spriteforge 0.1.1__py3-none-any.whl

spriteforge/app/chat.py

@@ -0,0 +1,114 @@
+"""Chatting with an agent: a message is a question (answered now, one Spark call with that
+agent's own work as context) or a change (filed for the gated pipeline, never run freely)."""
+
+import re
+from typing import Literal
+
+from pydantic import Field
+
+from spriteforge.agents.models import Contract
+from spriteforge.config import BudgetConfig, Config
+from spriteforge.core.cost import Budget, for_the_user
+from spriteforge.core.state import Store
+from spriteforge.stages.references import images
+
+Intent = Literal["question", "change"]
+
+# "can you make the bat purple?" asks for a change, though it ends with a question mark.
+CHANGE_START = re.compile(
+    r"^(please|can you|could you|would you|will you|i want|i'd like|i would like|let's|"
+    r"make|change|add|remove|delete|use|set|turn|give|move|swap|replace|fix|try|keep|drop|"
+    r"increase|decrease|raise|lower|speed|slow|shorten|lengthen|rename|recolou?r)\b"
+)
+QUESTION_START = re.compile(
+    r"^(why|what|how|when|where|which|who|whose|is|are|was|were|does|do|did|has|have|"
+    r"should|explain|tell me)\b"
+)
+
+CONTEXT_CHARS = 20000  # the agent's own artifacts sent with a question, newest first
+TEXT_MIMES = {"application/json", "text/markdown", "text/plain"}
+
+
+def classify(text: str) -> Intent:
+    """Deterministic and free; the studio lets the user flip it when it guesses wrong."""
+    t = " ".join(text.lower().split())
+    if CHANGE_START.match(t):
+        return "change"
+    if t.endswith("?") or QUESTION_START.match(t):
+        return "question"
+    return "change"
+
+
+class ChatAnswer(Contract):  # Contract: Meta's strict json_schema needs additionalProperties false
+    answer: str = Field(description="Your reply to the human, in plain words", max_length=4000)
+
+
+def own_work(store: Store, run_id: str, agent: str, limit: int = CONTEXT_CHARS) -> str:
+    """The agent's latest text artifacts (one version of each, Markdown over JSON when it wrote
+    both), newest first, up to `limit` characters."""
+    mine = {
+        e.payload["id"]
+        for e in store.events(run_id)
+        if e.type == "artifact.created" and e.agent == agent
+    }
+    latest: dict[str, tuple[int, str, str]] = {}
+    for a in store.artifacts(run_id):
+        if a.id not in mine or a.mime not in TEXT_MIMES:
+            continue
+        family = re.sub(r"v\d+", "vN", a.name.rsplit(".", 1)[0])
+        version = max(map(int, re.findall(r"v(\d+)", a.name)), default=0)
+        rank = (version, a.mime == "text/markdown")
+        if family not in latest or rank > latest[family][:2]:
+            latest[family] = (*rank, a.name, a.data.decode("utf-8", "replace"))
+    parts, used = [], 0
+    for *_, name, text in sorted(latest.values(), key=lambda v: v[:2], reverse=True):
+        block = f"### {name}\n{text}\n"
+        if used + len(block) > limit:
+            block = block[: max(0, limit - used)]
+        if block:
+            parts.append(block)
+            used += len(block)
+    return "\n".join(parts)
+
+
+def history(store: Store, run_id: str, agent: str, turns: int = 6) -> str:
+    lines = []
+    for e in store.events(run_id):
+        if e.type == "chat.user" and e.payload.get("to") == agent:
+            lines.append("Human: " + e.payload.get("text", ""))
+        elif e.type == "chat.agent" and e.agent == agent:
+            lines.append(f"{agent}: " + e.payload.get("text", ""))
+    return "\n".join(lines[-turns:])
+
+
+def question_prompt(store: Store, run_id: str, agent: str, text: str) -> str:
+    work = own_work(store, run_id, agent) or "(nothing yet: you have not run in this project)"
+    talk = history(store, run_id, agent)
+    return (
+        "The human making this game asks you about your work. Answer from your work below, "
+        "briefly and concretely; say so when the answer is not in it. Do not promise changes: "
+        "the human asks for those separately and they go through review.\n\n"
+        f"## Your work so far\n{work}\n\n"
+        + (f"## The conversation so far\n{talk}\n\n" if talk else "")
+        + f"## The question\n{text}"
+    )
+
+
+def answer_question(store: Store, run_id: str, agent: str, text: str, models=None) -> str:
+    """One Spark call (offline: a stand-in answer) booked to this agent in the cost ledger.
+    `models` (tests) replaces the run's own model access."""
+    from spriteforge.game.pipeline import Models
+
+    run = store.get_run(run_id)
+    if models is None:
+        cfg = Config.model_validate(run.config.get("settings") or {})
+        budget = Budget(store, run_id, BudgetConfig.model_validate(run.config.get("budget", {})))
+        models = Models(cfg, budget, mock=bool(run.config.get("mock")))
+        models.references = images(store, run_id, [agent])
+    fallback = ChatAnswer(
+        answer=f"(Offline mock: no model is called.) I'm the {agent}. Ask again with a live "
+        "Muse key for a real answer about my work."
+    )
+    with for_the_user():  # the human asked: no cap or stop request refuses it
+        return models.ask(agent, question_prompt(store, run_id, agent, text), ChatAnswer,
+                          fallback, "chat").answer  # fmt: skip

spriteforge/app/extensions.py

@@ -0,0 +1,115 @@
+"""Human-only extension administration and per-call confirmation routes."""
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+from pydantic import BaseModel, Field
+
+from spriteforge.agents.roles import load_roles
+from spriteforge.core.security import redact
+from spriteforge.mcp.service import ConfirmationRequired, MCPService
+from spriteforge.skills.catalog import SkillCatalog
+
+
+class EnableRequest(BaseModel):
+    role: str
+    enabled: bool
+
+
+class PolicyRequest(BaseModel):
+    tool: str
+    confirm: bool
+
+
+class InvokeRequest(BaseModel):
+    role: str
+    tool: str
+    arguments: dict = Field(default_factory=dict)
+
+
+class Decision(BaseModel):
+    approve: bool
+
+
+def router(store, service=None):
+    def local_request(request: Request):
+        # Explicit UI approvals must not be forgeable by an unrelated web page.
+        if request.url.hostname not in {"127.0.0.1", "localhost", "::1", "testserver"}:
+            raise HTTPException(403, "Local host required")
+        origin = request.headers.get("origin")
+        if origin and origin != str(request.base_url).rstrip("/"):
+            raise HTTPException(403, "Same-origin request required")
+
+    api = APIRouter(dependencies=[Depends(local_request)])
+    service = service or MCPService(store)
+    roles = load_roles()
+
+    @api.get("/api/extensions")
+    def extensions():
+        return {
+            "roles": list(roles),
+            "skills": {n: SkillCatalog(store.path.parent).summaries(r) for n, r in roles.items()},
+            "servers": {
+                n: redact(s.model_dump()) for n, s in service.registry.read().mcpServers.items()
+            },
+        }
+
+    @api.post("/api/mcp/{name}/inspect")
+    async def inspect(name: str):
+        try:
+            return {"tools": await service.discover(name)}
+        except Exception as exc:  # noqa: BLE001 -- scrub all SDK errors at the HTTP boundary
+            raise HTTPException(400, redact(str(exc))) from None
+
+    @api.post("/api/mcp/{name}/enable")
+    def enable(name: str, body: EnableRequest):
+        try:
+            if body.enabled:
+                service.registry.enable(name, body.role)
+            else:
+                service.registry.disable(name, body.role)
+        except (KeyError, ValueError) as exc:
+            raise HTTPException(400, str(exc)) from None
+        return {"ok": True}
+
+    @api.post("/api/mcp/{name}/policy")
+    def policy(name: str, body: PolicyRequest):
+        try:
+            service.registry.policy(name, body.tool, body.confirm)
+        except (KeyError, ValueError) as exc:
+            raise HTTPException(400, str(exc)) from None
+        return {"ok": True}
+
+    @api.get("/api/runs/{run_id}/mcp/confirmations")
+    def confirmations(run_id: str):
+        return service.pending(run_id)
+
+    @api.post("/api/runs/{run_id}/mcp/call")
+    async def call(run_id: str, body: InvokeRequest):
+        try:
+            return await service.call(run_id, roles[body.role], body.tool, body.arguments)
+        except ConfirmationRequired as exc:
+            return {"confirmation": exc.ident}
+        except Exception as exc:  # noqa: BLE001 -- scrub all SDK errors at the HTTP boundary
+            raise HTTPException(400, redact(str(exc))) from None
+
+    @api.post("/api/runs/{run_id}/mcp/confirmations/{ident}")
+    async def confirm(run_id: str, ident: str, body: Decision):
+        try:
+            row = service.row(run_id, ident)
+            if row is None:
+                raise ValueError("Unknown confirmation")
+            import json
+
+            role = roles[json.loads(row["intent"])["role"]]
+            result = await service.respond(run_id, ident, body.approve, role)
+            # Runtime checkpoints consume the saved result without repeating the tool call.
+            if store.get_run(run_id).config.get("workflow") == "agent-runtime-mock-v1":
+                import asyncio
+
+                from spriteforge.agents.workflow import advance_until_gate
+
+                await asyncio.to_thread(advance_until_gate, store, run_id)
+            return result
+        except Exception as exc:  # noqa: BLE001 -- scrub all SDK errors at the HTTP boundary
+            raise HTTPException(409, redact(str(exc))) from None
+
+    return api

spriteforge/app/index.html

@@ -0,0 +1,279 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width">
+<title>SpriteForge</title><style>
+.concept-preview{width:100%!important;height:auto!important;max-width:960px!important}
+.concept-figure{width:100%;max-width:960px}.swatch-field{display:inline-block;margin:8px;padding:8px}
+.gameplay-figure{flex:1 1 560px;max-width:100%;order:0}.gameplay-image{width:100%!important;height:auto!important}.mood-figure{flex:0 1 240px;order:1}.mood-image{width:240px!important;height:auto!important;max-width:100%}.preview-checks{flex-basis:100%;order:2}#preview-history a{display:inline-block;margin-right:16px}#preview-summary{white-space:pre-wrap}
+.asset-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(200px,1fr));gap:12px}.asset-card{border:1px solid #556;padding:12px;overflow-wrap:anywhere}.asset-card img{width:auto;height:auto;max-width:192px;max-height:192px}.asset-pass{color:#9ae6b4}.asset-fail{color:#ffb4b4}.production-sheet{width:100%!important;height:auto!important}
+body{background:#151822;color:#e2e8f0;font:16px system-ui;margin:40px auto;max-width:960px;padding:0 20px}
+h1{color:#9ae6b4}select{padding:8px;max-width:100%}li{padding:8px;border-bottom:1px solid #333}
+#artifacts,#gate-artifacts{display:flex;gap:24px;flex-wrap:wrap}img{width:128px;height:128px;image-rendering:pixelated;background:#303447}
+.muted{color:#a8b3c7}#error{color:#ffb4b4}figure{margin:0}pre{white-space:pre-wrap;max-width:800px;overflow-wrap:anywhere}textarea{display:block;width:95%;min-height:80px}fieldset{margin:16px 0}button{padding:10px;margin:6px}#gate-panel{border:2px solid #9ae6b4;padding:16px}#gate-artifacts img{width:auto;max-width:100%;height:160px}figcaption{padding:8px}a{color:#9ae6b4}
+</style></head><body><h1>SpriteForge</h1><p class="muted">Local game builder · human approval gates</p>
+<details id="extensions"><summary>Skills and MCP servers</summary>
+<label>Agent role <select id="extension-role"></select></label><h3>Available skills</h3><div id="skill-list"></div>
+<h3>MCP servers</h3><p>Inspect tools, then explicitly enable a server for the selected role. Every tool requires confirmation by default.</p><div id="mcp-list"></div><p id="extension-error" role="alert"></p>
+<label>Tool name (server.tool) <input id="mcp-tool"></label><label>Tool arguments (JSON)<textarea id="mcp-arguments">{}</textarea></label><button id="mcp-call" type="button">Request tool call</button>
+</details><section id="mcp-confirmations" aria-label="MCP confirmations"></section>
+<label>Run <select id="runs" aria-label="Select run"></select></label>
+<p id="status" role="status">Connecting…</p><p id="usage"></p><p id="play"></p><p id="error" role="alert"></p>
+<section id="preview-panel" hidden aria-label="Gameplay preview history"><p id="preview-summary"></p><details id="preview-warnings"><summary>Processing warnings</summary><ul id="preview-warning-list"></ul></details><nav id="preview-history" aria-label="Preview versions"></nav></section>
+<section id="production-panel" hidden aria-label="Production assets"><h2>Asset production</h2><p id="production-mode"></p><p id="set-review"></p><div id="production-assets"></div></section>
+<section id="gate-panel" hidden aria-labelledby="gate-title">
+<h2 id="gate-title"></h2><div id="gate-artifacts"></div><div id="change-requests"></div>
+<form id="gate-form"><div id="custom-fields"></div>
+<fieldset id="tags"><legend>Feedback tags</legend>
+<label><input type="checkbox" value="art">Art</label>
+<label><input type="checkbox" value="gameplay">Gameplay</label>
+<label><input type="checkbox" value="controls">Controls</label>
+<label><input type="checkbox" value="difficulty">Difficulty</label>
+<label><input type="checkbox" value="bug">Bug</label></fieldset>
+<label for="feedback-text">Feedback</label><textarea id="feedback-text"></textarea>
+<p id="feedback-hint" hidden>Describe what to change and submit to get a new version, or leave the box empty and submit to approve this build.</p>
+<button id="approve" type="submit" value="approve">Approve</button>
+<button id="request-changes" type="submit" value="request_changes">Request changes</button>
+<button id="submit-feedback" type="submit" value="submit" hidden>Approve (no feedback)</button>
+<button type="submit" value="abort">Abort</button><p id="gate-error" role="alert"></p>
+</form></section><h2>Artifacts</h2><div id="artifacts"></div><h2>Timeline</h2><ol id="timeline"></ol>
+<script>
+const $=id=>document.getElementById(id);let source, selected;
+let renderedGate=null,artifactIds={};
+async function extensionPost(path,body){const response=await fetch(path,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body||{})});const data=await response.json();if(!response.ok)throw new Error(typeof data.detail==='string'?data.detail:JSON.stringify(data.detail));return data;}
+async function extensionAction(fn){try{$('extension-error').textContent='';await fn();await loadExtensions();await loadConfirmations();}catch(e){$('extension-error').textContent=e.message;}}
+async function loadExtensions(){const data=await(await fetch('/api/extensions')).json();const pick=$('extension-role');if(!pick.options.length)for(const role of data.roles){const option=new Option(role,role);pick.add(option);}
+ const role=pick.value;$('skill-list').replaceChildren();for(const skill of data.skills[role]||[]){const p=document.createElement('p');p.textContent=skill.name+' — '+skill.description;$('skill-list').append(p);}
+ $('mcp-list').replaceChildren();for(const [name,server] of Object.entries(data.servers)){const box=document.createElement('fieldset'),legend=document.createElement('legend');legend.textContent=name+' — '+(Object.hasOwn(server.enabled_roles,role)?'enabled for '+role:'disabled for '+role);box.append(legend);
+ const inspect=document.createElement('button');inspect.textContent='Inspect tools: '+name;inspect.type='button';inspect.onclick=()=>extensionAction(()=>extensionPost('/api/mcp/'+name+'/inspect'));box.append(inspect);
+ const enable=document.createElement('button');const enabled=Object.hasOwn(server.enabled_roles,role);enable.textContent=(enabled?'Disable ':'Enable ')+name+' for '+role;enable.type='button';enable.disabled=!server.discovered_fingerprint;enable.onclick=()=>extensionAction(()=>extensionPost('/api/mcp/'+name+'/enable',{role,enabled:!enabled}));box.append(enable);
+ for(const tool of server.tools){const p=document.createElement('p');p.textContent=name+'.'+tool.name+' — '+(tool.description||'');box.append(p);const label=document.createElement('label'),toggle=document.createElement('input');toggle.type='checkbox';toggle.checked=server.confirmation[tool.name]!==false;toggle.onchange=()=>extensionAction(()=>extensionPost('/api/mcp/'+name+'/policy',{tool:tool.name,confirm:toggle.checked}));label.append(toggle,document.createTextNode(' Require human confirmation for '+name+'.'+tool.name));box.append(label);const schema=document.createElement('details'),summary=document.createElement('summary'),pre=document.createElement('pre');summary.textContent='Arguments';pre.textContent=JSON.stringify(tool.inputSchema,null,2);schema.append(summary,pre);box.append(schema);}$('mcp-list').append(box);}}
+async function loadConfirmations(){if(!selected)return;const current=selected;const calls=await(await fetch('/api/runs/'+current+'/mcp/confirmations')).json();if(selected!==current)return;$('mcp-confirmations').replaceChildren();for(const call of calls){const box=document.createElement('fieldset'),title=document.createElement('legend'),pre=document.createElement('pre');title.textContent='Confirm MCP call: '+call.tool+' ('+call.role+')';pre.textContent=JSON.stringify(call.arguments,null,2);box.append(title,pre);for(const approve of [true,false]){const b=document.createElement('button');b.textContent=approve?'Approve tool call':'Deny tool call';b.onclick=()=>extensionAction(async()=>{b.disabled=true;await extensionPost('/api/runs/'+current+'/mcp/confirmations/'+encodeURIComponent(call.id),{approve});await refresh();});box.append(b);}$('mcp-confirmations').append(box);}}
+$('extension-role').onchange=()=>extensionAction(async()=>{});
+$('mcp-call').onclick=()=>extensionAction(async()=>{if(!selected)throw new Error('Select an active run first');await extensionPost('/api/runs/'+selected+'/mcp/call',{role:$('extension-role').value,tool:$('mcp-tool').value,arguments:JSON.parse($('mcp-arguments').value)});});
+loadExtensions().catch(e=>{$('extension-error').textContent=e.message;});setInterval(()=>loadConfirmations().catch(()=>{}),1500);
+async function renderArtifact(a,container){
+ const fig=document.createElement('figure'),cap=document.createElement('figcaption');cap.textContent=a.name;
+ if(a.mime.startsWith('image/')){const img=document.createElement('img');img.src='/api/artifacts/'+a.id;img.alt=a.name;
+ if(a.name.startsWith('concept/')){img.className='concept-preview';fig.className='concept-figure';cap.textContent=a.name+' · CONCEPT — not final art'+(a.name.includes('-pixel')?' · Pixel-true preview (320×180, nearest-neighbor 3×)':'');}
+ if(a.name.endsWith('/contact-sheet.png'))img.className='production-sheet';
+ if(/^game\/v\d+\/art\.png$/.test(a.name)){img.style.imageRendering='pixelated';cap.textContent='Art for every entity: library first, Muse Image for the rest · '+a.name;}
+ if(/^game\/v\d+\/levels\/level-\d+\.png$/.test(a.name)){img.style.imageRendering='pixelated';img.style.width='auto';img.style.height='auto';img.style.maxWidth='100%';fig.style.flexBasis='100%';cap.textContent='Level '+a.name.match(/level-(\d+)/)[1]+' map, drawn by code from the level data (the white line is the route the bot plays; gold: a dash) · '+a.name;}
+ if(/^game\/v\d+\/poster\.png$/.test(a.name)){img.style.imageRendering='pixelated';img.style.width='960px';img.style.maxWidth='100%';cap.textContent='Frame from the autoplay (install ffmpeg for the video) · '+a.name;}
+ if(a.name.endsWith('/gameplay-4x.png')||a.name.endsWith('/gameplay.png')){img.className='gameplay-image';fig.className='gameplay-figure';img.alt='Gameplay screen rendered from actual tiles, sprites and HUD';cap.textContent='This is what your game will look like · '+a.name;}
+ if(a.name.startsWith('mood/')){img.className='mood-image';fig.className='mood-figure';cap.textContent='Mood board, not final art';}
+ fig.append(img);}
+ else if(a.mime.startsWith('video/')){const v=document.createElement('video');v.src='/api/artifacts/'+a.id;v.controls=true;v.autoplay=true;v.muted=true;v.loop=true;v.playsInline=true;v.className='kit-video';v.style.maxWidth='100%';v.style.width='960px';v.style.imageRendering='pixelated';cap.textContent='20 s autoplay of the generated game · '+a.name;fig.append(v);}
+ else if(a.mime==='application/json'&&/^game\/design\/v\d+\.json$/.test(a.name)){const d=await(await fetch('/api/artifacts/'+a.id)).json();const box=document.createElement('div');
+ const h=document.createElement('h3');h.textContent=d.title;const p=document.createElement('p');p.textContent=d.pitch;box.append(h,p);
+ const list=(title,items)=>{const t=document.createElement('h4');t.textContent=title;const ul=document.createElement('ul');for(const i of items){const li=document.createElement('li');li.textContent=i;ul.append(li);}box.append(t,ul);};
+ list('Basics',['Camera: '+d.camera,'Controls: '+d.controls,'Session: '+d.session_seconds+' s','Player: '+d.player,'World: '+d.world,'Look: '+d.look,'Win: '+d.win,'Lose: '+d.lose]);
+ list('Rules',d.rules);if(d.progression.length)list('Progression',d.progression);if(d.difficulty.length)list('Difficulty',d.difficulty);
+ list('Entities',d.entities.map(e=>e.id+' ('+e.role+', '+e.width+'x'+e.height+'): '+e.look+' — '+e.behaviour));
+ list('Checks the playtest will verify',d.checks.map(c=>c.event+' ≥ '+c.min_count+(c.by_second?' by '+c.by_second+' s':'')+' — '+c.description));
+ fig.append(box);cap.textContent='Game design doc · '+a.name;}
+ else if(a.mime==='application/json'&&a.name==='game/research.json'){const rec=await(await fetch('/api/artifacts/'+a.id)).json(),r=rec.research;const box=document.createElement('div');
+ const list=(title,items)=>{const t=document.createElement('h4');t.textContent=title;const ul=document.createElement('ul');for(const i of items){const li=document.createElement('li');if(i instanceof Node)li.append(i);else li.textContent=i;ul.append(li);}box.append(t,ul);};
+ box.append(Object.assign(document.createElement('h3'),{textContent:'Research: how similar games do it'}),Object.assign(document.createElement('p'),{textContent:rec.by+' · '+rec.searches+' search call(s) · '+rec.sources.length+' pages found'}));
+ list('Reference games (patterns only; the game stays original)',r.references.map((ref,i)=>{const span=document.createElement('span');span.append(ref.title+': '+ref.learn+' ');if(ref.url&&/^https?:\/\//.test(ref.url)){const link=document.createElement('a');link.href=ref.url;link.target='_blank';link.rel='noopener noreferrer';link.textContent=ref.url;span.append(link);}if(ref.url&&!rec.verified[i])span.append(' ⚠ not among the pages the searches returned');return span;}));
+ list('Patterns',r.patterns.map(x=>x.name+': '+x.how+' For this game: '+x.use));
+ list('Feel numbers players expect',r.feel.map(f=>f.name+': '+f.value+' ('+f.why+')'));
+ list('Pitfalls',r.pitfalls);if(rec.queries.length)list('Searched for',rec.queries);if(rec.notes.length)list('Notes',rec.notes);
+ fig.append(box);cap.textContent='Research (Game Designer with web search) · '+a.name;}
+ else if(a.mime==='application/json'&&/^game\/plan\/v\d+\.json$/.test(a.name)){const rec=await(await fetch('/api/artifacts/'+a.id)).json(),p=rec.plan,k=rec.kinematics,m=p.movement;const box=document.createElement('div');
+ const list=(title,items)=>{const t=document.createElement('h4');t.textContent=title;const ul=document.createElement('ul');for(const i of items){const li=document.createElement('li');li.textContent=i;ul.append(li);}box.append(t,ul);};
+ box.append(Object.assign(document.createElement('h3'),{textContent:'Game plan'}),Object.assign(document.createElement('p'),{textContent:'Style: '+p.style}));
+ if(rec.problems.length)list('⚠ Problems code found (the plan was '+(rec.retried?'asked for again once':'not retried')+')',rec.problems);
+ list('Your requirements (your words) and what covers each',p.requirements.map(r=>r.id+'. "'+r.text+'" → '+(p.coverage.filter(c=>c.requirement===r.id).map(c=>c.parts.join(', ')+': '+c.how).join('; ')||'NOT COVERED')));
+ list('Movement',[m.move_speed+' tiles/s','jump '+m.jump_height+' tiles, '+m.air_time+' s in the air'+(k?' → gravity '+k.gravity+' px/s², clears gaps up to '+k.max_gap+' tiles ('+k.max_gap_with_dash+' with a dash), platforms up to '+k.max_rise+' tiles high':''),'dash '+m.dash_distance+' tiles, cooldown '+m.dash_cooldown+' s','coyote time '+m.coyote_time+' s']);
+ list('Abilities',p.abilities.map(x=>x.name+': '+x.does+(x.numbers?' ('+x.numbers+')':'')+' · from '+x.unlocked_by));
+ list('Mechanics',p.mechanics.map(x=>x.name+': '+x.what+' — for '+x.purpose));
+ list('Challenges',p.challenges.map(c=>c.name+': '+c.tests));
+ list('Levels',p.levels.map(l=>l.n+'. '+l.name+' (difficulty '+l.difficulty+'): teaches '+l.teaching_goal+' · new idea: '+l.new_idea+' · challenges: '+(l.challenges.join(', ')||'-')+' · needs: '+(l.abilities.join(', ')||'-')));
+ list('Feel',p.feel.map(f=>f.event+': '+f.see+(f.hear?' · '+f.hear:'')));
+ list('Animations',p.animations.map(x=>x.entity+': '+x.rows.map(r=>r.name+' '+r.frames+'f '+(r.loop?'loop':'once')+' ('+r.shows+')').join('; ')));
+ list('Risks',p.risks);
+ fig.append(box);cap.textContent='Game plan: the design is written from it · '+a.name;}
+ else if(a.mime==='application/json'&&/^game\/(design\/v\d+-story|story\/v\d+-[a-z0-9-]+)\.json$/.test(a.name)){const s=await(await fetch('/api/artifacts/'+a.id)).json();const box=document.createElement('div');
+ const list=(title,items)=>{const t=document.createElement('h4');t.textContent=title;const ul=document.createElement('ul');for(const i of items){const li=document.createElement('li');li.textContent=i;ul.append(li);}box.append(t,ul);};
+ const h=document.createElement('h3');h.textContent=s.title+' — story bible';box.append(h);
+ box.append(Object.assign(document.createElement('p'),{textContent:s.logline}),Object.assign(document.createElement('p'),{textContent:s.premise}));
+ list('Basics',['Setting: '+s.setting,'Tone: '+s.tone,'Themes: '+(s.themes.join(', ')||'-')]);
+ list('Characters',s.characters.map(c=>c.name+' ('+c.role+', '+c.entity+'): '+c.look+' — '+c.personality+'. Goal: '+c.goal+(c.relationships?' · '+c.relationships:'')));
+ list('Locations',s.locations.map(l=>l.name+': '+l.description));
+ list('Arc (beat 1 is this game)',s.arc.map((b,i)=>(i+1)+'. '+b));
+ list('Canon — later levels must keep these',s.canon);
+ fig.append(box);cap.textContent='Story bible: the canon every later level is written from · '+a.name;}
+ else if(a.mime==='application/json'&&/^game\/v\d+\/report\.json$/.test(a.name)){const r=await(await fetch('/api/artifacts/'+a.id)).json();const box=document.createElement('div');
+ if(r.play){const play=document.createElement('a');play.href=r.play;play.target='_blank';play.rel='noopener';play.textContent='▶ Play this build in a new tab';box.append(play);if(r.sounds){const ed=document.createElement('a');ed.href=r.play.replace(/index\.html$/,'sounds.html');ed.target='_blank';ed.rel='noopener';ed.textContent=' · 🔊 Edit the sounds';box.append(ed);}}
+ if(r.levels){const h=document.createElement('h4');h.textContent='Levels (each played on its own by the bot)';const lu=document.createElement('ul');for(const lv of r.levels){const li=document.createElement('li');li.append((lv.cleared?'✔ ':'✖ ')+'Level '+lv.n+': '+lv.name+' — '+(lv.cleared?'cleared in '+lv.game_seconds+' game s':'not cleared ('+(lv.ended||'?')+(lv.bot&&lv.bot.detail?': '+lv.bot.detail:'')+')')+(lv.missing&&lv.missing.length?' · events missing: '+lv.missing.join(', '):'')+' · difficulty '+lv.difficulty+' ');if(lv.play){const a=document.createElement('a');a.href=lv.play;a.target='_blank';a.rel='noopener';a.textContent='▶ play level '+lv.n;li.append(a);}for(const p of lv.problems||[]){const x=document.createElement('div');x.textContent='⚠ code found: '+p;li.append(x);}lu.append(li);}box.append(h,lu);}
+ const ul=document.createElement('ul');const li=t=>{const x=document.createElement('li');x.textContent=t;ul.append(x);};
+ li((r.passed?'✔ All playtest checks passed':'✖ Some playtest checks failed')+' · written by '+r.chosen_by+' · design v'+r.design_version+' · '+r.attempts.length+' attempt(s)');
+ for(const c of r.checks)li((c.ok?'✔ ':'✖ ')+c.event+': '+c.count+'/'+c.min_count+(c.by_second?' by '+c.by_second+' s':'')+' — '+c.description);
+ for(const p of r.problems||[])li('✖ '+p);
+ for(const x of r.art)li('art '+x.entity+': '+x.source);
+ if(r.sounds)li('Sounds v'+r.sounds.version+' ('+r.sounds.by+'): '+r.sounds.cues.map(c=>c.name+(c.heard?' ✔':'')).join(', ')+(r.sounds.never_heard.length?' · not heard in the bot playtest: '+r.sounds.never_heard.join(', '):''));
+ for(const w of r.warnings||[])li('⚠ '+w);
+ if(r.revision)li('Feedback applied: design «'+(r.revision.design_changes||'-')+'» · art '+(r.revision.art_changes.map(c=>c.entity).join(', ')||'-')+' · code «'+(r.revision.code_instructions||'-')+'»');
+ if(r.game_db)li('Game record (OKF bundle: design, entities, art, code, QA, builds, decisions, and the story when asked for): '+(r.game_db.concepts??r.game_db.entries)+' concepts in '+r.game_db.path);
+ li('Model calls: '+r.model_calls.chat+' Spark, '+r.model_calls.image+' Muse Image, about $'+r.model_calls.estimated_cost_usd);
+ box.append(ul);if(r.art_review)box.append(artReview(r.art_review,container.id==='gate-artifacts'));if(r.qa)box.append(qaSection(r.qa));const details=document.createElement('details'),summary=document.createElement('summary'),pre=document.createElement('pre');summary.textContent='Full report.json';pre.textContent=JSON.stringify(r,null,2);details.append(summary,pre);box.append(details);fig.append(box);cap.textContent='Build and playtest report · '+a.name;}
+ else if(a.mime==='application/json'&&/^game\/final\/v\d+-review\.json$/.test(a.name)){const f=await(await fetch('/api/artifacts/'+a.id)).json();const box=document.createElement('div');
+ const list=(title,items)=>{const t=document.createElement('h4');t.textContent=title;const ul=document.createElement('ul');for(const i of items){const li=document.createElement('li');li.textContent=i;ul.append(li);}box.append(t,ul);};
+ const tests=q=>q.passed+'/'+(q.passed+q.failed)+(q.failing&&q.failing.length?' (failing: '+q.failing.join(', ')+')':'');
+ if(f.play){const p=document.createElement('a');p.href=f.play;p.target='_blank';p.rel='noopener';p.textContent='▶ Play the whole game in a new tab';box.append(p);}
+ if(f.levels.length)list('Levels: the bot’s run and the QA tests that start in each',f.levels.map(l=>(l.cleared?'✔ ':'✖ ')+'Level '+l.n+': '+l.name+' — '+(l.cleared?'cleared in '+l.game_seconds+' game s':'not cleared ('+(l.ended||'?')+')')+' · QA '+tests(l.qa)));
+ list('QA tests',[tests(f.qa)+' pass in this build',...Object.entries(f.qa.by_kind).map(([k,v])=>k+': '+tests(v))]);
+ list('Art',[f.art.entities+' entities: '+Object.entries(f.art.sources).map(([k,v])=>v+' '+k).join(', '),...Object.entries(f.art.review_scores).map(([k,v])=>'art review '+k+': '+v+'/5')]);
+ list('Cost of the whole run',[f.cost.chat+' Spark and '+f.cost.image+' Muse Image calls, about $'+f.cost.estimated_cost_usd+' over '+f.builds+' build(s)']);
+ list('The game’s record (OKF bundle)',[f.record.concepts+' concepts in '+f.record.path,'sections: '+Object.entries(f.record.sections).map(([k,v])=>k+' '+v).join(', '),'trust now: '+Object.entries(f.record.trust).map(([k,v])=>v+' '+k).join(', ')+' (all human-reviewed when you approve)']);
+ fig.append(box);cap.textContent='Final review of the whole game · '+a.name;}
+ else if(a.mime==='application/json'&&/^game\/final\/v\d+-lessons\.json$/.test(a.name)){const r=await(await fetch('/api/artifacts/'+a.id)).json();const box=document.createElement('div');const ol=document.createElement('ol');
+ for(const l of r.lessons){const li=document.createElement('li'),b=document.createElement('strong'),e=document.createElement('small');b.textContent=l.title+' ('+l.topic+')';e.textContent='Evidence: '+l.evidence;li.append(b,document.createElement('br'),l.lesson,document.createElement('br'),e);ol.append(li);}
+ const details=document.createElement('details'),summary=document.createElement('summary'),ul=document.createElement('ul');summary.textContent='The facts code recorded ('+r.facts.length+')';for(const x of r.facts){const li=document.createElement('li');li.textContent=x;ul.append(li);}details.append(summary,ul);box.append(ol,details);
+ fig.append(box);cap.textContent='Lessons by the Librarian ('+r.by+'): they go to the shared memory (lessons/) as generated knowledge when you approve; promote them with spriteforge memory promote · '+a.name;}
+ else if(a.mime==='text/x-python'){const link=document.createElement('a');link.href='/api/artifacts/'+a.id;link.download=a.name.split('/').pop();link.textContent='⬇ Download '+link.download+' (QA tests: pytest + Playwright; put it in the build’s tests/ folder)';fig.append(link);cap.textContent='Exported QA tests · '+a.name;}
+ else if(a.mime==='application/json'){const pre=document.createElement('pre');
+ pre.textContent=JSON.stringify(await(await fetch('/api/artifacts/'+a.id)).json(),null,2);
+ if(a.name.endsWith('/readability.json')){fig.className='preview-checks';const details=document.createElement('details'),summary=document.createElement('summary');summary.textContent='Asset validation and readability report';details.append(summary,pre);fig.append(details);}else fig.append(pre);}
+ fig.append(cap);container.append(fig);
+}
+// Art review on the G4 report: scores, fixed art (before/after), every issue; at the playtest
+// gate each suggestion has Apply, which submits it as feedback (a targeted art rebuild).
+function artReview(rv,canApply){const box=document.createElement('section');box.className='art-review';
+ const h=document.createElement('h4');h.textContent='Art review · '+rv.reviewed_by;box.append(h);
+ const scores=document.createElement('p');scores.textContent=Object.entries(rv.scores).map(([k,v])=>k+' '+v+'/5').join(' · ')+(rv.cost?' · cost $'+(rv.cost.review+rv.cost.fixes).toFixed(3)+' of $'+rv.cost.cap.toFixed(2)+' (review $'+rv.cost.review.toFixed(3)+', fixes $'+rv.cost.fixes.toFixed(3)+')':'');box.append(scores);
+ const pic=name=>{const img=document.createElement('img');img.src='/api/artifacts/'+artifactIds[name];img.alt=name;img.style.cssText='width:auto;height:64px;vertical-align:middle';return img;};
+ for(const f of rv.fixes){const p=document.createElement('p');p.textContent=(f.fixed?'✔ Fixed ':'✖ Not fixed ')+f.entity+' ('+f.mode+')'+(f.notes.length?': '+f.notes.join('; '):'');
+  if(f.before&&artifactIds[f.before]&&artifactIds[f.after])p.append(' ',pic(f.before),' → ',pic(f.after));box.append(p);}
+ if(rv.replay)box.append(Object.assign(document.createElement('p'),{textContent:'Replayed with the fixed art: '+(rv.replay.passed?'checks passed':'checks failed')+(rv.replay.qa?' · QA '+rv.replay.qa.passed+'/'+(rv.replay.qa.passed+rv.replay.qa.failed):'')+(rv.replay.reverted?' — fixes reverted':'')}));
+ const ul=document.createElement('ul');
+ for(const i of rv.issues){const li=document.createElement('li');li.textContent='#'+i.n+' ['+i.severity+'] '+i.entity+': '+i.problem+' — fix: '+i.fix_prompt+' · '+i.status+' ('+i.from+')';
+  if(canApply&&i.status!=='fixed'){const b=document.createElement('button');b.type='button';b.textContent='Apply #'+i.n;b.onclick=()=>applySuggestion(i,b);li.append(' ',b);}ul.append(li);}
+ if(!rv.issues.length)ul.append(Object.assign(document.createElement('li'),{textContent:'No issues'}));box.append(ul);
+ const missed=rv.named.filter(n=>!n.ok);if(missed.length)box.append(Object.assign(document.createElement('p'),{textContent:'Naming test misses: '+missed.map(n=>n.entity+' seen as “'+n.seen_as+'”').join('; ')}));
+ const seen=rv.images.filter(n=>/\/(sheet-4x|shot-\d+)\.png$/.test(n)&&artifactIds[n]);
+ if(seen.length){const details=document.createElement('details'),summary=document.createElement('summary');summary.textContent='What the reviewer saw';details.append(summary);for(const n of seen){const img=pic(n);img.style.height='180px';details.append(img);}box.append(details);}
+ return box;}
+// QA tests on the G4 report: each test with pass/fail, its steps, the failing step and its
+// screenshots, and the exported Playwright file.
+function qaSection(qa){const box=document.createElement('section');box.className='qa-tests';
+ const total=qa.passed+qa.failed,h=document.createElement('h4');
+ h.textContent='QA tests and code checks · '+qa.passed+'/'+total+' pass'+(qa.broken?' · '+qa.broken+' check(s) broken (an error in the check itself, not in the game)':'');box.append(h);
+ if(qa.failed)box.append(Object.assign(document.createElement('p'),{textContent:'A failing test is a game bug or a wrong test (they are written from the design, not the code). If the test is wrong, drop it with feedback such as “ignore the restart test”.'}));
+ if(qa.note)box.append(Object.assign(document.createElement('p'),{textContent:'⚠ '+qa.note}));
+ if(qa.export_url){const a=document.createElement('a');a.href=qa.export_url;a.download='test_game_qa.py';a.textContent='⬇ test_game_qa.py: run these tests yourself (pytest + Playwright)';box.append(a);}
+ const ul=document.createElement('ul');
+ for(const t of qa.tests){const li=document.createElement('li');
+  const chk=t.kind==='check';
+  li.textContent=(t.passed?'✔ ':t.broken?'⚠ ':'✖ ')+(chk?'[code check] ':'')+t.name+(t.god?'':' (the player can die)')+' — '+t.purpose+(t.since?' · since v'+t.since:'')+(t.passed?'':chk?' · '+t.failure:' · failed at step '+t.failed_step+': '+t.failure);
+  const d=document.createElement('details'),sm=document.createElement('summary');sm.textContent=chk?'the check (JavaScript the QA Playtester wrote for this game)':'steps';d.append(sm);
+  if(chk){const pre=document.createElement('pre');pre.textContent=t.code+((t.logs||[]).length?'\n\n// notes: '+t.logs.join(' | '):'');d.append(pre);}
+  const ol=document.createElement('ol');for(const st of t.steps){ol.append(Object.assign(document.createElement('li'),{textContent:(st.ok?'✔ ':'✖ ')+st.step+(st.detail?' — '+st.detail:'')}));}d.append(ol);
+  for(const n of t.screenshots||[])if(artifactIds[n]){const img=document.createElement('img');img.src='/api/artifacts/'+artifactIds[n];img.alt=n;img.style.cssText='width:auto;height:120px;image-rendering:pixelated;margin:2px';d.append(img);}
+  li.append(d);ul.append(li);}
+ box.append(ul);
+ if(qa.dropped&&qa.dropped.length)box.append(Object.assign(document.createElement('p'),{textContent:'Dropped by feedback: '+qa.dropped.join(', ')}));
+ return box;}
+async function applySuggestion(i,button){const gate=renderedGate;if(!gate)return;button.disabled=true;
+ const body={action:'submit',tags:['art'],text:'Apply art review suggestion #'+i.n+' ('+i.entity+'): '+i.fix_prompt,form:{apply_suggestion:i.n}};
+ try{const response=await fetch('/api/runs/'+selected+'/gates/'+gate,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)});
+ const result=await response.json();if(!response.ok)throw new Error(typeof result.detail==='string'?result.detail:JSON.stringify(result.detail));await refresh();}
+ catch(err){$('gate-error').textContent=err.message;button.disabled=false;}}
+let refreshing=false,refreshAgain=false;
+async function refresh(){if(refreshing){refreshAgain=true;return;}refreshing=true;try{await refreshRun();}catch(error){$('error').textContent='Could not refresh the run. Check the local server connection: '+error.message;}finally{refreshing=false;if(refreshAgain){refreshAgain=false;refresh();}}}
+async function refreshRun(){const current=selected;const d=await (await fetch('/api/runs/'+current)).json();
+ if(current!==selected)return;
+ artifactIds=Object.fromEntries(d.artifacts.map(a=>[a.name,a.id]));
+ $('status').textContent=d.run.status+' · checkpoint '+d.run.cursor;
+ $('error').textContent=d.error||'';
+ $('play').replaceChildren();if(d.play){const a=document.createElement('a');a.href=d.play.url;a.target='_blank';a.rel='noopener';a.textContent='▶ Play the latest build (v'+d.play.version+')';$('play').append(a);if(d.play.sounds){const s=document.createElement('a');s.href=d.play.url.replace(/index\.html$/,'sounds.html');s.target='_blank';s.rel='noopener';s.textContent=' · 🔊 Edit the sounds';$('play').append(s);}}
+ const zip=d.artifacts.filter(a=>/^game\/v\d+\/export\.zip$/.test(a.name)).pop();if(zip){const a=document.createElement('a');a.href='/api/artifacts/'+zip.id;a.download=zip.name.replaceAll('/','-');a.textContent=' · ⬇ The finished game (build, record, tests)';$('play').append(a);}
+ const u=d.usage, dollars=v=>v==null?'unknown':'$'+v.toFixed(6);
+ $('usage').textContent=u?`${u.image_calls} / ${u.cap} image calls (${dollars(u.estimated_image_cost)}) · Spark: ${u.spark.calls} calls, ${u.spark.input_tokens ?? 'unknown'} input / ${u.spark.output_tokens ?? 'unknown'} output tokens, ${u.spark.cached_input_tokens ?? 'unknown'} cached input (${dollars(u.spark.estimated_cost)}) · total estimate ${dollars(u.estimated_total_cost)} · failed attempts: ${u.failed_attempts} (excluded)${u.spark.missing_usage_calls ? ' · token usage unavailable for '+u.spark.missing_usage_calls+' calls' : ''}`:'';
+ renderProduction(d);
+ renderPreview(d);
+ $('artifacts').replaceChildren();for(const a of d.artifacts.filter(a=>a.mime.startsWith('image/')&&(!a.name.startsWith('production/')||a.name.endsWith('/sprite.png'))&&(!a.name.startsWith('preview/')||a.name.endsWith('/sprite.png')||a.name.endsWith('/gameplay-4x.png'))&&(!a.name.startsWith('mood/')||a.name.endsWith('/landscape.png')))){await renderArtifact(a,$('artifacts'));}
+ if(current!==selected)return;
+ const g=d.gate;
+ if(!g){$('gate-panel').hidden=true;renderedGate=null;return;}if(renderedGate===g.id){$('gate-panel').hidden=false;return;}
+ $('gate-panel').hidden=true;renderedGate=null;
+ $('gate-title').textContent=g.title;$('gate-form').reset();$('gate-error').textContent='';
+ $('gate-artifacts').replaceChildren();for(const id of g.artifacts_to_show){const a=d.artifacts.find(a=>a.id===id);if(a)await renderArtifact(a,$('gate-artifacts'));}
+ $('change-requests').replaceChildren();
+ if(g.changes){for(const c of g.changes.requests){const p=document.createElement('p');
+ p.textContent='Target: '+JSON.stringify(c.target)+' | '+c.instruction+' | '+c.severity+' | '+c.scope+' | Regenerate: '+c.needs_regen;
+ $('change-requests').append(p);}}
+ $('request-changes').hidden=g.kind==='confirm_changes'||(d.run.config.workflow==='intake-concept-v1'&&!['concept','assets','gameplay','design','menus','playtest','final'].includes(g.stage));$('tags').hidden=g.kind==='confirm_changes';
+ const single=!!g.empty_feedback_approves;$('feedback-hint').hidden=!single;$('submit-feedback').hidden=!single;$('approve').hidden=single;if(single)$('request-changes').hidden=true;
+ const label=()=>{const story=$('custom-fields').querySelector('[name="story"]');$('submit-feedback').textContent=$('feedback-text').value.trim()?'Send feedback (make a new version)':(story&&story.value==='Add a story'?'Add a story (then review it here)':'Approve (no feedback)');};$('feedback-text').oninput=label;label();
+ $('custom-fields').replaceChildren();
+ if(g.form_schema.title!=='Feedback')for(const [name,rule] of Object.entries(g.form_schema.properties||{})){
+ const label=document.createElement('label');label.textContent=rule.title||name;
+ let input;
+ if(rule.enum){input=document.createElement('select');for(const v of rule.enum){const o=document.createElement('option');o.value=v;o.textContent=v;input.append(o);}}
+ else{input=document.createElement('input');input.type=rule.format==='color'?'color':rule.type==='boolean'?'checkbox':(['integer','number'].includes(rule.type)?'number':'text');}
+ input.name=name;input.dataset.kind=rule.type||'string';input.required=(g.form_schema.required||[]).includes(name);if(rule.default!==undefined)input.value=rule.default;
+ label.append(input);const box=document.createElement('fieldset');box.append(label);
+ if(rule.format==='color')box.className='swatch-field';
+ if(rule.suggestions&&rule.format!=='color'){const choices=document.createElement('div');
+ for(const value of rule.suggestions){const chip=document.createElement('button');chip.type='button';chip.textContent=value;chip.onclick=()=>{input.value=value;};choices.append(chip);}box.append(choices);
+ const suggest=document.createElement('button');suggest.type='button';suggest.textContent="I'm not sure, suggest options";suggest.onclick=()=>{choices.hidden=false;choices.style.border='1px solid #9ae6b4';choices.querySelector('button')?.focus();};box.append(suggest);
+ const skip=document.createElement('button');skip.type='button';skip.textContent='Skip / use default';skip.onclick=()=>{input.value=rule.default||'';};box.append(skip);}
+ $('custom-fields').append(box);}
+ $('custom-fields').onchange=label;label();
+ const optionsArtifact=d.artifacts.find(a=>a.name==='options.json');
+ if(g.stage==='styles'&&optionsArtifact){const options=await(await fetch('/api/artifacts/'+optionsArtifact.id)).json();
+ for(const option of options.options){const box=document.createElement('fieldset');const title=document.createElement('legend');title.textContent=option.name;box.append(title);const desc=document.createElement('p');desc.textContent=option.description;box.append(desc);
+ for(const color of option.colors){const swatch=document.createElement('span');swatch.style.cssText='display:inline-block;width:42px;height:42px;margin:4px';swatch.style.backgroundColor=color;swatch.title=color;box.append(swatch);}$('custom-fields').append(box);}}
+ if(current!==selected)return;renderedGate=g.id;$('gate-panel').hidden=false;
+}
+function renderPreview(d){
+ $('preview-panel').hidden=!d.preview;
+ if(!d.preview)return;
+ $('usage').textContent+=` · Gate 2 cap: ${d.preview.cap} image calls`;
+ const report=d.preview.report;
+ $('preview-summary').textContent=report?`Hero: ${report.hero_logical_height} logical pixels tall${report.hero_logical_height<24?' — WARNING: under 24':''} · Palette: ${report.palette_size} colors`:'';
+ const warnings=report?.warnings||[];$('preview-warnings').hidden=!warnings.length;$('preview-warning-list').replaceChildren();
+ for(const warning of warnings){const item=document.createElement('li');item.textContent=warning;$('preview-warning-list').append(item);}
+ $('preview-history').replaceChildren();
+ for(const v of d.preview.versions){const link=document.createElement('a');link.href='/api/artifacts/'+v.artifact;link.textContent='Gameplay v'+v.version;link.target='_blank';link.rel='noopener';$('preview-history').append(link);}
+}
+function renderProduction(d){
+ const panel=$('production-panel');panel.hidden=!d.production;if(!d.production)return;
+ $('production-mode').textContent=d.run.config.mock?'Mock preview: synthetic images and scripted critic scores.':'Muse asset production with pixel checks and visual review.';
+ const issues=d.production.consistency?.issues||[];$('set-review').textContent=d.production.consistency?`Set style score: ${d.production.consistency.style_match}/5. `+(issues.length?'Review issues: '+issues.map(i=>i.asset_ids.join(', ')+': '+i.issue+' '+i.fix).join(' | '):'No set consistency issues reported.'):'Production in progress; accepted assets are saved.';
+ $('production-assets').replaceChildren();
+ for(const type of ['character','tile','item','ui','fx']){
+ const records=d.production.assets.filter(r=>r.type===type);if(!records.length)continue;
+ const heading=document.createElement('h3');heading.textContent=type;const grid=document.createElement('div');grid.className='asset-grid';
+ for(const r of records){const card=document.createElement('article');card.className='asset-card';card.dataset.assetId=r.id;const title=document.createElement('h4');title.textContent=r.id;card.append(title);
+ const a=d.artifacts.find(a=>a.name===r.artifact);if(a){const img=document.createElement('img');img.src='/api/artifacts/'+a.id;img.alt=r.id;img.onload=()=>{img.style.width=(img.naturalWidth*4)+'px';};card.append(img);}
+ const failed=r.status!=='accepted'||issues.some(i=>i.asset_ids.includes(r.id));const badge=document.createElement('p');badge.className=failed?'asset-fail':'asset-pass';badge.textContent=(failed?'FAIL / '+(r.status==='placeholder'?'PLACEHOLDER':'SET REVIEW'):'PASS')+` · attempts ${r.attempts}/3 · v${r.version}`;card.append(badge);
+ if(r.scores){const scores=document.createElement('p');scores.textContent=`Style ${r.scores.style_match}/5 · Readability ${r.scores.readability}/5`;card.append(scores);}
+ if(r.issues.length){const detail=document.createElement('p');detail.textContent=r.issues.join('; ');card.append(detail);}
+ if(d.gate?.stage==='assets'){const button=document.createElement('button');button.type='button';button.textContent='Change '+r.id;button.onclick=()=>{const input=$('custom-fields').querySelector('[name="targets"]');if(input){input.value=r.id;input.focus();}$('feedback-text').focus();};card.append(button);}grid.append(card);}
+ $('production-assets').append(heading,grid);}
+}
+$('gate-form').onsubmit=async e=>{e.preventDefault();const gate=renderedGate;if(!gate)return;
+ const form={};for(const input of $('custom-fields').querySelectorAll('input,select')){
+ form[input.name]=input.dataset.kind==='boolean'?input.checked:(['integer','number'].includes(input.dataset.kind)?Number(input.value):input.value);}
+ const body={action:e.submitter.value,tags:[...$('tags').querySelectorAll('input:checked')].map(i=>i.value),text:$('feedback-text').value,form};
+ for(const b of $('gate-form').querySelectorAll('button'))b.disabled=true;
+ try{const response=await fetch('/api/runs/'+selected+'/gates/'+gate,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)});
+ const result=await response.json();if(!response.ok)throw new Error(typeof result.detail==='string'?result.detail:JSON.stringify(result.detail));
+ await refresh();}catch(err){$('gate-error').textContent=err.message;}finally{for(const b of $('gate-form').querySelectorAll('button'))b.disabled=false;}
+};
+function choose(){if(source)source.close();selected=$('runs').value;renderedGate=null;$('timeline').replaceChildren();refresh();
+ source=new EventSource('/api/runs/'+selected+'/events');source.onmessage=e=>{const d=JSON.parse(e.data);
+ const li=document.createElement('li');li.textContent=d.timestamp+' · '+d.agent+' · '+d.type+' · '+(d.payload.message||'');
+ if(d.type==='router.decision'||d.type==='router.outcome'){
+   const details=document.createElement('details'),summary=document.createElement('summary'),pre=document.createElement('pre');
+   summary.textContent=d.type==='router.decision'?'Capability selection':'Capability usage';
+   pre.textContent=JSON.stringify(d.payload,null,2);details.append(summary,pre);li.append(details);
+ }
+ $('timeline').append(li);refresh();};source.addEventListener('done',()=>{source.close();refresh();});
+ source.addEventListener('worker-error',e=>{$('error').textContent=JSON.parse(e.data);source.close();});}
+fetch('/api/runs').then(r=>r.json()).then(d=>{for(const r of d.runs){const o=document.createElement('option');
+ o.value=r.id;o.textContent=r.id+' · '+r.status;$('runs').append(o);}const wanted=new URLSearchParams(location.search).get('run');if(wanted&&d.runs.some(r=>r.id===wanted))$('runs').value=wanted;else if(d.active)$('runs').value=d.active;
+ if(d.error)$('error').textContent=d.error;if(d.runs.length)choose();else $('status').textContent='No runs yet';})
+ .catch(e=>{$('error').textContent=e.message;});$('runs').onchange=choose;
+</script></body></html>

spriteforge/app/local_only.py

@@ -0,0 +1,49 @@
+"""Localhost-only guard: the studio has no accounts, so any website the user visits could try to
+drive it through the browser. Requests must name a loopback host (DNS rebinding), and requests
+that change state must come from the studio's own origin (cross-site forms and fetches)."""
+
+from urllib.parse import urlsplit
+
+from fastapi.responses import JSONResponse
+
+LOCAL_HOSTS = {"127.0.0.1", "localhost", "::1", "testserver"}
+SAFE_METHODS = {"GET", "HEAD", "OPTIONS"}
+
+
+def host_name(host: str) -> str:
+    return (urlsplit("//" + host).hostname or "") if host else ""
+
+
+def refusal(method: str, headers) -> str | None:
+    """Why this request is refused, or None. `headers` is a case-insensitive mapping."""
+    host = headers.get("host", "")
+    if host_name(host) not in LOCAL_HOSTS:
+        return "Local host required"
+    if method in SAFE_METHODS:
+        return None
+    origin = headers.get("origin")
+    if origin is not None:
+        parts = urlsplit(origin)
+        # Compared with the Host header (not the bind address) so the Vite dev proxy works.
+        if parts.scheme not in {"http", "https"} or parts.netloc != host:
+            return "Same-origin request required"
+    elif headers.get("sec-fetch-site") == "cross-site":
+        return "Same-origin request required"
+    return None
+
+
+class LocalOnly:
+    """Pure ASGI middleware, so streaming responses (SSE) pass through untouched."""
+
+    def __init__(self, app):
+        self.app = app
+
+    async def __call__(self, scope, receive, send):
+        if scope["type"] == "http":
+            from starlette.datastructures import Headers
+
+            reason = refusal(scope["method"], Headers(scope=scope))
+            if reason:
+                await JSONResponse({"detail": reason}, status_code=403)(scope, receive, send)
+                return
+        await self.app(scope, receive, send)