Skip to content

Support configured web deployment targets - #125

Merged
imjlk merged 35 commits into
mainfrom
codex/generic-web-target
Aug 3, 2026
Merged

imjlk merged 35 commits into
mainfrom
codex/generic-web-target

Conversation

@imjlk

@imjlk imjlk commented Aug 2, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • accept exact game-owned kind: "web" target names in CLI build and matrix commands
  • load additive game-owned target configuration extensions without allowing built-in target replacement
  • support game-owned monetization identifiers for custom deployment targets
  • compose optional static web overlays and permit explicitly non-installable browser artifacts
  • bind extension content to effective configuration and release provenance

Why

Independent browser deployments can require distinct runtime policies and release artifacts while still sharing the standard web builder. Keeping those names and files game-owned avoids adding deployment-specific concepts to the public target matrix.

Validation

  • mise exec -- pnpm check
  • mise exec -- pnpm test
  • SAMPO_RELEASE_BRANCH=main mise exec -- pnpm sampo:release:dry-run
  • OCR review for every commit; all high/medium findings fixed and follow-up reviews returned no comments

Summary by CodeRabbit

  • New Features

    • Added support for game-owned web targets across build and CLI workflows.
    • Web targets can include custom static files and configure installable or non-installable artifacts.
    • Added extensible target configuration with custom monetization identifiers and deployment mappings.
    • Added authoritative purchase and rewarded-ad verification for custom deployment targets.
    • Added runtime target configuration support for starter projects.
  • Bug Fixes

    • Improved validation for unsupported targets, unsafe paths, invalid identifiers, and web artifacts.
    • Improved web manifest, favicon, and icon evidence handling.
  • Documentation

    • Documented configured web targets, configuration extensions, and custom browser deployment options.

@coderabbitai

coderabbitai Bot commented Aug 2, 2026 •

Copy link
Copy Markdown

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: dbfd735f-c1b6-4a7c-968c-204dd68ed945

📥 Commits

Reviewing files that changed from the base of the PR and between fe95d9a and 163b964.

📒 Files selected for processing (10)
  • apps/game-services-worker/src/handler.ts
  • apps/game-services-worker/src/index.test.ts
  • packages/catalog/src/index.test.ts
  • packages/catalog/src/index.ts
  • packages/cli/src/production-target-readiness.ts
  • tools/icons/icons.test.ts
  • tools/icons/staging.ts
  • tools/smoke/production-target-readiness.ts
  • tools/target/web-artifact.test.ts
  • tools/target/web-artifact.ts
🚧 Files skipped from review as they are similar to previous changes (6)
  • packages/catalog/src/index.test.ts
  • packages/cli/src/production-target-readiness.ts
  • tools/icons/icons.test.ts
  • tools/smoke/production-target-readiness.ts
  • tools/icons/staging.ts
  • tools/target/web-artifact.test.ts

📝 Walkthrough

Walkthrough

The PR adds additive custom target configuration, configurable web artifacts, runtime matrix injection, target-specific catalog mappings, deployment-aware game services, and validation coverage.

Changes

Configured Web Targets

Layer / File(s) Summary
Target configuration and CLI resolution
tools/target/target-config-matrix.ts, packages/cli/src/*, tools/smoke/cli-configured-web-targets.ts
The loader validates custom target extensions and runtime policies. The CLI normalizes aliases, preserves configured web targets, validates names, and propagates extension files.
Runtime matrix injection
examples/phaser-starter/vite*, packages/cli/templates/phaser-game/vite*
The example and template load and validate optional runtime matrices and expose them through __MPGD_TARGET_CONFIG_MATRIX__.
Web artifact configuration and build
tools/target/*, tools/icons/*, tools/smoke/verify-target-artifacts*
Web targets support installable and staticDir. Builds validate paths, copy static files, sanitize artifacts, stage icon evidence, and validate finalized outputs.
Custom target mappings
packages/catalog/*, packages/target-config/*, adapters/verse8/*, examples/*/buildGateways/*
Catalog and effective configuration resolve product and ad identifiers for arbitrary targets. Verse8 uses configured target mappings.
Deployment-aware game services
packages/game-services/*, apps/game-services-worker/*, examples/*/gameServices.ts
Clients and workers propagate deployment targets. Backends bind and validate targets, resolve target-specific identifiers, and persist deployment targets in retry and ledger data.
Validation and release support
tools/smoke/*, tools/validate-*.ts, tools/target/web-artifact.test.ts, tools/icons/icons.test.ts, package.json, .sampo/*
Tests cover target extensions, artifact policies, PWA overlays, readiness rules, identifier validation, and starter synchronization.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

Poem

A rabbit checks each target path,
Static files join the artifact.
Custom IDs guide each call,
Deployment bindings guard them all.
Matrices merge and tests run bright—
Web targets hop into the light.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the main change: support for configured web deployment targets.
Description check ✅ Passed The description includes the required Summary and Validation sections and explains the purpose, scope, and validation performed.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/generic-web-target

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@imjlk
imjlk marked this pull request as ready for review August 2, 2026 03:31
@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 2, 2026 •

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (1)
tools/target/target-config-matrix.ts (1)

10-19: 🗄️ Data Integrity & Integration | 🔵 Trivial | 💤 Low value

Share MPGD_TARGET_CONFIG_EXTENSIONS_FILE from one source of truth. tools/target/target-config-matrix.ts declares targetConfigExtensionsFileEnv, but packages/cli/src/index.ts and tools/target/build-target.ts still repeat the literal. Replace those literals with an importable constant, or centralize the env-var name behind a public API that the CLI can use.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/target/target-config-matrix.ts` around lines 10 - 19, Centralize the
MPGD_TARGET_CONFIG_EXTENSIONS_FILE environment-variable name by exposing and
reusing targetConfigExtensionsFileEnv from target-config-matrix.ts. Update
packages/cli/src/index.ts and the corresponding usage in
tools/target/build-target.ts to import and use that shared constant instead of
repeating the literal; no direct change is required at the declaration site
beyond making it publicly importable if needed.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/target/build-target.ts`:
- Around line 159-165: The build path around staticDir handling must enforce
installable:false in the final artifact by preventing or removing any
manifest.webmanifest and manual manifest link, including files pre-existing in
output and introduced by copyDirectoryContents. Update the relevant staging/copy
flow to ensure these artifacts fail the build or are removed, and add a
build-path test covering both a pre-existing manifest and a staticDir overlay
when installable is false.

In `@tools/target/platform-targets.ts`:
- Around line 98-99: Update validatePlatformTargetsFile to reject blank
staticDir values before resolving the path, rather than relying on
assertOptionalString, while continuing to allow the property to be omitted.
Apply the same validation in the corresponding target-validation branch
referenced by the additional location, and preserve existing behavior for
non-empty paths.

In `@tools/target/validate-platform-targets.ts`:
- Around line 30-36: Update the web-target validation around target.staticDir to
use statSync(resolvePath(target.staticDir)).isDirectory() alongside the existing
existence check. Reject regular files with the current validation error before
copyDirectoryContents runs, while preserving valid directory handling.

---

Nitpick comments:
In `@tools/target/target-config-matrix.ts`:
- Around line 10-19: Centralize the MPGD_TARGET_CONFIG_EXTENSIONS_FILE
environment-variable name by exposing and reusing targetConfigExtensionsFileEnv
from target-config-matrix.ts. Update packages/cli/src/index.ts and the
corresponding usage in tools/target/build-target.ts to import and use that
shared constant instead of repeating the literal; no direct change is required
at the declaration site beyond making it publicly importable if needed.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2d16c5ae-9c8d-4fc4-b4e2-89a29ee08f22

📥 Commits

Reviewing files that changed from the base of the PR and between 0e23de1 and 8711f8b.

📒 Files selected for processing (23)
  • .sampo/changesets/configured-web-targets.md
  • docs/GAME_DEVELOPMENT.md
  • package.json
  • packages/catalog/src/index.test.ts
  • packages/catalog/src/index.ts
  • packages/cli/src/build-targets.ts
  • packages/cli/src/index.ts
  • packages/target-config/src/effective.ts
  • packages/target-config/test/target-config-smoke.ts
  • tools/icons/icons.test.ts
  • tools/icons/staging.ts
  • tools/smoke/cli-configured-web-targets.ts
  • tools/smoke/target-config-extensions.ts
  • tools/target/build-target.ts
  • tools/target/effective-config.ts
  • tools/target/generate-release-manifest.ts
  • tools/target/platform-targets.ts
  • tools/target/schemas.ts
  • tools/target/target-config-matrix.ts
  • tools/target/validate-platform-targets.ts
  • tools/validate-ad-placements.ts
  • tools/validate-product-catalog.ts
  • tools/validate-target-config.ts
💤 Files with no reviewable changes (1)
  • packages/target-config/src/effective.ts

Comment thread tools/target/build-target.ts Resolved
Comment thread tools/target/platform-targets.ts Resolved

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8711f8b852

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread tools/icons/staging.ts Resolved
Comment thread tools/target/target-config-matrix.ts Resolved
Comment thread tools/target/build-target.ts Resolved
Comment thread tools/target/build-target.ts Resolved
Comment thread packages/cli/src/build-targets.ts Resolved
@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@coderabbitai

coderabbitai Bot commented Aug 2, 2026 •

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 136e7dd21c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread tools/target/web-artifact.ts Resolved
Comment thread tools/target/build-target.ts Resolved
Comment thread packages/cli/src/build-targets.ts Resolved
Comment thread tools/target/target-config-matrix.ts Resolved
@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@coderabbitai

coderabbitai Bot commented Aug 2, 2026 •

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
tools/target/platform-targets.ts (1)

72-77: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Remove the unused helper.

appTargetForPlatformTarget has no caller, so keep this change scoped to the existing validation paths or wire the app-directory logic into the callers before exporting the helper.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/target/platform-targets.ts` around lines 72 - 77, Remove the unused
appTargetForPlatformTarget helper and its export, since it has no callers. Keep
the change limited to removing this dead code; do not add new call sites or
alter the existing validation paths.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@examples/phaser-starter/vite.shared.ts`:
- Around line 81-93: The readRuntimeTargetConfigMatrix functions accept
unvalidated JSON and must validate the parsed value with
assertTargetConfigMatrix before returning it. Apply this change in
examples/phaser-starter/vite.shared.ts and
packages/cli/templates/phaser-game/vite.shared.ts at the indicated ranges,
preserving the existing empty-input handling and parse-error wrapping.

---

Nitpick comments:
In `@tools/target/platform-targets.ts`:
- Around line 72-77: Remove the unused appTargetForPlatformTarget helper and its
export, since it has no callers. Keep the change limited to removing this dead
code; do not add new call sites or alter the existing validation paths.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 61322f1e-e9fd-4893-b0c3-0055c74f7c7d

📥 Commits

Reviewing files that changed from the base of the PR and between 8711f8b and 0da769e.

📒 Files selected for processing (23)
  • .sampo/changesets/configured-web-targets.md
  • examples/phaser-starter/src/env.d.ts
  • examples/phaser-starter/src/platform/installStarterPlatform.ts
  • examples/phaser-starter/vite.shared.ts
  • package.json
  • packages/cli/src/build-targets.ts
  • packages/cli/src/index.ts
  • packages/cli/src/target-config-env.ts
  • packages/cli/src/target-name.ts
  • packages/cli/templates/phaser-game/src/env.d.ts
  • packages/cli/templates/phaser-game/src/platform/installPlatform.ts
  • packages/cli/templates/phaser-game/vite.shared.ts
  • tools/icons/icons.test.ts
  • tools/icons/staging.ts
  • tools/smoke/cli-configured-web-targets.ts
  • tools/smoke/target-config-extensions.ts
  • tools/target/build-target.ts
  • tools/target/effective-config.ts
  • tools/target/platform-targets.ts
  • tools/target/target-config-matrix.ts
  • tools/target/validate-platform-targets.ts
  • tools/target/web-artifact.test.ts
  • tools/target/web-artifact.ts
🚧 Files skipped from review as they are similar to previous changes (9)
  • tools/target/validate-platform-targets.ts
  • tools/target/target-config-matrix.ts
  • tools/target/effective-config.ts
  • tools/icons/staging.ts
  • tools/icons/icons.test.ts
  • .sampo/changesets/configured-web-targets.md
  • tools/smoke/cli-configured-web-targets.ts
  • package.json
  • packages/cli/src/build-targets.ts

Comment thread examples/phaser-starter/vite.shared.ts Resolved

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0da769e0bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread tools/target/build-target.ts Resolved
Comment thread packages/cli/src/build-targets.ts Resolved
Comment thread packages/catalog/src/index.ts Resolved
@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

Verified the appTargetForPlatformTarget helper is used by tools/target/build-target.ts and tools/smoke/target-config-extensions.ts, so it is intentionally retained.

@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@coderabbitai

coderabbitai Bot commented Aug 2, 2026 •

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f229bd3011

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/catalog/src/index.ts Resolved
Comment thread packages/target-config/src/effective.ts Resolved
Comment thread tools/icons/staging.ts Resolved
Comment thread tools/target/target-config-matrix.ts Resolved
@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@coderabbitai

coderabbitai Bot commented Aug 2, 2026 •

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d5b499cfb3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread tools/target/build-target.ts Resolved
Comment thread tools/target/build-target.ts Resolved
Comment thread tools/target/build-target.ts Resolved
Comment thread packages/cli/src/target-name.ts Resolved
Comment thread tools/icons/profiles.ts Resolved
@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@coderabbitai

coderabbitai Bot commented Aug 2, 2026 •

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e3045f4fa3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread tools/icons/staging.ts Resolved
@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@imjlk

imjlk commented Aug 2, 2026

Copy link
Copy Markdown
Owner Author

@codex review

imjlk commented Aug 3, 2026

Copy link
Copy Markdown
Owner Author

@codex review

Please re-review the current head 0cb30ff. The four findings from the review of 7662ada have been addressed with focused regressions. pnpm check, the full pnpm test suite, and SAMPO_RELEASE_BRANCH=main pnpm sampo:release:dry-run all pass.

imjlk commented Aug 3, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review

Please re-review the current head 0cb30ff. The latest Codex findings have been addressed with focused regressions, and pnpm check, the full pnpm test suite, and the Sampo release dry-run all pass.

@coderabbitai

coderabbitai Bot commented Aug 3, 2026 •

Copy link
Copy Markdown

@imjlk I will review the current head 0cb30ff and the related regression coverage.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
packages/game-services/src/types.ts (1)

317-346: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Block prototype keys for catalog target lookups.

resolveProductPlatformId indexes product.platformProductIds[target], so values like constructor can match inherited object properties instead of configured product IDs. Add those keys to reservedDeploymentTargetNames or make the target lookup use own-property checks / a Map.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/game-services/src/types.ts` around lines 317 - 346, Update
deployment target validation and lookup behavior around
assertOptionalDeploymentTarget and resolveProductPlatformId so prototype keys
such as constructor and prototype cannot resolve as configured catalog targets.
Prefer an own-property check for product.platformProductIds or reserve every
relevant prototype key in reservedDeploymentTargetNames, while preserving valid
configured target lookups.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/target/web-artifact.ts`:
- Around line 462-494: Update the implicit-head-close logic in scanHtmlHead so
disallowed start tags also close an explicitly opened head: apply the
implicitHeadElementNames check whenever implicitHeadClosed is false, regardless
of inHead, and set inHead = false when closing it. Preserve existing handling
for allowed head elements and already-closed heads.

---

Outside diff comments:
In `@packages/game-services/src/types.ts`:
- Around line 317-346: Update deployment target validation and lookup behavior
around assertOptionalDeploymentTarget and resolveProductPlatformId so prototype
keys such as constructor and prototype cannot resolve as configured catalog
targets. Prefer an own-property check for product.platformProductIds or reserve
every relevant prototype key in reservedDeploymentTargetNames, while preserving
valid configured target lookups.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c9e07e9e-95d2-4a60-a832-97630d6c53ec

📥 Commits

Reviewing files that changed from the base of the PR and between 0a551fb and 0cb30ff.

📒 Files selected for processing (11)
  • .sampo/changesets/configured-web-targets.md
  • packages/game-services/src/client.test.ts
  • packages/game-services/src/client.ts
  • packages/game-services/src/server.test.ts
  • packages/game-services/src/server.ts
  • packages/game-services/src/types.ts
  • tools/icons/icons.test.ts
  • tools/icons/staging.ts
  • tools/target/build-target.ts
  • tools/target/web-artifact.test.ts
  • tools/target/web-artifact.ts
🚧 Files skipped from review as they are similar to previous changes (8)
  • packages/game-services/src/client.ts
  • packages/game-services/src/client.test.ts
  • packages/game-services/src/server.test.ts
  • tools/icons/icons.test.ts
  • tools/icons/staging.ts
  • packages/game-services/src/server.ts
  • .sampo/changesets/configured-web-targets.md
  • tools/target/web-artifact.test.ts

Comment thread tools/target/web-artifact.ts Resolved

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0cb30ffc92

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread tools/target/web-artifact.ts Resolved
Comment thread tools/target/web-artifact.ts Resolved
Comment thread tools/target/web-artifact.ts Resolved
Comment thread tools/target/web-artifact.ts Resolved
Comment thread tools/target/target-config-matrix.ts Resolved

imjlk commented Aug 3, 2026

Copy link
Copy Markdown
Owner Author

@codex review

Please re-review the current head 8cb7358. All six inline findings on 0cb30ff have been addressed with focused regressions. pnpm check, the full pnpm test suite, and SAMPO_RELEASE_BRANCH=main pnpm sampo:release:dry-run all pass.

imjlk commented Aug 3, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review

Please re-review the current head 8cb7358. The inline unclosed-head finding is fixed, and the outside-diff prototype-key finding is also addressed: catalog product and placement resolvers now require an own property before reading a target ID, with regressions for inherited constructor. pnpm check, the full pnpm test suite, and the Sampo release dry-run all pass.

@coderabbitai

coderabbitai Bot commented Aug 3, 2026 •

Copy link
Copy Markdown

@imjlk I will re-review the current head 8cb7358. I will verify the unclosed-head fix, the own-property checks in the catalog resolvers, and the related regression coverage.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8cb7358874

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread tools/target/web-artifact.ts Resolved
Comment thread tools/target/web-artifact.ts Resolved
Comment thread packages/game-services/src/server.ts Resolved

imjlk commented Aug 3, 2026

Copy link
Copy Markdown
Owner Author

@codex review

Please review the current head (fe95d9a), including the server-side deployment-target binding, protected static-directory validation, exact raw-text closing-tag handling, and the Verse8 CI environment fix.

imjlk commented Aug 3, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review

Please review the current head (fe95d9a), including the server-side deployment-target binding, protected static-directory validation, exact raw-text closing-tag handling, and the Verse8 CI environment fix.

@coderabbitai

coderabbitai Bot commented Aug 3, 2026 •

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '=== Current head and changed files ==='
git rev-parse --short HEAD
git diff --name-status HEAD^ HEAD
git diff --stat HEAD^ HEAD

echo '=== Relevant files ==='
fd -t f . \
  | rg '(^|/)(server(\.test)?|web-artifact(\.test)?|agent8(\.test)?|.*verse8.*|.*workflow.*)\.(ts|ya?ml)$' \
  || true

echo '=== Source outlines ==='
for f in \
  packages/game-services/src/server.ts \
  packages/game-services/src/server.test.ts \
  tools/target/web-artifact.ts \
  tools/target/web-artifact.test.ts \
  adapters/verse8/src/agent8.ts \
  adapters/verse8/src/agent8.test.ts
do
  if [ -f "$f" ]; then
    echo "--- $f ---"
    ast-grep outline "$f" --items all || true
  fi
done

echo '=== Focused diff ==='
git diff --find-renames --find-copies HEAD^ HEAD -- \
  packages/game-services/src/server.ts \
  packages/game-services/src/server.test.ts \
  tools/target/web-artifact.ts \
  tools/target/web-artifact.test.ts \
  adapters/verse8 \
  .github \
  | sed -n '1,2600p'

Length of output: 43920


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '=== Server binding and target resolution ==='
sed -n '315,405p' packages/game-services/src/server.ts
sed -n '550,640p' packages/game-services/src/server.ts
sed -n '640,750p' packages/game-services/src/server.ts
sed -n '940,1045p' packages/game-services/src/server.ts
sed -n '1,150p' packages/game-services/src/types.ts

echo '=== Backend construction call sites ==='
rg -n -C 4 'createGameServicesBackend\s*\(|deploymentTargetBindings|deploymentTarget:' \
  --glob '*.ts' \
  packages adapters examples tools \
  | sed -n '1,1800p'

echo '=== Static-directory and protected-output logic ==='
sed -n '140,230p' tools/target/web-artifact.ts
sed -n '580,820p' tools/target/web-artifact.ts
sed -n '1,130p' tools/target/validate-platform-targets.ts
sed -n '1,180p' tools/target/platform-targets.ts
sed -n '360,430p' tools/target/web-artifact.test.ts

echo '=== HTML head scanner ==='
sed -n '250,430p' tools/target/web-artifact.ts
sed -n '430,590p' tools/target/web-artifact.ts

echo '=== Verse8 CI job context ==='
sed -n '55,110p' .github/workflows/ci.yml
rg -n -C 4 'VITE_MPGD_GAME_SERVICES_URL|smoke:target verse8|verse8-agent8' \
  package.json .github tools adapters packages examples \
  | sed -n '1,1000p'

Length of output: 107815


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '=== Build preflight and static-overlay paths ==='
rg -n -C 5 \
  'validatePlatformTargetsFile\s*\(|assertDisjointWebTargetOutputs\s*\(|assertWebStaticDirectory\s*\(|copyWebStaticDirectoryContents\s*\(' \
  tools packages \
  --glob '*.ts' \
  | sed -n '1,1800p'

echo '=== Deployment-target validation ==='
rg -n -C 5 \
  'function assertGameServicesDeploymentTarget|assertGameServicesDeploymentTarget\s*=|assertOptionalGameServicesDeploymentTarget|assertDeploymentTargetName' \
  packages/game-services/src packages/cli/src \
  --glob '*.ts' \
  | sed -n '1,900p'

echo '=== Focused server fixtures and assertions ==='
sed -n '15,115p' packages/game-services/src/server.test.ts
sed -n '240,415p' packages/game-services/src/server.test.ts
sed -n '315,425p' tools/target/build-target.ts
sed -n '1,210p' tools/target/web-artifact.test.ts

echo '=== Verse8 target configuration ==='
rg -n -C 5 '"verse8"|verse8' \
  examples/phaser-starter/mpgd.targets.json \
  packages/target-config/targets.json \
  | sed -n '1,600p'

echo '=== Full current commit patch ==='
git show --format=fuller --find-renames --find-copies --stat --patch HEAD \
  | sed -n '1,3600p'

Length of output: 76517


@imjlk I reviewed head fe95d9a.

I found no actionable issues in the requested areas.

  • The backend binds deployment targets before product or placement ID resolution, evidence verification, retry matching, and ledger storage.
  • The tests cover omitted client targets and reject conflicting client targets for Android purchases and Verse8 rewards.
  • Static directories cannot overlap Vite outputs or protected generated outputs. The build path also applies the checks.
  • Raw-text parsing now ignores lookalike </scriptx>, </stylex>, and </titlex> text.
  • The Verse8 build step receives VITE_MPGD_GAME_SERVICES_URL at the command that consumes it.
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/cli/src/production-target-readiness.ts`:
- Around line 64-70: Update the ownerPathKey === undefined branch in the
production-target readiness validation to reject configurations where
requiresVerse8RewardAuthority is true and authoritativeGameServices is
explicitly false before calling assertAuthoritativeGameServicesUrl or returning.
Preserve the existing URL validation for other configurations and ensure the
explicit non-authoritative flag cannot bypass the rewarded-ad requirement.
- Around line 17-27: Update assertProductionTargetReadiness to reject production
reads for Verse8 targets when targetPolicy is absent, ensuring the validation
cannot bypass readTargets and assertAuthoritativeGameServicesUrl through an
undefined ownerPathKey. Apply the requirement to all non-built-in
ait/android/ios owner-path targets while preserving existing behavior for
built-in targets.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b1e6a041-5f97-4a1b-a2f1-4388f2fe0090

📥 Commits

Reviewing files that changed from the base of the PR and between 0cb30ff and fe95d9a.

📒 Files selected for processing (11)
  • .github/workflows/ci.yml
  • packages/catalog/src/index.test.ts
  • packages/catalog/src/index.ts
  • packages/cli/src/production-target-readiness.ts
  • packages/game-services/src/server.test.ts
  • packages/game-services/src/server.ts
  • packages/game-services/src/types.ts
  • tools/smoke/production-target-readiness.ts
  • tools/target/build-target.ts
  • tools/target/web-artifact.test.ts
  • tools/target/web-artifact.ts
🚧 Files skipped from review as they are similar to previous changes (3)
  • packages/catalog/src/index.test.ts
  • packages/game-services/src/types.ts
  • tools/target/web-artifact.ts

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fe95d9a5d0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread tools/target/web-artifact.ts Resolved
Comment thread packages/game-services/src/server.ts Resolved
Comment thread tools/target/web-artifact.ts Resolved
Comment thread tools/target/web-artifact.ts Resolved
Comment thread tools/icons/staging.ts Resolved
Comment thread packages/catalog/src/index.ts Resolved
Comment thread tools/target/web-artifact.ts Resolved

imjlk commented Aug 3, 2026

Copy link
Copy Markdown
Owner Author

@codex review

Please re-review the current head (163b964). The latest patch addresses all nine actionable threads with focused regressions. Local validation passed: pnpm check, full pnpm test, the Sampo release dry-run, and the production Verse8 build.

imjlk commented Aug 3, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review

Please re-review the current head (163b964). The latest patch addresses all nine actionable threads with focused regressions. Local validation passed: pnpm check, full pnpm test, the Sampo release dry-run, and the production Verse8 build.

@coderabbitai

coderabbitai Bot commented Aug 3, 2026 •

Copy link
Copy Markdown

@imjlk I will review the current head 163b964, including the latest patch and its regression coverage.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 163b96498b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

imjlk commented Aug 3, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review

Please retry the final review of the current head (163b964) now that the previously reported review-limit window has elapsed. All review threads remain resolved, Codex found no major issues on this head, and the required CI matrix is still running.

@coderabbitai

coderabbitai Bot commented Aug 3, 2026 •

Copy link
Copy Markdown

@imjlk I will review the current head 163b964. I will assess the current diff and the resolved regression paths.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@imjlk
imjlk merged commit 3938b2f into main Aug 3, 2026
6 checks passed
@imjlk
imjlk deleted the codex/generic-web-target branch October 27, 2026 11:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant