daddy
8822a03f53
Implements the DSL that docs/architecture/scripting_sandbox.md recommends
as the primary (and, for now, sufficient) approach in place of running
untrusted GDScript in-process: a fixed set of trigger/condition/action
verbs, expressed as plain JSON data, interpreted by trusted GDScript with
zero ability to reference engine singletons, call arbitrary methods, or
execute code.
- ScriptBehavior (scripts/scripting/script_behavior.gd): parses and
validates rules from JSON/Dictionary data. Every trigger, condition
type/op, and verb is checked against an explicit whitelist at parse
time; malformed or unknown entries are dropped and recorded in
rejected_rules, never partially executed. Carries an optional
content_flags passthrough so this data type isn't hostile to future
moderation-queue integration (docs/architecture/content_moderation.md).
- ScriptInterpreterNode (scripts/scripting/script_interpreter.gd): the
only code that executes rules. Triggers: on_interact (proximity +
"interact" input action), on_enter (edge-triggered Area3D overlap),
on_touch (continuous overlap), on_timer (physics-clocked Timer). Verbs:
give_item, play_sound, move, rotate, spawn_from_catalog, set_timer --
each a fixed, hand-written function; verb dispatch is an explicit
match(), never call()-by-name from data. move/rotate animate via Tween
rather than teleporting.
- PlayerInventory (scripts/scripting/player_inventory.gd): a small
per-player item-count stub for give_item to target, since no real
inventory/entity-state system exists yet (M9 Economy). Attached to
scenes/player.tscn as "Inventory".
- SpawnCatalog (scripts/scripting/spawn_catalog.gd): trusted catalog_id ->
asset_id lookup for spawn_from_catalog, mirroring the AvatarCatalog
data-driven-JSON convention. Rule data only ever supplies a catalog_id
key, never a resource path.
- Wired a real demo ("ScriptedChest") into scenes/worlds/test_level.tscn
with an on_interact rule (give_item + play_sound + rotate), plus an
"interact" input action (project.godot).
- scripts/smoke_test_script_behavior.gd: exercises every trigger type,
every verb, and every condition type against the real interpreter and
the wired demo scene, and proves unknown/malformed/unsafe rules
(unknown verb, unknown trigger, non-scalar smuggled arguments, etc.)
are rejected at parse time and never run -- 50/50 checks pass.
37 lines
1.1 KiB
Plaintext
37 lines
1.1 KiB
Plaintext
[gd_scene load_steps=5 format=3 uid="uid://player_scene_001"]
|
|
|
|
[ext_resource type="Script" path="res://scripts/player.gd" id="1_player"]
|
|
[ext_resource type="Script" path="res://scripts/scripting/player_inventory.gd" id="2_inventory"]
|
|
|
|
[sub_resource type="CapsuleMesh" id="CapsuleMesh1"]
|
|
radius = 0.35
|
|
height = 1.6
|
|
|
|
[sub_resource type="CapsuleShape3D" id="CapsuleShape1"]
|
|
radius = 0.35
|
|
height = 1.6
|
|
|
|
[node name="Player" type="CharacterBody3D"]
|
|
collision_layer = 2
|
|
collision_mask = 1
|
|
script = ExtResource("1_player")
|
|
|
|
[node name="CollisionShape3D" type="CollisionShape3D" parent="."]
|
|
shape = SubResource("CapsuleShape1")
|
|
|
|
[node name="CapsuleMesh" type="MeshInstance3D" parent="."]
|
|
mesh = SubResource("CapsuleMesh1")
|
|
|
|
[node name="CameraPivot" type="Node3D" parent="."]
|
|
transform = Transform3D(1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1.2, 0)
|
|
|
|
[node name="SpringArm3D" type="SpringArm3D" parent="CameraPivot"]
|
|
spring_length = 3.5
|
|
margin = 0.2
|
|
|
|
[node name="Camera3D" type="Camera3D" parent="CameraPivot/SpringArm3D"]
|
|
current = true
|
|
|
|
[node name="Inventory" type="Node" parent="."]
|
|
script = ExtResource("2_inventory")
|