8000 fix: seeded spell rolls, single turn resolution, world size budget and replay accounting by Mnehmos · Pull Request #118 · Mnehmos/mnehmos.rpg.mcp · GitHub
[go: up one dir, main page]
Skip to content

fix: seeded spell rolls, single turn resolution, world size budget and replay accounting - #118

Merged
Mnehmos merged 28 commits into
mainfrom
claude/practical-cannon-cel9je
Nov 10, 2026
Merged

fix: seeded spell rolls, single turn resolution, world size budget and replay accounting#118
Mnehmos merged 28 commits into
mainfrom
claude/practical-cannon-cel9je

Conversation

@Mnehmos
@Mnehmos Mnehmos commented Nov 10, 2026
Copy link
Copy Markdown
Owner

The findings left open at the end of the engine audit (#116 and #117). Each fix was written test-first.

What changed

  • Spell rolls follow the encounter seed. Spell damage, healing, attack and save rolls, and death saves, used Math.random. They now draw from the encounter's seeded dice, so a spell is as reproducible as a weapon attack and rewinds with a rolled-back call. Two encounters with the same seed now produce the same Fireball.
  • A strategy turn resolves once. resolve_turn took the turn number from the caller and could be run twice for the same turn, applying the economy and every conflict again. The last resolved turn is stored per world (new strategy_turns table); that turn or an earlier one is refused with a message naming the next turn.
  • A campaign has a world size budget. Every world keeps a tile snapshot (about 26 MB at 1000x1000) and nothing limited how many a campaign holds. WorldRepository.create now refuses a world that would take the campaign past RPG_MAX_WORLD_TILES_PER_CAMPAIGN (default 10,000,000 tiles: ten maximum-size worlds, or a thousand 100x100 ones). Deleting a world frees its share.
  • Live replays are charged to the token budget. A live replay is a real provider call but was never counted, so a budget-exhausted agent could keep spending through it. Replays now add their tokens to the agent's usage and are refused once the budget is gone.
  • The competency ladder file is read once instead of on every agent invoke.

Deliberately unchanged

  • A paused agent can still be replayed, and a failed replay still does not trip the circuit breaker. Replay remains a DM audit action; only the spending loophole is closed. The existing test that asserted replays are free was updated to assert they are charged.
  • Dry replays (no model) call no provider and are never refused.

Contract changes for rpg-mcp-live

  • strategy_manage resolve_turn for a turn at or before the last resolved one returns error: true with lastResolvedTurn.
  • agent_manage replay with a model returns error: true when the agent's budget is exhausted, and otherwise increases tokensUsed.
  • Creating or generating a world past the campaign's tile budget returns an error naming the budget and current use.
  • Spell outcomes for a given encounter seed are now fixed. Nothing about the response shape changes.

Not changed

  • Token accounting still rolls back with the call: if an auto-invoke on next_turn succeeds and the enclosing call then fails, the provider was paid but tokensUsed is restored. Fixing that means writing outside the call's transaction, which cuts against the all-or-nothing rule, so it is left as a known gap.
  • Rests outside combat still use Math.random; there is no encounter seed to draw from.

Testing

  • New: tests/server/audit-followups.test.ts (seeded spells, turn resolution, world budget), budget cases in tests/agent/audit/replay.test.ts, a ladder caching test.
  • Spell tests that mocked Math.random now mock the encounter dice (CombatRNG.prototype.random).
  • Full suite locally: 2422 passed, 7 skipped, 3 failed. The 3 are tests/server/websocket.test.ts, which cannot bind :: in the sandbox this ran in; they pass in CI.

Note on history

The branch could not be force-pushed after the earlier PRs were squash-merged, so their history is recorded with an ours merge that leaves the tree unchanged. The diff against main is only this change.

Generated by Claude Code

claude added 28 commits November 9, 2026 20:42
@claude
fix(math): bound dice expressions so a roll cannot hang or exhaust th…
970de09 
…e server

An exploding one-sided die (1d1!) never stopped exploding, and dice counts
were unbounded, so one math_manage call could freeze or kill the process
for every campaign. Dice are now capped at 1000 dice of 1000 sides at every
parser, exploding dice need at least 2 sides, and exact distributions are
refused when too large to compute.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(server): stop a dead event subscriber from taking the server down
9f626b0 
subscribe_to_events left a callback pointing at the per-request HTTP
transport. The next combat event in any campaign made it reject with
'Not connected'; the unhandled rejection shut the process down, and the
shutdown path exited 0, so the host never restarted it.

- Crashes now exit 1; requested stops still exit 0.
- A subscriber whose connection is gone is dropped, not left to reject.
- Subscribers only receive events from their own campaign.
- On the stateless HTTP transport, where nothing can be pushed after the
  response, subscribe_to_events makes no subscription and points the
  caller at poll_events.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(combat): a refused move has no consequences, and damage never heals
8549668 
- Moves are validated (destination, path, remaining movement) before
  opportunity attacks resolve. A refused move used to cost the mover hit
  points and the attacker its reaction, then report success. It is now an
  error, so the call rolls back.
- Negative damage is rejected; it was subtracted as healing with no cap
  at max HP (a 7 HP goblin reached 107). Dice damage with a penalty
  floors at zero, and applyDamage/heal ignore negative amounts.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(deps): update MCP SDK to 1.32.2 for security advisories
e7269b7 
npm audit fix: clears the advisories in @modelcontextprotocol/sdk and its
transitive dependencies. The remaining zod advisory needs a breaking move
to zod 4 and is left for a separate change.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(combat): enforce turn order, reach and sane numbers on attacks
805fb10 
- An attack outside the attacker's turn now resolves as its reaction, one
  per round, and no longer spends its action. It used to be a warning
  only, so a combatant could attack any number of times off turn.
- A target must be within reach: 5ft for melee, or the new optional
  `range` (feet) for ranged and reach attacks. Checked only when both
  combatants have a position.
- Caller-supplied attackBonus, dc and damage are bounded (-20..30, 1..40,
  1000 damage), so one call can no longer decide the outcome.
- Opportunity attacks use the attacker's attack bonus and the mover's AC
  when known instead of deriving both from initiative.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(storage): never close a campaign database out from under a runnin…
2bdec30 
…g call

Pool eviction closed the least recently used handle even when a call was
mid-transaction on it, and DELETE /campaign did the same. Eviction now
skips handles that are in use, and erasure waits for the call in flight.
The pool cap can be set with RPG_MAX_OPEN_DATABASES (default 64).

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(world): scope the in-memory world cache to its campaign and bound it
18ed707 
Cached worlds were keyed by a guessable id alone and never evicted, so one
campaign could read another's world by id and memory grew for the life of
the process. Entries are now keyed by the verified tenant too, and the
cache keeps the most recently used worlds (RPG_MAX_CACHED_WORLDS, default
32); the rest are restored from their database snapshot on demand.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(storage): refuse a corrupted campaign database instead of replaci…
b9d509c 
…ng it

A hosted campaign that failed its integrity check was quarantined and
swapped for an empty database, so the game looked deleted and play
continued into a second file. Campaign databases now fail to open and the
files are left untouched. Local single-user databases keep the
quarantine-and-recreate behaviour.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(audit): keep only the newest audit rows per campaign
fe247eb 
audit_logs stored arguments and results for every tool call and was never
pruned. It now keeps the newest RPG_AUDIT_LOG_MAX_ROWS rows (default 5000).

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(transport): compare transport tokens in constant time
324368b 
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
chore: drop Node 18 from CI, quiet per-request startup logs, fix repo…
4e2847c 
… URLs

better-sqlite3 12 requires Node 20+, so CI no longer tests 18 and
package.json declares the engine. The HTTP transport builds a server per
request and logged tool registration every time; it now logs once.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
docs: correct tool and test counts
cb482a3 10BC8 
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(combat): accept range through the combat_action tool schema
aa81cf6 
The tool's outer input schema dropped the new range argument before it
reached the handler, so a ranged attack could not be made over MCP.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
chore: merge already-merged branch history so the branch fast-forwards
cbc9e67 
The earlier commits on this branch were squash-merged as #113. This merge
keeps the current tree exactly as it is; it only records that history so
the branch can be pushed without rewriting it.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(deps): upgrade zod 3 to 4 to clear the remaining security advisory
222867b 
npm audit reported a memory-exhaustion advisory fixed only in zod 4.

- z.record() takes an explicit key schema.
- Object defaults that relied on inner defaults use .prefault(), which
  parses the default as zod 3 did (zod 4's .default() returns it as is).
- UUID fields use z.guid() to keep zod 3's lenient matching.
- load_tool_schema's summarizer read zod 3 internals; it now reads zod 4
  definitions and produces byte-identical output for all 36 tools.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
chore: record already-merged branch history so the branch fast-forwards
e9d9b8e 
Tree unchanged. The earlier commits on this branch were squash-merged as
#113 and #114.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(magic): report the roll when a spell attack misses
cbfe6fe 
A missed spell attack returned a bare 'casts Fire Bolt!' with no attack
roll, no dice and no miss, so the caller could not tell a miss from a hit
for zero damage. It now uses the same formatter as a hit. The fire bolt
scaling test depended on three unseeded attacks all hitting and was
retried to hide that; it is now deterministic and the retry is gone.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(agent): close the replay model loophole and bound agent timeouts
95ed309 
- Live replay took its model straight from the caller, so it bypassed the
  no-pro-model rule that invoke enforces. It now refuses a pro variant
  before calling the provider.
- timeoutMs had no upper limit. The provider call runs inside the
  campaign's unit of work, holding its lock and an open transaction, so a
  huge timeout could stall a campaign. New and updated agents are capped
  at 120s; rows stored earlier are clamped when used.
- An abort that landed while reading the response body escaped as a bare
  AbortError and was recorded as a generic error; it is now a timeout.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
chore: record already-merged branch history so the branch fast-forwards
5b8b85f 
Tree unchanged. The earlier commits on this branch were squash-merged as
#113, #114 and #115.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(magic): roll each spell save once, with the right DC and caster a…
2843e72 
…bility

- Save-based spells were resolved twice: the resolver rolled a generic
  save and baked it into the damage, then every target rolled its own on
  top. Fireball did quarter damage to a target that saved whenever the
  hidden roll also passed, and a save-for-none spell could be cancelled
  for everyone before any target rolled. Targets now save once, against
  the dice as rolled.
- The handler's fallback save DC assumed Intelligence and +2 proficiency
  for every class and could be fractional; it now uses the caster's DC.
- Healing added the Wisdom modifier for every class; it now uses the
  caster's own spellcasting ability.
- A single-target spell could be aimed at any number of creatures.
- On a spell attack a natural 1 always misses and a natural 20 always hits.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(strategy): keep conquest inside the control scale and count each …
588c487 
…claimant once

- A lopsided victory left the conqueror with control in the tens of
  thousands (the scale is 0-100), and one that landed exactly on zero
  left the region with no owner. Conquest now always transfers the region
  with control between 10 and 100.
- A nation that claimed a region several times was entered once per claim:
  it could fight itself to farm control, and got extra rolls in a real
  contest. Claimants are now counted once.
- The result says who won the battle and who holds the region as separate
  fields instead of the processor sniffing the log text for 'conquered'.
- A nation can no longer propose an alliance with itself.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(storage): migrations no longer move parties, and apply all-or-not…
4a5d7d0 
…hing

- The backfill that gives legacy parties a map position ran on every
  database open, not just when the column was added. A party left off the
  map was moved to (50, 50) by the next restart, deploy or pool eviction.
- migrate() now runs in one transaction, so a failure part-way leaves the
  database as it was instead of half-migrated.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(world): bound the world cache by total tiles, not just world count
071357d 
A maximum-size world is about 100 MB in memory, so a cap of 32 worlds
could still exhaust the heap. The cache now also limits total tiles
(RPG_MAX_CACHED_WORLD_TILES, default 2,000,000) and always keeps the
world just created.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(rest): track hit dice, and restore spell slots on party long rests
a54208e 
- Hit dice were not tracked: a short rest could spend up to 20 dice, as
  often as you liked, for free unlimited healing, always on a d8. A
  character now has one hit die per level in resourcePools.hit_dice, of
  its class's size; spent dice stay spent, and a long rest returns half.
- travel_manage's party long rest restored hit points only, leaving
  casters without their spell slots. It now does what rest_manage does.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
chore: record already-merged branch history so the branch fast-forwards
0fa9958 
Tree unchanged. The earlier commits on this branch were squash-merged as
#113 to #116.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix: seed spell rolls, resolve each strategy turn once, cap world siz…
6441de3 
…e per campaign

- Spell damage, healing, attack and save rolls (and death saves) used
  Math.random. They now come from the encounter's seeded dice, so a spell
  is as reproducible as a weapon attack and rewinds with a rolled-back call.
- resolve_turn took the turn number from the caller and could be run twice
  for the same turn, applying the economy and every conflict again. The
  last resolved turn is now stored per world; that turn or an earlier one
  is refused.
- Every world keeps a tile snapshot (about 26 MB at 1000x1000) and nothing
  limited how many a campaign holds. A campaign now has a world size
  budget (RPG_MAX_WORLD_TILES_PER_CAMPAIGN, default 10,000,000 tiles).

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
fix(agent): charge live replays to the token budget
d81e88d 
A live replay is a real provider call but was never counted, so a
budget-exhausted agent could keep spending through it. Replays now add
their tokens to the agent's usage and are refused once the budget is gone.
A paused agent can still be replayed and a failed replay still does not
trip the circuit breaker; dry replays are unaffected.

Also reads the competency ladder file once instead of on every invoke.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@claude
chore: record already-merged branch history so the branch fast-forwards
8000
3af065f 
Tree unchanged. The earlier commits on this branch were squash-merged as
#113 to #117.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013FWeViVwVRAxVuCWaf7UQS
@coderabbitai
coderabbitai Bot commented Nov 10, 2026 •
edited
Loading
Copy link
Copy Markdown

Explain Change →

Caution

Review failed

The pull request is closed.

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@Mnehmos
Mnehmos marked this pull request as ready for review November 10, 2026 15:33
@Mnehmos
Mnehmos merged commit dbac817 into main Nov 10, 2026
4 checks passed
@chatgpt-codex-connector
chatgpt-codex-connector Bot commented Nov 10, 2026 •
edited
Loading
Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-10T15:35:07.046705Z 3af065f Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Mnehmos @claude
0