistent profile storage in design memory
+- `/intent` commands and TUI intent panel for confirming genre/combat/enemy direction
+- Genre-aware internal skills: `bullet_hell`, `topdown_shooter`, `platformer_enemy`, `tower_defense`, `stealth_guard`
+- Profile-aware playtest selection and report context
+- MkDocs documentation site skeleton with getting-started, TUI, validation, provider, and MCP guides
+
+### Changed
+- Unified `ask` and `chat` rendering pipeline, including tool progress and validation feedback
+- Improved post-tool validation visibility and tool result summaries in interactive sessions
+- Session persistence now preserves assistant tool calls and richer metadata for restore
+- Prompt assembly, skill routing, planner/reviewer/playtest flows, and workspace state now consume shared gameplay intent
+
+## [0.1.0] - 2026-04-02
+
+### Added
+- CLI with `ask`, `chat`, `info`, `login`, `logout`, `status` commands
+- 10 tools: read_file, write_file, edit_file, list_dir, grep, glob, git, run_shell, run_godot, screenshot_scene
+- OpenAI-compatible API client with streaming and vision support
+- OAuth login via Codex CLI refresh token
+- Godot project parser (project.godot, autoloads, resolution)
+- .tscn scene parser, writer, and format validator with auto-fix
+- GDScript linter (naming, ordering, type annotations, anti-patterns)
+- Collision layer planner (standard 8-layer scheme)
+- Cross-file consistency checker (collision, signals, resource paths, groups)
+- Project dependency graph builder
+- Design pattern advisor (object pool, component, state machine)
+- Godot Playbook knowledge system (17 sections, context-aware injection)
+- Build discipline rules (incremental build-and-verify)
+- Error detection loop with Godot output parsing and fix suggestions
+- Conversation context compaction for long sessions
+- Path containment security (file ops restricted to project root)
+- Shell command sandboxing (dangerous pattern blocking)
+- API retry with exponential backoff (429 rate limits)
+- Content filter graceful handling (400 errors)
+- Session persistence to JSON
+
+### Security
+- File operations restricted to project root directory
+- Shell commands blocked for dangerous patterns (rm -rf /, sudo, etc.)
+- Git argument parsing via shlex.split()
+- OAuth tokens stored with 600 permissions
+- API key/token masked in status output