From 8e1238c316f3eced7b1d301d6d242efacfb73b70 Mon Sep 17 00:00:00 2001 From: Phillip Tarrant Date: Sun, 12 Jul 2026 18:47:19 -0500 Subject: [PATCH] fix(currency): cap repeated currency move tags at one per reply MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TagExtractor collects every [MOVE:] tag occurrence with no dedupe, and MoveValidator is a pure membership test against available_moves, so N copies of one legal move all pass validation. MoveApplier then looped and applied every copy. A model could therefore pick an arbitrary amount of money in unary by repeating one tag: [MOVE: accept_item(copper)] x47 against a 47c purse drains it to 0; [MOVE: give_item(gold)] x10 mints +100,000c. The eight-move vocabulary (§6) takes no quantity argument precisely so the AI cannot choose a number — this closed that gap by another door and was a §2 breach (AI owns text, never state). MoveApplier.apply() now tracks currency moves (give_item/accept_item on a denomination) already applied within one call, keyed on name+denom, and skips repeats. Non-currency moves are untouched — repeated give_item(amulet) still yields multiple copies, which stays bounded by the pre-existing cross-reply gifts_given gate and is a separate, already-reported issue. move_validator.gd and tag_extractor.gd are untouched. Also adds the Finding-2 test the currency spec (§7) named but never delivered: after GameState.grant("gold", 1), inventory stays empty, so accept_item(gold) in available_moves comes only from the affordability loop, never double-offered via the inventory.keys() loop. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01QYa9u7Kdxv5gX4AnwWexy8 --- client/scripts/npc/move_applier.gd | 11 +++++ client/tests/unit/test_move_applier.gd | 57 ++++++++++++++++++++++++++ client/tests/unit/test_npc_content.gd | 15 +++++++ 3 files changed, 83 insertions(+) diff --git a/client/scripts/npc/move_applier.gd b/client/scripts/npc/move_applier.gd index 5b22c64..d9e87f6 100644 --- a/client/scripts/npc/move_applier.gd +++ b/client/scripts/npc/move_applier.gd @@ -11,9 +11,20 @@ const HOSTILE_FLOOR := -100 static func apply(moves: Array, game_state, canon_log, content_db, npc_id: String) -> void: + # A currency move (give_item/accept_item on a denomination) applies AT MOST + # ONCE per reply. Without this, a model repeating one tag N times would pick + # an arbitrary amount in unary — the AI choosing a number is a §2 breach. + # Real-item duplicates are unaffected; that stays bounded by gifts_given. + var currency_applied_this_reply := {} # "name(denom)" -> true for move in moves: var name: String = move.get("name", "") var args: Array = move.get("args", []) + if name in ["give_item", "accept_item"] and not args.is_empty() \ + and Currency.is_currency(str(args[0])): + var currency_key := "%s(%s)" % [name, str(args[0])] + if currency_applied_this_reply.has(currency_key): + continue + currency_applied_this_reply[currency_key] = true match name: "offer_quest": var q: String = str(args[0]) diff --git a/client/tests/unit/test_move_applier.gd b/client/tests/unit/test_move_applier.gd index 3fd940e..542c18c 100644 --- a/client/tests/unit/test_move_applier.gd +++ b/client/tests/unit/test_move_applier.gd @@ -84,3 +84,60 @@ func test_refuse_and_end_are_noops(): var gs = GameState.new() MoveApplier.apply([_m("refuse"), _m("end_conversation")], gs, CanonLog.new(), _content(), "fenn") assert_eq(gs.npc_dispositions.size(), 0) + + +# --- Finding 1: a repeated currency move tag in ONE reply must not let the AI +# pick an arbitrary amount by unary repetition (§2 breach). A currency move +# (give_item/accept_item on a denomination) applies AT MOST ONCE per apply() +# call, keyed on move name + denomination. + +func test_repeated_accept_item_silver_applies_once(): + var gs = GameState.new() + gs.purse_copper = 10000 + MoveApplier.apply([_m("accept_item", ["silver"]), _m("accept_item", ["silver"])], + gs, CanonLog.new(), _content(), "fenn") + assert_eq(gs.purse_copper, 9900, "second accept_item(silver) tag must be a no-op") + + +func test_repeated_give_item_gold_applies_once(): + var gs = GameState.new() + var moves: Array = [] + for i in range(10): + moves.append(_m("give_item", ["gold"])) + MoveApplier.apply(moves, gs, CanonLog.new(), _content(), "fenn") + assert_eq(gs.purse_copper, 10000, "nine of the ten give_item(gold) tags must be no-ops") + + +func test_repeated_accept_item_copper_applies_once(): + var gs = GameState.new() + gs.purse_copper = 47 + var moves: Array = [] + for i in range(47): + moves.append(_m("accept_item", ["copper"])) + MoveApplier.apply(moves, gs, CanonLog.new(), _content(), "fenn") + assert_eq(gs.purse_copper, 46, "46 of the 47 accept_item(copper) tags must be no-ops") + + +func test_different_currency_moves_both_still_apply(): + # Proves dedup is keyed per (move name + denomination), not per reply as a whole. + var gs = GameState.new() + MoveApplier.apply([_m("give_item", ["gold"]), _m("accept_item", ["silver"])], + gs, CanonLog.new(), _content(), "fenn") + assert_eq(gs.purse_copper, 9900) + + +func test_repeated_non_currency_give_item_still_applies_each_time(): + # Pins the scope line: real-item duplicate handling is UNCHANGED by this fix + # (it stays bounded only by the cross-reply gifts_given gate, reported separately). + var gs = GameState.new() + MoveApplier.apply([_m("give_item", ["amulet"]), _m("give_item", ["amulet"]), _m("give_item", ["amulet"])], + gs, CanonLog.new(), _content(), "fenn") + assert_eq(gs.inventory.get("amulet", 0), 3, "non-currency give_item is out of scope for this fix") + + +func test_repeated_non_currency_accept_item_still_applies_each_time(): + var gs = GameState.new() + gs.add_item("worn_shortsword", 5) + MoveApplier.apply([_m("accept_item", ["worn_shortsword"]), _m("accept_item", ["worn_shortsword"])], + gs, CanonLog.new(), _content(), "fenn") + assert_eq(gs.inventory.get("worn_shortsword", 0), 3, "non-currency accept_item is out of scope for this fix") diff --git a/client/tests/unit/test_npc_content.gd b/client/tests/unit/test_npc_content.gd index 4914477..d88306b 100644 --- a/client/tests/unit/test_npc_content.gd +++ b/client/tests/unit/test_npc_content.gd @@ -66,6 +66,21 @@ func test_a_gold_coin_is_asked_for_once_affordable(): assert_true("accept_item(gold)" in moves) +func test_currency_never_arrives_via_the_inventory_loop(): + # §7 of the currency spec: currency never enters the inventory dict, so the + # only accept_item() in available_moves comes from the affordability + # loop — never a double-offer via the inventory.keys() loop. + var gs = GameState.new() + gs.grant("gold", 1) + assert_true(gs.inventory.is_empty(), "currency must never be written into inventory") + var moves = NpcContent.available_moves(_fenn(), gs, CanonLog.new()) + var gold_offers := 0 + for m in moves: + if m == "accept_item(gold)": + gold_offers += 1 + assert_eq(gold_offers, 1, "accept_item(gold) must be offered exactly once") + + func test_currency_gift_is_offered_repeatedly(): var npc := _fenn() npc["capabilities"]["giveable_items"] = ["copper", "amulet"]