Drive Scriptward from your own code

The page reads pasted GDScript in the browser for free — one or more files joined into one paste, each introduced by a # file: <path> line, plus a .tscn scene for the node tree and project.godot for the Godot version and the autoloads — with its line numbers. It lexes strings and comments out first, rebuilds every block from indentation (and notes per file whether it indents with tabs or spaces), inventories every func and whether it is typed, every member variable and when it is initialised, every node lookup ($Path, %Unique, get_node, group searches) and whether it runs every frame, every signal declared, connected, emitted and disconnected, and — from a pasted scene — which nodes really exist and which script sits on which node, and runs 19 deterministic checks drawn from Godot 4 practice (catalogue ids GD-01..GD-19, plus GD-20 for context): Godot 3 syntax and APIs that Godot 4 refuses (onready and export keywords, yield(), setget, KinematicBody2D, .instance(), rand_range() and more), an @export with no type or default and files that mix tabs and spaces, nodes fetched in a member initialiser without @onready, $Paths and %Unique names that are not in the pasted scene, node lookups and tree searches every frame, physics movement in _process, movement per frame without delta, a RigidBody moved directly, signals connected to handlers that do not exist or connected every frame, lambdas left on long-lived signals, signals and methods wired by string names, free() where queue_free() belongs, load() or instantiate() on the per-frame path, absolute /root/ paths to autoloads, credentials in scripts, untyped declarations, empty per-frame callbacks and signals never emitted. Nothing is run, and it is not the Godot editor: every flag is a reading of the text. Its two paid steps are available over HTTP. You send one JSON object with task set to "audit" or "fix", the paste as code and the page’s check as a facts string, and the model replies with one JSON object: an audit that rates the four areas, answers every flag and gives exact before/after edits per finding, or the whole fixed script(s) with a list of every change tied to the page’s flags.

Base URL: https://api.skillsafe.ai/v1/app-api. Every call sends Content-Type: application/json and, once you have a token, Authorization: Bearer <token>. The paths below (/guest, /me, /estimate, /run, /jobs/{job_id}, /run-stream) are relative to it, exactly as sdk.js calls them. A plain-text summary of the app for agents is at /llms.txt. Both lanes run on the gpt-terra model with a 10% publisher markup. A run needs a signed-in (user) token and is metered: the platform places a hold on your credits when the run starts and then charges only what the run used. /estimate is free.

The response envelope

Responses are JSON of the form {"ok": ..., "data": ..., "error": {...}}. The page’s SDK (sdk.js) decides success from the HTTP status, not from ok: on a 2xx it returns data; otherwise it raises an error whose message is error.message (or the HTTP status text when the body carries none), with status, code (error.code) and details (error.details) attached. A body that is not JSON is treated as {}.

{ "ok": true,  "data": { ... } }
{ "ok": false, "error": { "code": "...", "message": "...", "details": { ... } } }

Error codes

Branch on the HTTP status and error.code, show error.message. The page handles 401 and 402 by name; the rest reach it as a generic failure (“The run failed: ...”).

Failures that do not arrive as an HTTP status:

The task field: two lanes

task routes the run, and it takes exactly two values: "audit" and "fix". Each lane has its own reply contract, and a reply never mixes them. The skill’s instructions tell the model to do the audit lane when task is missing or anything else (and the page’s own Gdkit.buildInput turns any lane that is not "fix" into "audit"), so a typo silently gets you an audit: always send one of the two values.

The page chains the two: after an audit, “Apply every edit and fix the rest” puts every audit edit into the paste, switches to the fix lane on that edited paste and adds an audit_handoff string (below) with the audit’s verdict, headline and findings. Over the API that is a second run with task: "fix", the edited paste as code, facts recomputed from the edited paste, and that string. The page drops the handoff as soon as the paste is edited again.

Guards the page applies before a run and the API does not: it refuses to price or run a paste it cannot read as GDScript (“Nothing was pasted.”, “No GDScript file was found. Paste .gd source, with a # file: <path>.gd line above each file (a .tscn scene or project.godot may come too).”, or “This does not read as GDScript: no extends, func, var or signal was found.”), and it warns before a run on a paste with no func (“No func was found; the run will see member declarations only.”) or with $ and % lookups but no scene (“No .tscn scene was pasted, so node paths are not checked against the real node tree - paste the scene too for that check.”).

Input fields

This is exactly what the page sends (gdkit.js buildInput(lane, A, note, handoff), checked by mustBeObject; app.js currentInput and run), and what input-schema.json declares. The platform’s input schema is scalar-only, so every value is a string. buildInput emits them in the order task, code, facts, note, audit_handoff:

mustBeObject only insists on a plain object that is not wrapped in {"input": ...}; it is buildInput that leaves a blank note out, which is why an empty note is simply absent. There is no slug header: the token and the body are all the run needs.

The code string

code is the paste itself. A line # file: <path> (a path with a . or / in it) starts each file, and a --- line just before it only separates files. Files dropped on the page (or a dropped scene folder) are joined that way by Gdkit.joinFiles: each file under its # file: line, trailing whitespace removed, joined by newlines, ending in a newline. A paste with no # file: line is read as one script, script.gd. The page normalises line endings to \n. A .gd path is checked as GDScript (gdscript); .tscn and .escn are scene (the node tree, the node each script sits on and its %Unique names, so a $Path can be checked against the nodes that exist); project.godot is project (its config/features give facts.project.godot_version, or config_version gives 4.x or 3.x, and its [autoload] section the autoload names); .tres is resource; anything else is other. GDScript refuses a file that indents with both tabs and spaces, so the page keeps every file’s own indentation character and reports it as facts.files[].indent. Send the text you want the reply to quote: every file in an audit reply must be a path from facts.files, every line must fall inside that file, every evidence must be copied from it, and every edit’s before must occur in it exactly once.

The page reads up to 400 000 characters (MAX_TEXT, cut at a line) and 40 files (MAX_FILES), and sends at most 60 000 characters (MAX_SEND): past that buildInput drops whole files from the end — the last file that is not a script first (scenes and project.godot), then the last file — until the rest fits, cuts a single remaining file at a line (“the end of <path>”) if it still does not, and ends the string with one line naming what it left out:

# [scriptward: not sent: levels/level_1.tscn, enemies/turret.gd]

The model is told never to quote or rewrite what was not sent, and facts.notes gets the sentence “Not sent (the paste is over 60,000 characters): ... The page checked them; the run did not see them.” facts is still computed from the whole paste. The worked examples below are small, so their code is the paste unchanged.

The facts string

facts is optional to compute but required to send. It is produced by the page’s free check: Gdkit.analyze splits the paste into files, lexes them, rebuilds their blocks, reads any scene and project.godot, inventories the scripts and runs the rules, and Gdkit.facts(A) turns that analysis into the object below (it does not depend on the lane: an audit and a fix run of the same paste carry the same facts). It is how the model knows which flags to answer, which file paths and line ranges to name, which indentation character to write, and which funcs and signals must survive. Its top-level keys, in the order built:

The simplest source is gdkit.js itself: the page loads it from /gdkit.js, and it also runs in Node (it sets module.exports). This script prints what the page would send as code and facts (with the 60 000-character cut applied), with the facts decoded so you can read them; the step 4 samples compact them back into the page’s string byte for byte. Save the paste as player-paste.txt and redirect the output into player-check.json:

// build-check.js -- run: node build-check.js player-paste.txt > player-check.json   (gdkit.js saved next to it)
const fs = require("fs");
const Gdkit = require("./gdkit.js");
const A = Gdkit.analyze(fs.readFileSync(process.argv[2], "utf8"));
if (!A.ok) { console.error(A.errors.join("\n")); process.exit(1); }
const inp = Gdkit.buildInput("audit", A, "", null);       // code and facts do not depend on the lane
console.log(JSON.stringify({ code: inp.code, facts: JSON.parse(inp.facts) }, null, 2));
const real = A.flags.filter((f) => f.sev !== "info");
console.error(A.files.length + " file(s), " + A.scripts.length + " script(s), " + A.functions.length + " func(s), " + A.signals.length + " signal(s), " + A.connects.length + " connection(s), " + A.lookups.length + " lookup(s), " + A.scenes.length + " scene(s); " +
  real.length + " flags (" + A.counts.high + " high, " + A.counts.medium + " medium, " + A.counts.low + " low); verdict_candidate " + A.candidate);

For the player example it reports 2 file(s), 1 script(s), 4 func(s), 2 signal(s), 2 connection(s), 6 lookup(s), 1 scene(s); 9 flags (5 high, 2 medium, 2 low); verdict_candidate blocked; for the turret example, 2 file(s), 1 script(s), 3 func(s), 1 signal(s), 0 connection(s), 2 lookup(s), 1 scene(s); 4 flags (0 high, 4 medium, 0 low); verdict_candidate needs_work. For both worked examples its code and facts are exactly what the page sends.

Without the page’s check. The platform only checks that facts is a string, so a minimal object works — "{}", or a hand-built one such as {"flags": [], "notes": ["No page check was run; read the code directly."]} — and the model still reads code. But you lose what the check adds: with no flags there is nothing to confirm, dismiss or close, with no files there are no paths, line ranges or indentation characters to follow, with no scenes no node path is known to exist, and with no functions and signals nothing says what must survive a fix. Build it with gdkit.js as above when you can.

The audit_handoff string

Only for task: "fix", and only for the code the audit was about with every audit edit applied. The page builds both from the normalised audit reply res (recon.js normalize, below) and the analysis A of the audited paste, in recon.js fixHandoff:

const run = Recon.applyFindings(A, res.findings, Gdkit);      // every finding's edits, in order, each on top of the last
JSON.stringify({ verdict: res.verdict, headline: res.headline,
  findings: res.findings.map(f => ({ id: f.id, severity: f.severity, file: f.file, line: f.line, title: f.title, why: f.why, edits: f.edits.length })),
  applied: /* edits that applied */, failed: /* edits that did not */ })
// run.A.text is the edited paste: it becomes code, and facts is recomputed from it

That is {"verdict", "headline", "findings": [{id, severity, file, line, title, why, edits}], "applied", "failed"}, where each finding’s edits is the number of edits it carried. applyFindings applies every finding’s edits with Gdkit.applyEdits, in the order listed: each before must occur exactly once in its file as the earlier edits left it (leading and trailing blank lines ignored). A before that is not found as written but is found exactly once re-indented to the file’s own tabs or spaces applies with its after re-indented the same way, and is counted as loose; anything else is reported as failed and skipped — it is never guessed. The handoff is a previous reply, not evidence: the model checks it against code and fixes what is left. This script does the whole step — the edited paste, its recomputed facts and the handoff string, in the same shape as build-check.js prints, so the samples read it the same way:

// handoff.js -- run: node handoff.js player-paste.txt player-reply.txt > player-fix-check.json   (gdkit.js, recon.js next to it)
const fs = require("fs");
const Gdkit = require("./gdkit.js");
const Recon = require("./recon.js");
const A = Gdkit.analyze(fs.readFileSync(process.argv[2], "utf8"));             // the audited paste
const res = Recon.normalize(Recon.parseResult(fs.readFileSync(process.argv[3], "utf8")), "audit");
const ho = Recon.fixHandoff(A, res);                                            // every edit, in order
const B = Gdkit.analyze(ho.text);                                               // facts recomputed from the edited paste
const inp = Gdkit.buildInput("fix", B, "", ho.handoff);
console.log(JSON.stringify({ code: inp.code, facts: JSON.parse(inp.facts), audit_handoff: inp.audit_handoff }, null, 2));
console.error(ho.applied + " edit(s) applied, " + ho.failed + " did not apply");

Save the audit’s output.output as player-reply.txt; for the player audit below it reports 15 edit(s) applied, 0 did not apply, the recomputed facts of the edited paste carry only the GD-20 context flag (verdict_candidate ready), and the page sends that fix run with the audit’s note and the key scriptward:fix:12f96ec6-25d8:a1.

The output contracts

The model is instructed (SKILL.md) to reply with one JSON object and nothing else — no prose, no code fences — with every array of its lane present ([] when empty). The run’s output text is that object. In both lanes it must ground everything in code: a node, a scene, an autoload, an input action, a parent script’s method or another script’s signal that is not in the paste is never claimed to exist — it goes into questions (“if EventBus is an autoload ...”, unless a pasted project.godot lists it). It must never write a secret value: a line that holds a literal credential is never copied into the reply (not in evidence, not in an edit, not in a file), and no credential, URL or server is invented. It must never change what the code offers the rest of the project: the same funcs with the same names and parameters, the same signals with the same arguments, the same @export variables (scenes store their values by name), the same class_name and the same node paths unless a GD-04 finding is about that path, unless the note asks for it. Every line it writes is Godot 4 syntax with typed declarations, cached lookups and handlers that exist, and an API it is not sure exists in Godot 4 (or in facts.project.godot_version when that is known) is recommended in words rather than written. Every page flag whose sev is not info is answered exactly once (audit lane: in flag_answers), and an info flag is never reported as a finding.

task: "audit"

• task: "audit".
• verdict: blocked (any finding is high) | needs_work (the worst is medium) | ready (nothing above low; low findings and questions do not stop a release).
• headline: one sentence. scene: one or two sentences — what the scripts do and what runs every frame.
• areas[]: exactly four entries, in the order syntax (Godot 4 loads every script: no Godot 3 construct, exports typed, one indentation character, declarations typed), lifecycle (what runs at construction, in _ready and every frame: node references, physics, delta, lookups), signals (every connection made once, to a handler that exists, in a checked form; every signal emitted), resources (freeing, loading, spawning and pooling, autoloads, credentials): {area, status, note} with status sound | fragile | broken (broken when a high finding sits in that area, fragile for a medium one).
• findings[]: {id, flags[], file, line, severity, area, title, evidence, why, edits[]}. id is a catalogue id (GD-01..GD-19) or other; flags lists the page uids it confirms ([] for something the page did not flag, such as a freed reference used without is_instance_valid, an await that resumes after the node left the tree, or a handler whose parameter count does not match its signal); file is a path from facts.files, copied exactly; line is the line of code with the offending text, inside that file’s line..end_line; severity is high (the script does not load or crashes on first use: a Godot 3 construct, @export with no type or default, tabs mixed with spaces, a node fetched in a member initialiser, a node path that is not in the scene, a handler that is not defined) | medium (it misbehaves or pays every frame: a lookup or tree search every frame, physics in _process, movement without delta, a RigidBody moved directly, a signal connected every frame, free() on a node, load() every frame, a credential in a script) | low (bounded risk or hygiene: a lambda on a long-lived signal never disconnected, a signal or method named by a string, an absolute /root/ path, untyped declarations, an empty _process, a signal never emitted, instantiate() every frame without a pool); area is syntax | lifecycle | signals | resources; evidence is one to three whole lines copied verbatim from code as pasted (indentation may be trimmed).
• edits[]: {before, after} on that one file. Each before is a contiguous, exact slice of the file — whole lines with their indentation, copied character for character — that occurs exactly once in the file as it stands when the edit is applied; after is its replacement, indented with the file’s own character (facts.files[].indent: with tabs, every level is one tab, written \t in the JSON string; never tabs and spaces mixed). Findings are applied in the order listed and their edits in order, each on top of the ones before, so a later finding that touches the same lines writes its before as the earlier one left it. An edit never renames or removes a func, a signal, an @export variable or a class_name, and never changes a func’s parameters. A finding that carries an aggregated flag (GD-01, GD-12, GD-17) closes it only when no line of it is left in the file. edits may be [] only for a low finding or a change outside the paste (a scene that was not pasted, a project setting).
• flag_answers[]: {flag, status, reason}, exactly one per non-info page flag, status confirmed (a finding lists that uid) | dismissed (with the reason).
• plan[]: the findings in the order to apply them, ending with running the scene with the Debugger’s Errors tab open and the GDScript warnings on, and watching the Profiler for the frame time. questions[] (only what the paste cannot answer; a bug that is not about how the script uses Godot, such as a balance number, goes here) and summary (two to four sentences, answering note if one was sent).

task: "fix"

• task: "fix".
• verdict: fixed (open is empty) | partial.
• headline: one sentence.
• files[]: {path, content} — every pasted script it changes, whole (every line, without the # file: line), under its path from facts.files, indented with the file’s own character (\t in JSON for a tab), keeping every func, signal, @export, class_name, name, parameter, default and comment it was not asked to change; at most one new script next to them. Scripts only — never a .tscn, .tres or project.godot.
• changes[]: {file, function, flags[], change, why}, one per change. function is the func it is in, as facts.functions names it, or (member) for a member variable, signal or class-level change; flags are the page flags the change closes ([] for a problem the page did not flag). Every high and medium flag appears in the flags of a change or of an open item.
• verify[]: always running the scene (F6) with the Debugger’s Errors tab open, plus the check that would have caught the worst problem (what to do in the running game and what to watch: the Profiler’s frame time, the Monitors’ object count, the node staying on screen at 30 and 144 fps).
• open[]: {item, flags[], reason} for what it left unfixed — a decision for the developer, a scene or project setting, or code outside the paste. When the note asks to leave something as it is, it is left exactly as it is and named here. questions[] and summary, as in the audit lane; with an audit_handoff, it fixes what the audit left.

How the page reads a reply (recon.js parseResult and normalize): it strips a code fence and parses from the first { to the last }. A reply is read as the lane that was asked for, unless it names the other lane and carries that lane’s body (a files array for fix, a findings array for audit). An unknown verdict shows as needs_work or partial and counts as a disagreement; an unknown severity becomes medium; ids like GD7 or gd 7 become GD-07; flags keeps only F<n> values; findings with no file, evidence and title are dropped; file may also arrive as path, a change’s function as func and its change as what, and an open item as path; questions is capped at 10, plan at 30 and verify at 20. An audit reply carries 9 sections (verdict, headline, scene, areas, findings, flag_answers, plan, questions, summary) and a fix reply 8 (verdict, headline, files, changes, verify, open, questions, summary), which is what the page counts when it recovers a partial reply.

Worked examples

Both are examples the page ships (the example buttons on the app page; the full pastes are in /example.js, ids player and turret), built exactly as the page builds them: Gdkit.buildInput(lane, Gdkit.analyze(text), note, null), with the real model reply the page replays for each. The pastes are shown whole (the scripts indent with tabs, as pasted); the request bodies cut the long code and facts strings with a visible ..., and the replies are pretty-printed excerpts, with ... where entries were left out. Every value shown is copied from the input or the reply. Neither paste holds a credential.

Audit: a player controller ported from Godot 3 that Godot 4 refuses to load

Two files, scenes/player/player.gd (indented with tabs) and scenes/player/player.tscn, with no project.godot, so the Godot version is unknown. The script still uses onready var, yield() and rand_range(), exports hurt_sound with no type and no default, fetches $Hitbox in a member initialiser, connects the HurtTimer’s timeout to _on_hurt_timer_timeout, which is never written, moves the body with move_and_slide() in _process, and looks up $AnimatedSprite2D and $Camera2D there every frame — and the scene has no Camera2D. The page’s free check raises 9 flags (5 high, 2 medium, 2 low) (plus the GD-20 context flag); its own reading of the verdict is blocked. The developer’s note: “Porting the player from our Godot 3 prototype. It will not even open in 4.3 - what do we fix first?”

The code string, whole: 1,960 characters, 73 lines ending in a newline. Save it as player-paste.txt and run node build-check.js player-paste.txt > player-check.json:

# file: scenes/player/player.gd
extends CharacterBody2D

signal health_changed(new_health)
signal died

const SPEED = 220.0
const JUMP_VELOCITY = -420.0

@export var max_health = 100
@export var hurt_sound

onready var anim = $AnimatedSprite2D
var hitbox = $Hitbox
var health = 100
var gravity = ProjectSettings.get_setting("physics/2d/default_gravity")


func _ready():
	health = max_health
	hitbox.area_entered.connect(_on_hitbox_area_entered)
	$HurtTimer.timeout.connect(_on_hurt_timer_timeout)


func _process(delta):
	var direction = Input.get_axis("move_left", "move_right")
	velocity.x = direction * SPEED
	if not is_on_floor():
		velocity.y += gravity * delta
	if Input.is_action_just_pressed("jump") and is_on_floor():
		velocity.y = JUMP_VELOCITY
	move_and_slide()
	$AnimatedSprite2D.flip_h = direction < 0
	$Camera2D.offset.x = direction * 24.0


func take_damage(amount):
	health = max(health - amount, 0)
	emit_signal("health_changed", health)
	$HurtTimer.start()
	if health <= 0:
		died.emit()
		yield(get_tree().create_timer(0.6), "timeout")
		get_tree().reload_current_scene()


func _on_hitbox_area_entered(area):
	if area.is_in_group("spikes"):
		take_damage(rand_range(10, 20))
# file: scenes/player/player.tscn
[gd_scene load_steps=4 format=3 uid="uid://b6k2plyr7q"]

[ext_resource type="Script" path="res://scenes/player/player.gd" id="1_pl"]
[ext_resource type="SpriteFrames" path="res://scenes/player/player_frames.tres" id="2_fr"]

[sub_resource type="CapsuleShape2D" id="CapsuleShape2D_body"]
radius = 7.0
height = 26.0

[node name="Player" type="CharacterBody2D"]
script = ExtResource("1_pl")

[node name="AnimatedSprite2D" type="AnimatedSprite2D" parent="."]
sprite_frames = ExtResource("2_fr")

[node name="CollisionShape2D" type="CollisionShape2D" parent="."]
shape = SubResource("CapsuleShape2D_body")

[node name="Hitbox" type="Area2D" parent="."]

[node name="HurtTimer" type="Timer" parent="."]
one_shot = true
wait_time = 0.4

Its facts, decoded (the request carries this object as one compact JSON string):

{
  "project": {
    "godot_version": null,
    "scripts": 1,
    "scenes": 1,
    "functions": 4,
    "signals": 2,
    "connections": 2,
    "node_lookups": 6,
    "autoloads": []
  },
  "files": [
    {
      "path": "scenes/player/player.gd",
      "kind": "gdscript",
      "line": 2,
      "end_line": 49,
      "indent": "tabs"
    },
    {
      "path": "scenes/player/player.tscn",
      "kind": "scene",
      "line": 51,
      "end_line": 74
    }
  ],
  "scripts": [
    {
      "file": "scenes/player/player.gd",
      "extends": "CharacterBody2D",
      "base": "CharacterBody2D",
      "class_name": null,
      "tool": false,
      "callbacks": [
        "_ready",
        "_process"
      ],
      "attached_to": [
        "scenes/player/player.tscn:."
      ]
    }
  ],
  "functions": [
    {
      "name": "_ready",
      "file": "scenes/player/player.gd",
      "line": 19,
      "params": [],
      "every_frame": false
    },
    {
      "name": "_process",
      "file": "scenes/player/player.gd",
      "line": 25,
      "params": [
        "delta"
      ],
      "every_frame": true
    },
    {
      "name": "take_damage",
      "file": "scenes/player/player.gd",
      "line": 37,
      "params": [
        "amount"
      ],
      "every_frame": false
    },
    {
      "name": "_on_hitbox_area_entered",
      "file": "scenes/player/player.gd",
      "line": 47,
      "params": [
        "area"
      ],
      "every_frame": false
    }
  ],
  "signals": [
    {
      "name": "health_changed",
      "file": "scenes/player/player.gd",
      "line": 4,
      "emitted": true
    },
    {
      "name": "died",
      "file": "scenes/player/player.gd",
      "line": 5,
      "emitted": true
    }
  ],
  "connections": [
    {
      "file": "scenes/player/player.gd",
      "line": 21,
      "func": "_ready",
      "source": "hitbox",
      "signal": "area_entered",
      "handler": "_on_hitbox_area_entered",
      "form": "method",
      "every_frame": false
    },
    {
      "file": "scenes/player/player.gd",
      "line": 22,
      "func": "_ready",
      "source": "$HurtTimer",
      "signal": "timeout",
      "handler": "_on_hurt_timer_timeout",
      "form": "method",
      "every_frame": false
    }
  ],
  "lookups": [
    {
      "file": "scenes/player/player.gd",
      "line": 13,
      "func": "(member)",
      "kind": "$",
      "path": "AnimatedSprite2D",
      "every_frame": false,
      "member_init": true
    },
    {
      "file": "scenes/player/player.gd",
      "line": 14,
      "func": "(member)",
      "kind": "$",
      "path": "Hitbox",
      "every_frame": false,
      "member_init": true
    },
    {
      "file": "scenes/player/player.gd",
      "line": 22,
      "func": "_ready",
      "kind": "$",
      "path": "HurtTimer",
      "every_frame": false,
      "member_init": false
    },
    {
      "file": "scenes/player/player.gd",
      "line": 33,
      "func": "_process",
      "kind": "$",
      "path": "AnimatedSprite2D",
      "every_frame": true,
      "member_init": false
    },
    {
      "file": "scenes/player/player.gd",
      "line": 34,
      "func": "_process",
      "kind": "$",
      "path": "Camera2D",
      "every_frame": true,
      "member_init": false
    },
    {
      "file": "scenes/player/player.gd",
      "line": 40,
      "func": "take_damage",
      "kind": "$",
      "path": "HurtTimer",
      "every_frame": false,
      "member_init": false
    }
  ],
  "scenes": [
    {
      "file": "scenes/player/player.tscn",
      "root": "Player",
      "root_type": "CharacterBody2D",
      "nodes": 5,
      "scripts": [
        ". <- res://scenes/player/player.gd"
      ],
      "unique": []
    }
  ],
  "flags": [
    {
      "uid": "F1",
      "id": "GD-02",
      "sev": "high",
      "file": "scenes/player/player.gd",
      "line": 11,
      "text": "@export var hurt_sound has no type and no default value",
      "detail": "Godot 4 cannot export a variable whose type it cannot know: the script fails to parse (\"Cannot use simple @export annotation with variable without type or initializer\"). Give it a type (var hurt_sound: float) or a default (var hurt_sound = 1.0)."
    },
    {
      "uid": "F2",
      "id": "GD-01",
      "sev": "high",
      "file": "scenes/player/player.gd",
      "line": 13,
      "text": "scenes/player/player.gd uses 3 Godot 3 constructs that Godot 4 does not have: onready var, yield(), rand_range()",
      "detail": "Godot 4 refuses to load the script (a parse error or an unknown identifier), so the scene that uses it does not run. Godot 4 forms: onready var -> @onready var; yield() -> await signal (await get_tree().create_timer(t).timeout); rand_range() -> randf_range().",
      "lines": [
        13,
        43,
        49
      ]
    },
    {
      "uid": "F3",
      "id": "GD-03",
      "sev": "high",
      "file": "scenes/player/player.gd",
      "line": 14,
      "text": "var hitbox is set from the scene tree when the script is created, before its children exist",
      "detail": "A member initialiser runs when the node is constructed, before it enters the tree and before its children are added: get_node fails (\"Node not found\") and hitbox is null, so the first use crashes. Mark it @onready (@onready var hitbox := ...) so it is set just before _ready()."
    },
    {
      "uid": "F4",
      "id": "GD-09",
      "sev": "high",
      "file": "scenes/player/player.gd",
      "line": 22,
      "text": "timeout is connected to _on_hurt_timer_timeout, which is not a func in scenes/player/player.gd",
      "detail": "GDScript resolves _on_hurt_timer_timeout when it compiles the script: an identifier that is not declared is a parse error, so the whole script fails to load. Add func _on_hurt_timer_timeout(...) with the signal's arguments, or fix the name."
    },
    {
      "uid": "F5",
      "id": "GD-04",
      "sev": "high",
      "file": "scenes/player/player.gd",
      "line": 34,
      "text": "$Camera2D names a node that is not in scenes/player/player.tscn",
      "detail": "The script sits on the scene root (Player) in scenes/player/player.tscn, and that scene has no node at Camera2D: the lookup fails at runtime (\"Node not found\") and returns null, so the first use crashes. Fix the path, or rename the node in the scene."
    },
    {
      "uid": "F6",
      "id": "GD-06",
      "sev": "medium",
      "file": "scenes/player/player.gd",
      "line": 32,
      "text": "_process moves the body with move_and_slide(), once per rendered frame",
      "detail": "_process runs once per rendered frame, at a variable rate; physics runs at a fixed tick in _physics_process. Moving a body or applying forces from _process makes movement depend on the frame rate, jitters against the physics step, and can tunnel through collisions. Move the body in _physics_process(delta)."
    },
    {
      "uid": "F7",
      "id": "GD-05",
      "sev": "medium",
      "file": "scenes/player/player.gd",
      "line": 33,
      "text": "_process looks up 2 nodes ($AnimatedSprite2D, $Camera2D) every frame",
      "detail": "Every $Path or get_node call walks the node path again, every frame; at 60 frames a second that is wasted work on the main thread and a hitch source as the scene grows. Cache the node once: @onready var sprite: Sprite2D = $Sprite2D (a group: cache it in _ready and refresh on node_added / a signal).",
      "lines": [
        33,
        34
      ]
    },
    {
      "uid": "F8",
      "id": "GD-17",
      "sev": "low",
      "file": "scenes/player/player.gd",
      "line": 10,
      "text": "scenes/player/player.gd: 12 of 12 declarations are untyped (var max_health, var hurt_sound, var hitbox, var health and more)",
      "detail": "Untyped variables, parameters and returns are Variants: the editor cannot catch a wrong type or a typo in a member name, autocompletion stops working, and the GDScript VM cannot use its faster typed instructions. Give each a type (var speed: float = 200.0, func take_damage(amount: int) -> void) or infer it with :=.",
      "lines": [
        10,
        11,
        14,
        15,
        16,
        19,
        25,
        37,
        47
      ]
    },
    {
      "uid": "F9",
      "id": "GD-12",
      "sev": "low",
      "file": "scenes/player/player.gd",
      "line": 39,
      "text": "scenes/player/player.gd wires emit_signal(\"health_changed\")",
      "detail": "A signal or method named by a string is only looked up when the line runs: a typo or a rename fails at runtime (or silently, for emit_signal), and the editor cannot find or rename it. Godot 4 has first-class signals and Callables: died.emit(), died.connect(_on_died), _on_died.call_deferred()."
    },
    {
      "uid": "F10",
      "id": "GD-20",
      "sev": "info",
      "file": "scenes/player/player.gd",
      "line": 2,
      "text": "context: 1 script, 4 func(s), 2 signal(s) declared, 2 connect() call(s), 6 node lookup(s), 1 scene(s), Godot version unknown (paste project.godot)",
      "detail": "Also read: scenes/player/player.tscn (scene). Only what is pasted is checked: scripts that extend or call code outside the paste, scenes that were not pasted and signals emitted elsewhere are outside the check."
    }
  ],
  "verdict_candidate": "blocked",
  "notes": []
}

The request body (POST /estimate, then POST /run or /run-stream with Idempotency-Key: scriptward:audit:a1de78f0-27ad:a1 as the page sends it):

{
  "task": "audit",
  "code": "# file: scenes/player/player.gd\nextends CharacterBody2D\n\nsignal health_changed(new_health)\nsignal died\n\nconst SPEED = 220.0\nconst JUMP_VELOCITY = -420.0\n\n@export var max_health = 100\n@export var hurt_sound\n\nonready var a...",
  "facts": "{\"project\":{\"godot_version\":null,\"scripts\":1,\"scenes\":1,\"functions\":4,\"signals\":2,\"connections\":2,\"node_lookups\":6,\"autoloads\":[]},\"files\":[{\"path\":\"scenes/player/player.gd\",\"kind\":\"gdscript...",
  "note": "Porting the player from our Godot 3 prototype. It will not even open in 4.3 - what do we fix first?"
}

The reply (output.output), an excerpt: the verdict, the headline, each area’s status, and the finding that answers “it will not even open in 4.3” for the Godot 3 leftovers, with its three edits and its flag answer:

{
  "task": "audit",
  "verdict": "blocked",
  "headline": "The script won't load in Godot 4.3 yet - an untyped export, three Godot 3 leftovers, an undefined signal handler, a null member reference and a missing Camera2D node all block it before anything else matters.",
  "scene": ...,
  "areas": [
    {
      "area": "syntax",
      "status": "broken"
    },
    {
      "area": "lifecycle",
      "status": "broken"
    },
    {
      "area": "signals",
      "status": "broken"
    },
    {
      "area": "resources",
      "status": "sound"
    }
  ],
  "findings": [
    ...,
    {
      "id": "GD-01",
      "flags": [
        "F2"
      ],
      "file": "scenes/player/player.gd",
      "line": 13,
      "severity": "high",
      "area": "syntax",
      "title": "Three Godot 3 constructs stop the script from parsing",
      "evidence": "onready var anim = $AnimatedSprite2D\n\t\tyield(get_tree().create_timer(0.6), \"timeout\")\n\t\ttake_damage(rand_range(10, 20))",
      "why": "onready var, yield() and rand_range() no longer exist in Godot 4: the parser stops on the first one it hits, so nothing past it runs and the scene using this script cannot start.",
      "edits": [
        {
          "before": "onready var anim = $AnimatedSprite2D",
          "after": "@onready var anim: AnimatedSprite2D = $AnimatedSprite2D"
        },
        {
          "before": "\t\tyield(get_tree().create_timer(0.6), \"timeout\")",
          "after": "\t\tawait get_tree().create_timer(0.6).timeout"
        },
        {
          "before": "\t\ttake_damage(rand_range(10, 20))",
          "after": "\t\ttake_damage(randi_range(10, 20))"
        }
      ]
    },
    ...
  ],
  "flag_answers": [
    ...,
    {
      "flag": "F2",
      "status": "confirmed",
      "reason": "onready var, yield() and rand_range() are Godot 3 only; converted to @onready var, await and randi_range()."
    },
    ...
  ],
  "plan": [
    ...,
    "Run the scene (F6) with the Debugger's Errors tab open and GDScript warnings on (Project Settings > Debug > GDScript, e.g. untyped_declaration), then watch the Profiler's frame time."
  ],
  "questions": [
    ...
  ],
  "summary": ...
}

The reply has 8 findings for the 9 flags — one GD-06 finding carries both F6 and F7, because moving the body into _physics_process and using the cached anim rewrite the same lines — and confirms all 9. Its 15 edits: hurt_sound typed as AudioStream; the three Godot 3 constructs rewritten (@onready var anim: AnimatedSprite2D, await get_tree().create_timer(0.6).timeout, randi_range); a stub func _on_hurt_timer_timeout() -> void: added so the connection resolves; hitbox made @onready and typed Area2D; the $Camera2D line removed; _process split into a _process that flips the cached anim and a _physics_process that moves the body; emit_signal("health_changed", health) replaced by health_changed.emit(health); and six edits that type the remaining declarations. The two low findings (GD-12, GD-17) carry edits too. Its questions ask whether a Camera2D is meant to exist in the scene, what the stubbed timer handler should actually do, and where hurt_sound is played.

Fix: a turret that turns without delta, searches the tree every tick and loads on every shot

Two files, enemies/turret.gd (indented with tabs) and enemies/turret.tscn, with no project.godot. _physics_process finds the player with get_tree().get_first_node_in_group("player") and the muzzle with $Barrel/Muzzle on every tick, turns with rotation += turn_speed * signf(...) and no delta, and calls load("res://fx/muzzle_flash.tscn") every time it fires; take_hit calls free(). The free check raises 4 flags (4 medium) (plus the GD-20 context flag); its reading of the verdict is needs_work. This example has no audit before it, so it carries no audit_handoff. The developer’s note: “The turret spins faster on my 144 Hz monitor and the game hitches every time it fires. Fix those. Leave the free() in take_hit exactly as it is for now - the level script checks for the turret on the same frame, and we will change both together.”

The code string, whole: 1,671 characters, 60 lines ending in a newline. Save it as turret-paste.txt and run node build-check.js turret-paste.txt > turret-check.json:

# file: enemies/turret.gd
extends StaticBody2D

signal destroyed

@export var bullet_scene: PackedScene
@export var fire_rate: float = 1.5
@export var turn_speed: float = 0.05

var hp: int = 5
var _cooldown: float = 0.0


func _physics_process(delta: float) -> void:
	var player := get_tree().get_first_node_in_group("player") as Node2D
	if player == null:
		return
	var wanted := global_position.direction_to(player.global_position).angle()
	rotation += turn_speed * signf(angle_difference(rotation, wanted))
	_cooldown -= delta
	if _cooldown <= 0.0:
		var flash := load("res://fx/muzzle_flash.tscn") as PackedScene
		var muzzle := $Barrel/Muzzle as Marker2D
		_fire(muzzle.global_position, flash)
		_cooldown = fire_rate


func _fire(from: Vector2, flash: PackedScene) -> void:
	var bullet := bullet_scene.instantiate() as Area2D
	bullet.global_position = from
	bullet.rotation = rotation
	get_parent().add_child(bullet)
	var fx := flash.instantiate() as Node2D
	fx.global_position = from
	get_parent().add_child(fx)


func take_hit(damage: int) -> void:
	hp -= damage
	if hp <= 0:
		destroyed.emit()
		free()
# file: enemies/turret.tscn
[gd_scene load_steps=3 format=3 uid="uid://d8turretm0s"]

[ext_resource type="Script" path="res://enemies/turret.gd" id="1_tu"]

[sub_resource type="CircleShape2D" id="CircleShape2D_base"]
radius = 14.0

[node name="Turret" type="StaticBody2D" groups=["enemies"]]
script = ExtResource("1_tu")

[node name="CollisionShape2D" type="CollisionShape2D" parent="."]
shape = SubResource("CircleShape2D_base")

[node name="Barrel" type="Sprite2D" parent="."]

[node name="Muzzle" type="Marker2D" parent="Barrel"]
position = Vector2(18, 0)

Its facts, decoded, cut to files, flags and verdict_candidate (the full object also lists the project counts, the one script and the scene node it sits on, the 3 funcs, the destroyed signal, the 2 lookups and the scene’s 4 nodes):

{
  "files": [
    {
      "path": "enemies/turret.gd",
      "kind": "gdscript",
      "line": 2,
      "end_line": 42,
      "indent": "tabs"
    },
    {
      "path": "enemies/turret.tscn",
      "kind": "scene",
      "line": 44,
      "end_line": 61
    }
  ],
  "flags": [
    {
      "uid": "F1",
      "id": "GD-05",
      "sev": "medium",
      "file": "enemies/turret.gd",
      "line": 15,
      "text": "_physics_process looks up 2 nodes (get_first_node_in_group(\"player\"), $Barrel/Muzzle) every frame",
      "detail": "A tree search (find_child, get_nodes_in_group) walks the scene tree every frame and allocates an array each time; at 60 frames a second that is wasted work on the main thread and a hitch source as the scene grows. Cache the node once: @onready var sprite: Sprite2D = $Sprite2D (a group: cache it in _ready and refresh on node_added / a signal).",
      "lines": [
        15,
        23
      ]
    },
    {
      "uid": "F2",
      "id": "GD-07",
      "sev": "medium",
      "file": "enemies/turret.gd",
      "line": 19,
      "text": "_physics_process moves or turns the node by a fixed step per frame, without delta",
      "detail": "The step is applied once per call, so the speed depends on the frame rate: twice as fast at 120 fps as at 60, and it stutters when frames drop. Multiply the step by delta (position += velocity * delta), or set velocity and call move_and_slide() on a CharacterBody."
    },
    {
      "uid": "F3",
      "id": "GD-14",
      "sev": "medium",
      "file": "enemies/turret.gd",
      "line": 22,
      "text": "_physics_process calls load() on the per-frame path",
      "detail": "load() resolves the path through the resource cache (or reads the disk) each time this line runs, on the main thread, inside a callback that runs every physics tick or frame. preload() the resource once into a const (or load it once in _ready). instantiate() builds and allocates a whole node tree each time; for something spawned often (bullets, effects, pickups) keep a pool of instances and reuse them instead."
    },
    {
      "uid": "F4",
      "id": "GD-13",
      "sev": "medium",
      "file": "enemies/turret.gd",
      "line": 42,
      "text": "free() deletes this node immediately",
      "detail": "free() destroys the node on the spot, even in the middle of a physics step or of a signal emission that still holds it: anything that touches it later in the frame (another handler, a queued call, a collision callback) hits a freed object, and Godot reports \"Attempt to call on a previously freed instance\" or crashes. Use queue_free(), which frees at the end of the frame."
    },
    {
      "uid": "F5",
      "id": "GD-20",
      "sev": "info",
      "file": "enemies/turret.gd",
      "line": 2,
      "text": "context: 1 script, 3 func(s), 1 signal(s) declared, 0 connect() call(s), 2 node lookup(s), 1 scene(s), Godot version unknown (paste project.godot)",
      "detail": "Also read: enemies/turret.tscn (scene). Only what is pasted is checked: scripts that extend or call code outside the paste, scenes that were not pasted and signals emitted elsewhere are outside the check."
    }
  ],
  "verdict_candidate": "needs_work"
}

The request body (Idempotency-Key: scriptward:fix:b0fdeb55-18f5:a1):

{
  "task": "fix",
  "code": "# file: enemies/turret.gd\nextends StaticBody2D\n\nsignal destroyed\n\n@export var bullet_scene: PackedScene\n@export var fire_rate: float = 1.5\n@export var turn_speed: float = 0.05\n\nvar hp: int = 5\nvar _cooldown: float = 0.0\n...",
  "facts": "{\"project\":{\"godot_version\":null,\"scripts\":1,\"scenes\":1,\"functions\":3,\"signals\":1,\"connections\":0,\"node_lookups\":2,\"autoloads\":[]},\"files\":[{\"path\":\"enemies/turret.gd\",\"kind\":\"gdscript\",\"lin...",
  "note": "The turret spins faster on my 144 Hz monitor and the game hitches every time it fires. Fix those. Leave the free() in take_hit exactly as it is for now - the level script checks for the turret on the same frame, and we will change both together."
}

The reply (output.output), an excerpt: the verdict, the headline, the middle of the one returned script, the change that answers “spins faster on my 144 Hz monitor”, the last verification step and the open item:

{
  "task": "fix",
  "verdict": "partial",
  "headline": "Cached the turret's per-frame node lookups, scaled the turn by delta, and preloaded the muzzle flash so firing no longer stalls the frame.",
  "files": [
    {
      "path": "enemies/turret.gd",
      "content": "...\nconst MUZZLE_FLASH_SCENE: PackedScene = preload(\"res://fx/muzzle_flash.tscn\")\n\nvar hp: int = 5\nvar _cooldown: float = 0.0\n\n@onready var _muzzle: Marker2D = $Barrel/Muzzle\n@onready var _player: Node2D = get_tree().get_first_node_in_group(\"player\") as Node2D\n\n\nfunc _physics_process(delta: float) -> void:\n\tif not is_instance_valid(_player):\n\t\treturn\n\tvar wanted := global_position.direction_to(_player.global_position).angle()\n\trotation += turn_speed * signf(angle_difference(rotation, wanted)) * delta\n\t_cooldown -= delta\n\tif _cooldown <= 0.0:\n\t\t_fire(_muzzle.global_position, MUZZLE_FLASH_SCENE)\n\t\t_cooldown = fire_rate\n..."
    }
  ],
  "changes": [
    ...,
    {
      "file": "enemies/turret.gd",
      "function": "_physics_process",
      "flags": [
        "F2"
      ],
      "change": "Multiplied the rotation step by delta: rotation += turn_speed * signf(angle_difference(rotation, wanted)) * delta.",
      "why": "Without delta the step was applied once per physics call regardless of elapsed time, so the turret turned faster whenever _physics_process ran more often, matching the reported 144 Hz spin-up."
    },
    ...
  ],
  "verify": [
    ...,
    "Watch the Profiler's frame time while the turret fires repeatedly and confirm the per-shot spike that used to come from load() is gone."
  ],
  "open": [
    {
      "item": "take_hit() still calls free() instead of queue_free(), so the turret is destroyed immediately rather than at the end of the frame.",
      "flags": [
        "F4"
      ],
      "reason": "Left exactly as requested - the level script checks for this turret on the same frame free() runs, and that script is outside this paste, so switching to queue_free() needs to be done together with that check."
    }
  ],
  "questions": [
    ...
  ],
  "summary": ...
}

The other three changes cache $Barrel/Muzzle and the player group lookup in @onready vars (F1, function (member)), guard the cached player with is_instance_valid(_player) (flags []: nothing the page flagged), and replace the per-shot load() with a preloaded const MUZZLE_FLASH_SCENE passed into _fire() (F3). The verdict is partial because the note asked to leave free() in take_hit, so the medium F4 is named in open rather than fixed. One of its two questions matters before you ship: with delta applied, turn_speed (0.05) now means radians per second rather than per physics tick, so the turret turns much slower than before unless it is retuned.

The page checks the reply against the code; the API does not

What comes back from the API is the model’s raw text in output.output. The page holds it to account in the browser before showing it (recon.js reconcile, with the facts, the code and the handoff it sent): it applies every edit or returned script to the paste and re-runs its own checks on the result. None of that happens in the API. A direct API caller gets the reply unchecked and must do the applying and re-checking itself.

• Both lanes: the reply is the lane you asked for (one written for the other task is a disagreement), it carries a valid verdict for that lane, and no credential from the paste is repeated anywhere in it (every credential value the free check found in the paste).
• Audit: the areas table. Exactly four rows, covering syntax, lifecycle, signals and resources once each, each with a valid status.
• Audit: every finding is anchored. Its id is in the catalogue (GD-01..GD-19, or other; GD-20 is context and never a finding); its file is a pasted file; its line is inside that file; its evidence is found line by line in that file of code (indentation trimmed) and on or within three lines of line; every cited uid is a non-info flag the page raised. A finding with no valid area, one that carries a high flag at a lower severity, or a medium or high finding with no edit is pointed out.
• Audit: every flag is answered once, consistently. Every non-info flag answered exactly once and no other; a confirmed answer needs a finding carrying that uid; a dismissed one must not be carried by a finding and should give a reason. The verdict must fit the worst severity (blocked with a high finding, needs_work with a medium, otherwise ready).
• Audit: every edit is put in place and re-checked. The findings’ edits are applied in the listed order, each on top of the ones before (Gdkit.applyEdits, loosely re-indented to the file’s tabs or spaces when that is the only way it matches): a before that is not found, is found more than once, or changes nothing is a disagreement. After each finding the free check runs again: the code must still read and no new high flag may appear (tabs mixed with spaces included). With every edit applied, every confirmed flag a finding with edits carries must be gone, every func must still exist with the same parameters, every signal must still be declared, and a new medium flag is pointed out.
• Fix: the files. At least one file when the page raised a high or medium flag, at most one new one; none empty, none with a # file: line, every path a .gd script; a script indented with both tabs and spaces is a disagreement, and one indented differently from the pasted file is pointed out.
• Fix: put into the paste and re-checked. The files replace the pasted files of the same path (or are added) (Gdkit.replaceFiles) and the free check runs again: the code must read, no high or medium flag of the paste may remain unless an open item names it, no new high or medium flag may appear, every func must still exist with the same parameters, and every signal must still be declared.
• Fix: the changes list matches the code. Every change names a returned file, a func in the fixed code (or (member)) and real page flags; a high or medium flag no change and no open item names is pointed out. The verdict must fit the open list, and an empty verify is pointed out.

recon.js also runs in Node, so you can hold a reply to exactly the page’s standard. Save /gdkit.js and /recon.js next to this script, pass the file you built the body from (build-check.js or handoff.js output), the reply text and the lane; it prints every statement, the count, and the paste with every edit (or file) put back:

// recheck.js -- run: node recheck.js player-check.json player-reply.txt audit > player-edited.txt   (gdkit.js, recon.js next to it)
const fs = require("fs");
const Recon = require("./recon.js");                                            // loads ./gdkit.js itself
const sent = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));             // code, facts (and audit_handoff) you sent
const lane = process.argv[4] || "audit";
const res = Recon.normalize(Recon.parseResult(fs.readFileSync(process.argv[3], "utf8")), lane);  // output.output
const r = Recon.reconcile(res, { facts: sent.facts, code: sent.code, handoff: sent.audit_handoff || null });
r.notes.forEach((n) => console.error(n.kind + ": " + n.text));
console.error(r.disagreements + " disagreement(s) in " + r.statements + " statements checked");
if (r.after) (r.after.flags || []).forEach((f) => console.error("still raised: " + f.id + " " + f.sev + " " + f.file + ":" + f.line + " " + f.text));
if (r.after && r.after.text) console.log(r.after.text.replace(/\n$/, ""));      // the paste with every edit (or file) put back

For the player audit reply it reports (no flag is still raised once the 15 edits are in):

ok: The areas table rates syntax, lifecycle, signals and resources once each.
ok: Every one of the 8 findings names a pasted file, a line inside it and evidence copied from it.
ok: The verdict (blocked) fits the worst finding.
ok: Every one of the page's 9 flags is answered once.
ok: All 15 edits applied in order, each before text found exactly once.
ok: Every confirmed flag a finding carries is gone once all edits are applied.
ok: Every func (with its parameters) and every signal of the paste is still there after the edits.
ok: The reply repeats no credential from the paste.
0 disagreement(s) in 8 statements checked

and for the turret fix reply (node recheck.js turret-check.json turret-reply.txt fix):

ok: 1 file returned whole.
ok: With the fixed files in place the free check raises no high or medium flag beyond the ones left open (0 low).
info: F4 left open by the reply.
ok: Every one of the 3 funcs is still there.
ok: Every one of the 1 signals is still declared.
ok: Every one of the 4 changes names a returned file, a function in the fixed code and real page flags.
ok: The verdict (partial) fits the open list.
ok: The reply repeats no credential from the paste.
0 disagreement(s) in 7 statements checked
still raised: GD-13 medium enemies/turret.gd:44 free() deletes this node immediately

The page does not run the code and is not the Godot editor. After that, open the project in Godot 4 and run the scene (F6) with the Debugger’s Errors tab open and the GDScript warnings on (Project Settings > Debug > GDScript, for example untyped_declaration), watch the Profiler’s frame time, and do the checks the reply’s plan or verify names, before you ship anything.

Step 1 — a tiny client helper

One function per language that does what sdk.js does for every call: JSON in, bearer token if you have one, data out on a 2xx, an error carrying status, error.code and error.message otherwise. The later steps assume this helper is in the same file (for Go, Java and C#, the later snippets go inside main / the top-level statements; Java’s makeInput from step 4 goes in the class).

BASE="https://api.skillsafe.ai/v1/app-api"
TOKEN="${SKILLSAFE_TOKEN:-YOUR_TOKEN}"   # step 2

# api METHOD PATH [extra curl args...] -- prints the whole envelope; pipe to jq
api() {
  method="$1"; path="$2"; shift 2
  curl -sS -X "$method" "$BASE$path" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $TOKEN" "$@"
}
# success: jq '.data'      failure: jq '.error | {code, message}'

import hashlib, json, os, time, urllib.parse
import requests  # pip install requests

BASE = "https://api.skillsafe.ai/v1/app-api"
TOKEN = os.environ.get("SKILLSAFE_TOKEN", "YOUR_TOKEN")  # step 2


class ApiError(Exception):
    def __init__(self, status, code, message, details=None):
        super().__init__(f"{status} {code}: {message}")
        self.status, self.code, self.details = status, code, details


def api(method, path, body=None, headers=None):
    h = {"Content-Type": "application/json"}
    if TOKEN:
        h["Authorization"] = "Bearer " + TOKEN
    h.update(headers or {})
    r = requests.request(method, BASE + path, headers=h,
                         data=None if body is None else json.dumps(body))
    try:
        env = r.json()
    except ValueError:
        env = {}
    if not r.ok:
        err = env.get("error") or {}
        raise ApiError(r.status_code, err.get("code"), err.get("message") or r.reason, err.get("details"))
    return env.get("data")

// scriptward.mjs -- Node 18+ (global fetch), run with: node scriptward.mjs
import { readFileSync } from "node:fs";
import { createHash } from "node:crypto";

const BASE = "https://api.skillsafe.ai/v1/app-api";
let TOKEN = "YOUR_TOKEN"; // step 2

async function api(method, path, body, headers = {}) {
  const h = { "Content-Type": "application/json", ...headers };
  if (TOKEN) h.Authorization = "Bearer " + TOKEN;
  const res = await fetch(BASE + path, {
    method,
    headers: h,
    body: body === undefined ? undefined : JSON.stringify(body),
  });
  const json = await res.json().catch(() => ({}));
  if (!res.ok) {
    const err = new Error((json.error && json.error.message) || res.statusText);
    err.status = res.status;
    err.code = json.error && json.error.code;
    err.details = json.error && json.error.details;
    throw err;
  }
  return json.data;
}

package main

import (
	"bufio"
	"bytes"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"net/http"
	"net/url"
	"os"
	"strings"
	"time"
)

const base = "https://api.skillsafe.ai/v1/app-api"

var token = os.Getenv("SKILLSAFE_TOKEN") // step 2

type apiError struct {
	Status  int
	Code    string
	Message string
}

func (e *apiError) Error() string { return fmt.Sprintf("%d %s: %s", e.Status, e.Code, e.Message) }

type envelope struct {
	OK    bool            `json:"ok"`
	Data  json.RawMessage `json:"data"`
	Error *struct {
		Code    string `json:"code"`
		Message string `json:"message"`
	} `json:"error"`
}

func newRequest(method, path string, body any, headers map[string]string) (*http.Request, error) {
	var buf []byte
	if body != nil {
		b, err := json.Marshal(body)
		if err != nil {
			return nil, err
		}
		buf = b
	}
	req, err := http.NewRequest(method, base+path, bytes.NewReader(buf))
	if err != nil {
		return nil, err
	}
	req.Header.Set("Content-Type", "application/json")
	if token != "" {
		req.Header.Set("Authorization", "Bearer "+token)
	}
	for k, v := range headers {
		req.Header.Set(k, v)
	}
	return req, nil
}

func errorFrom(res *http.Response, env envelope) error {
	e := &apiError{Status: res.StatusCode, Message: http.StatusText(res.StatusCode)}
	if env.Error != nil {
		e.Code = env.Error.Code
		if env.Error.Message != "" {
			e.Message = env.Error.Message
		}
	}
	return e
}

// api sends body as JSON and decodes the envelope's data into out (out may be nil).
func api(method, path string, body any, headers map[string]string, out any) error {
	req, err := newRequest(method, path, body, headers)
	if err != nil {
		return err
	}
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		return err
	}
	defer res.Body.Close()
	var env envelope
	_ = json.NewDecoder(res.Body).Decode(&env)
	if res.StatusCode < 200 || res.StatusCode > 299 {
		return errorFrom(res, env)
	}
	if out != nil && len(env.Data) > 0 {
		return json.Unmarshal(env.Data, out)
	}
	return nil
}

func main() {
	// steps 2-6 go here; remove any import a step you skip no longer uses
	_, _, _, _, _ = bufio.NewScanner, sha256.Sum256, hex.EncodeToString, url.PathEscape, strings.Index
	_ = time.Second
}

// Scriptward.java -- Java 17+, needs com.fasterxml.jackson.core:jackson-databind on the classpath
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.net.URI;
import java.net.URLEncoder;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import java.security.MessageDigest;
import java.util.*;
import java.util.stream.Collectors;
import java.util.stream.Stream;

public class Scriptward {
  static final String BASE = "https://api.skillsafe.ai/v1/app-api";
  static String token = System.getenv().getOrDefault("SKILLSAFE_TOKEN", "YOUR_TOKEN"); // step 2
  static final HttpClient HTTP = HttpClient.newHttpClient();
  static final ObjectMapper JSON = new ObjectMapper();

  static class ApiException extends Exception {
    final int status;
    final String code;
    ApiException(int status, String code, String message) {
      super(status + " " + code + ": " + message);
      this.status = status;
      this.code = code;
    }
  }

  static HttpRequest.Builder request(String method, String path, Object body, Map<String, String> headers) throws Exception {
    HttpRequest.Builder b = HttpRequest.newBuilder(URI.create(BASE + path))
        .header("Content-Type", "application/json")
        .method(method, body == null ? HttpRequest.BodyPublishers.noBody()
                                     : HttpRequest.BodyPublishers.ofString(JSON.writeValueAsString(body)));
    if (token != null && !token.isEmpty()) b.header("Authorization", "Bearer " + token);
    if (headers != null) headers.forEach(b::header);
    return b;
  }

  static ApiException errorFrom(int status, JsonNode env) {
    JsonNode err = env.path("error");
    return new ApiException(status, err.path("code").asText(null), err.path("message").asText("HTTP " + status));
  }

  static JsonNode api(String method, String path, Object body, Map<String, String> headers) throws Exception {
    HttpResponse<String> res = HTTP.send(request(method, path, body, headers).build(), HttpResponse.BodyHandlers.ofString());
    JsonNode env;
    try { env = JSON.readTree(res.body()); } catch (Exception e) { env = JSON.createObjectNode(); }
    if (env == null) env = JSON.createObjectNode();
    if (res.statusCode() / 100 != 2) throw errorFrom(res.statusCode(), env);
    return env.path("data");
  }

  public static void main(String[] args) throws Exception {
    // steps 2-6 go here (makeInput from step 4 goes next to api())
  }
}

require "digest"
require "json"
require "net/http"
require "uri"

BASE = "https://api.skillsafe.ai/v1/app-api"
$token = ENV.fetch("SKILLSAFE_TOKEN", "YOUR_TOKEN") # step 2

class ApiError < StandardError
  attr_reader :status, :code
  def initialize(status, code, message)
    super("#{status} #{code}: #{message}")
    @status = status
    @code = code
  end
end

def build_request(method, path, body = nil, headers = {})
  uri = URI(BASE + path)
  req = Net::HTTPGenericRequest.new(method, !body.nil?, true, uri.request_uri)
  req["Content-Type"] = "application/json"
  req["Authorization"] = "Bearer #{$token}" if $token && !$token.empty?
  headers.each { |k, v| req[k] = v }
  req.body = JSON.generate(body) unless body.nil?
  [uri, req]
end

def api(method, path, body = nil, headers = {})
  uri, req = build_request(method, path, body, headers)
  res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
  env = (JSON.parse(res.body) rescue {})
  env = {} unless env.is_a?(Hash)
  unless res.is_a?(Net::HTTPSuccess)
    err = env["error"] || {}
    raise ApiError.new(res.code.to_i, err["code"], err["message"] || res.message)
  end
  env["data"]
end

<?php
// needs the curl extension
const BASE = "https://api.skillsafe.ai/v1/app-api";
$TOKEN = getenv("SKILLSAFE_TOKEN") ?: "YOUR_TOKEN"; // step 2

class ApiError extends Exception {
    public $status;
    public $apiCode;
    public function __construct($status, $code, $message) {
        parent::__construct("$status $code: $message");
        $this->status = $status;
        $this->apiCode = $code;
    }
}

function headers_for(array $extra = []): array {
    global $TOKEN;
    $h = ["Content-Type: application/json"];
    if ($TOKEN) $h[] = "Authorization: Bearer $TOKEN";
    foreach ($extra as $k => $v) $h[] = "$k: $v";
    return $h;
}

function api(string $method, string $path, $body = null, array $headers = []) {
    $ch = curl_init(BASE . $path);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_HTTPHEADER => headers_for($headers),
        CURLOPT_RETURNTRANSFER => true,
    ]);
    if ($body !== null) curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE));
    $raw = curl_exec($ch);
    if ($raw === false) throw new RuntimeException(curl_error($ch));
    $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    curl_close($ch);
    $env = json_decode($raw);
    if (!is_object($env)) $env = new stdClass();
    if ($status < 200 || $status > 299) {
        $e = $env->error ?? new stdClass();
        throw new ApiError($status, $e->code ?? null, $e->message ?? "HTTP $status");
    }
    return $env->data ?? null;
}

// Program.cs -- .NET 6+ console app (implicit usings on) with top-level statements; steps 2-6 (with the MakeInput local function) go ABOVE this class
using System.Text;
using System.Text.Json;
using System.Text.Json.Nodes;

static class Api
{
    public const string Base = "https://api.skillsafe.ai/v1/app-api";
    public static string Token = Environment.GetEnvironmentVariable("SKILLSAFE_TOKEN") ?? "YOUR_TOKEN"; // step 2
    public static readonly HttpClient Http = new HttpClient();

    public class ApiException : Exception
    {
        public int Status;
        public string? Code;
        public ApiException(int status, string? code, string message) : base($"{status} {code}: {message}")
        {
            Status = status;
            Code = code;
        }
    }

    public static HttpRequestMessage Request(string method, string path, object? body = null, IDictionary<string, string>? headers = null)
    {
        var req = new HttpRequestMessage(new HttpMethod(method), Base + path);
        if (body != null) req.Content = new StringContent(JsonSerializer.Serialize(body), Encoding.UTF8, "application/json");
        if (!string.IsNullOrEmpty(Token)) req.Headers.TryAddWithoutValidation("Authorization", "Bearer " + Token);
        if (headers != null) foreach (var kv in headers) req.Headers.TryAddWithoutValidation(kv.Key, kv.Value);
        return req;
    }

    public static ApiException ErrorFrom(HttpResponseMessage res, JsonNode? env)
    {
        var err = env?["error"];
        return new ApiException((int)res.StatusCode, err?["code"]?.GetValue<string>(),
            err?["message"]?.GetValue<string>() ?? res.ReasonPhrase ?? "error");
    }

    public static async Task<JsonNode?> Call(string method, string path, object? body = null, IDictionary<string, string>? headers = null)
    {
        using var req = Request(method, path, body, headers);
        using var res = await Http.SendAsync(req);
        var text = await res.Content.ReadAsStringAsync();
        JsonNode? env = null;
        try { env = JsonNode.Parse(text); } catch (JsonException) { }
        if (!res.IsSuccessStatusCode) throw ErrorFrom(res, env);
        return env?["data"];
    }
}

Step 2 — a token

Two kinds work:

• Personal — needed for a run. Both lanes are metered in credits on gpt-terra, so a run needs a signed-in (user) token (the page says “The audit run is metered, so it needs an account.”, or the same of the fix run) unless the estimate says sponsor_enabled. Sign in and copy your token from /tokens.html, then export it as SKILLSAFE_TOKEN (the samples fall back to the placeholder YOUR_TOKEN).
• Guest — enough for /me and /estimate. POST /guest with {"slug": "scriptward"} and no Authorization header, exactly as sdk.js guest() does. The response’s data carries token and guest_id. Reuse a token you already hold rather than minting a new one each time.

# personal token (needed for a run): copy it from /tokens.html, then
#   export SKILLSAFE_TOKEN=...        and skip the rest of this block
# guest token (enough for /me and /estimate): no Authorization header on this one call
TOKEN=$(curl -sS -X POST "$BASE/guest" \
  -H "Content-Type: application/json" \
  -d '{"slug":"scriptward"}' | jq -r '.data.token')
echo "guest token: ${TOKEN:0:12}..."

# personal token (needed for a run): set SKILLSAFE_TOKEN (from /tokens.html) and skip this
if TOKEN in ("", "YOUR_TOKEN"):
    TOKEN = ""                      # no Authorization header on /guest
    guest = api("POST", "/guest", {"slug": "scriptward"})
    TOKEN = guest["token"]
    print("guest", guest.get("guest_id"))

// personal token (needed for a run): paste it from /tokens.html into TOKEN and skip this
if (!TOKEN || TOKEN === "YOUR_TOKEN") {
  TOKEN = "";                       // no Authorization header on /guest
  const guest = await api("POST", "/guest", { slug: "scriptward" });
  TOKEN = guest.token;
  console.log("guest", guest.guest_id);
}

// inside main -- personal token (needed for a run): set SKILLSAFE_TOKEN (from /tokens.html) and skip this
if token == "" {
	var guest struct {
		Token   string `json:"token"`
		GuestID string `json:"guest_id"`
	}
	if err := api("POST", "/guest", map[string]string{"slug": "scriptward"}, nil, &guest); err != nil {
		panic(err)
	}
	token = guest.Token
	fmt.Println("guest", guest.GuestID)
}

// inside main -- personal token (needed for a run): set SKILLSAFE_TOKEN (from /tokens.html) and skip this
if (token.isEmpty() || token.equals("YOUR_TOKEN")) {
  token = "";                       // no Authorization header on /guest
  JsonNode guest = api("POST", "/guest", Map.of("slug", "scriptward"), null);
  token = guest.path("token").asText();
  System.out.println("guest " + guest.path("guest_id").asText());
}

# personal token (needed for a run): set SKILLSAFE_TOKEN (from /tokens.html) and skip this
if $token.empty? || $token == "YOUR_TOKEN"
  $token = ""                       # no Authorization header on /guest
  guest = api("POST", "/guest", { slug: "scriptward" })
  $token = guest["token"]
  puts "guest #{guest["guest_id"]}"
end

// personal token (needed for a run): set SKILLSAFE_TOKEN (from /tokens.html) and skip this
if ($TOKEN === "" || $TOKEN === "YOUR_TOKEN") {
    $TOKEN = "";                    // no Authorization header on /guest
    $guest = api("POST", "/guest", ["slug" => "scriptward"]);
    $TOKEN = $guest->token;
    echo "guest {$guest->guest_id}\n";
}

// top-level statements (above the Api class) -- personal token (needed for a run): set SKILLSAFE_TOKEN (from /tokens.html) and skip this
if (Api.Token == "" || Api.Token == "YOUR_TOKEN")
{
    Api.Token = "";                 // no Authorization header on /guest
    var guest = await Api.Call("POST", "/guest", new { slug = "scriptward" });
    Api.Token = guest!["token"]!.GetValue<string>();
    Console.WriteLine($"guest {guest["guest_id"]}");
}

Step 3 — GET /me

Who the token belongs to and what it can spend. sdk.js documents the shape as {subject_type, subject_id, credits, profile?}. The page treats the caller as signed in only when subject_type is "user", shows credits as the balance (1 credit = $0.0001, so it divides by 10 000 for the dollar figure), and compares it with the estimate in step 4 before it lets you run.

api GET /me | jq '.data // .error'

me = api("GET", "/me")
print(me["subject_type"], me.get("subject_id"), me.get("credits"))
signed_in = me["subject_type"] == "user"

const me = await api("GET", "/me");
console.log(me.subject_type, me.subject_id, me.credits);
const signedIn = me.subject_type === "user";

var me struct {
	SubjectType string `json:"subject_type"`
	SubjectID   any    `json:"subject_id"`
	Credits     any    `json:"credits"`
}
if err := api("GET", "/me", nil, nil, &me); err != nil {
	panic(err)
}
fmt.Println(me.SubjectType, me.SubjectID, me.Credits)
signedIn := me.SubjectType == "user"
_ = signedIn

JsonNode me = api("GET", "/me", null, null);
System.out.println(me.path("subject_type").asText() + " " + me.path("subject_id").asText() + " " + me.path("credits"));
boolean signedIn = me.path("subject_type").asText().equals("user");

me = api("GET", "/me")
puts [me["subject_type"], me["subject_id"], me["credits"]].join(" ")
signed_in = me["subject_type"] == "user"

$me = api("GET", "/me");
echo $me->subject_type, " ", $me->subject_id ?? "", " ", $me->credits ?? "", "\n";
$signedIn = $me->subject_type === "user";

var me = await Api.Call("GET", "/me");
Console.WriteLine($"{me?["subject_type"]} {me?["subject_id"]} {me?["credits"]}");
var signedIn = me?["subject_type"]?.GetValue<string>() == "user";

Step 4 — build the input, then POST /estimate

First a small makeInput that does what buildInput does: task, then code as the paste the page would send, facts as a compact JSON string, the note when it is not blank, and — for the fix lane only — the audit_handoff string when the file carries one. It reads the file build-check.js (or handoff.js) printed. The samples build the audit input of the player example from player-check.json; step 6 reuses makeInput for the turret (fix) example. Then price it. The body of /estimate is the same input you will send to /run; no job is created and nothing is charged — /estimate is free. From the response the page reads:

The page re-prices whenever the paste, the note or the lane change. The amounts grow with the size of code and facts, so read them from the call rather than hard-coding them.

# player-check.json: printed by build-check.js (see "The facts string").
# (.facts | tojson) turns the facts into ONE compact string, as JSON.stringify does.
BODY=$(jq -c --arg note "Porting the player from our Godot 3 prototype. It will not even open in 4.3 - what do we fix first?" \
  '{task: "audit", code, facts: (.facts | tojson), note: $note}' player-check.json)
# No page check at hand? facts: "{}" is accepted as a string, but the reply then has no page flags to answer.
# Fix lane after an audit: read handoff.js's output instead and add its string:
#   '{task: "fix", code, facts: (.facts | tojson), note: $note} + (if .audit_handoff then {audit_handoff} else {} end)'

api POST /estimate -d "$BODY" \
  | jq '.error // (.data | {hold_credits, min_credits, sponsor_enabled, warnings})'

def make_input(task, check_path, note=None):
    """The body the page sends: task, code, facts as a JSON STRING, an optional note, and
    (fix lane only) the audit_handoff string -- every value a string."""
    with open(check_path, encoding="utf-8") as f:
        check = json.load(f)                    # build-check.js (or handoff.js) output
    inp = {
        "task": task,
        "code": check["code"],                  # the paste as the page sends it
        "facts": json.dumps(check["facts"], separators=(",", ":"), ensure_ascii=False),  # a STRING, like JSON.stringify
    }
    n = (note or "").strip()
    if n:
        inp["note"] = n[:2000]                  # optional; the page caps it at 2000 chars
    if task == "fix" and check.get("audit_handoff"):
        inp["audit_handoff"] = check["audit_handoff"]   # optional; already a JSON string
    return inp


inp = make_input("audit", "player-check.json",
                 "Porting the player from our Godot 3 prototype. It will not even open in 4.3 - what do we fix first?")

est = api("POST", "/estimate", inp)
print("hold", est.get("hold_credits"), "min", est.get("min_credits"),
      "sponsored", est.get("sponsor_enabled"), "warnings", est.get("warnings") or [])

// The body the page sends: task, code, facts as a JSON STRING, an optional note,
// and (fix lane only) the audit_handoff string -- every value a string.
function makeInput(task, checkPath, note) {
  const check = JSON.parse(readFileSync(checkPath, "utf8"));          // build-check.js (or handoff.js) output
  const input = {
    task,
    code: check.code,                                                 // the paste as the page sends it
    facts: JSON.stringify(check.facts),                               // a STRING: the page's free check
  };
  const n = (note || "").trim();
  if (n) input.note = n.length > 2000 ? n.slice(0, 2000) : n;         // optional; max 2000 chars
  if (task === "fix" && check.audit_handoff) input.audit_handoff = check.audit_handoff;  // optional
  return input;
}

const input = makeInput("audit", "player-check.json",
  "Porting the player from our Godot 3 prototype. It will not even open in 4.3 - what do we fix first?");

const est = await api("POST", "/estimate", input);
console.log("hold", est.hold_credits, "min", est.min_credits,
  "sponsored", est.sponsor_enabled, "warnings", est.warnings || []);

// makeInput builds the body the page sends: task, code, facts as a JSON STRING,
// an optional note and (fix lane only) the audit_handoff string.
makeInput := func(task, checkPath, note string) map[string]any {
	raw, err := os.ReadFile(checkPath) // build-check.js (or handoff.js) output
	if err != nil {
		panic(err)
	}
	var check struct {
		Code         string          `json:"code"`
		Facts        json.RawMessage `json:"facts"`
		AuditHandoff string          `json:"audit_handoff"`
	}
	if err := json.Unmarshal(raw, &check); err != nil {
		panic(err)
	}
	var facts bytes.Buffer
	if err := json.Compact(&facts, check.Facts); err != nil { // keeps key order; travels as a STRING
		panic(err)
	}
	in := map[string]any{"task": task, "code": check.Code, "facts": facts.String()}
	if n := []rune(strings.TrimSpace(note)); len(n) > 0 {
		if len(n) > 2000 {
			n = n[:2000] // optional; the page caps it at 2000 chars
		}
		in["note"] = string(n)
	}
	if task == "fix" && check.AuditHandoff != "" {
		in["audit_handoff"] = check.AuditHandoff // optional; already a JSON string
	}
	return in
}

input := makeInput("audit", "player-check.json",
	"Porting the player from our Godot 3 prototype. It will not even open in 4.3 - what do we fix first?")

var est struct {
	HoldCredits    any   `json:"hold_credits"`
	MinCredits     any   `json:"min_credits"`
	SponsorEnabled bool  `json:"sponsor_enabled"`
	Warnings       []any `json:"warnings"`
}
if err := api("POST", "/estimate", input, nil, &est); err != nil {
	panic(err)
}
fmt.Printf("hold %v min %v sponsored %v warnings %v\n", est.HoldCredits, est.MinCredits, est.SponsorEnabled, est.Warnings)

// ---- add to the Scriptward class, next to api(): the body the page sends
static Map<String, Object> makeInput(String task, String checkPath, String note) throws Exception {
  JsonNode check = JSON.readTree(Files.readString(Path.of(checkPath)));        // build-check.js (or handoff.js) output
  Map<String, Object> in = new LinkedHashMap<>();
  in.put("task", task);
  in.put("code", check.path("code").asText());                                 // the paste as the page sends it
  in.put("facts", JSON.writeValueAsString(check.path("facts")));               // a STRING, compact
  String n = note == null ? "" : note.strip();
  if (!n.isEmpty()) in.put("note", n.length() > 2000 ? n.substring(0, 2000) : n);  // optional; max 2000 chars
  if (task.equals("fix") && check.hasNonNull("audit_handoff")) in.put("audit_handoff", check.get("audit_handoff").asText());
  return in;
}

// ---- inside main
Map<String, Object> input = makeInput("audit", "player-check.json",
    "Porting the player from our Godot 3 prototype. It will not even open in 4.3 - what do we fix first?");

JsonNode est = api("POST", "/estimate", input, null);
System.out.println("hold " + est.path("hold_credits") + " min " + est.path("min_credits")
    + " sponsored " + est.path("sponsor_enabled").asBoolean(false) + " warnings " + est.path("warnings"));

# The body the page sends: task, code, facts as a JSON STRING, an optional note,
# and (fix lane only) the audit_handoff string -- every value a string.
def make_input(task, check_path, note = nil)
  check = JSON.parse(File.read(check_path, encoding: "UTF-8"))   # build-check.js (or handoff.js) output
  input = {
    task: task,
    code: check["code"],                                            # the paste as the page sends it
    facts: JSON.generate(check["facts"])                            # a STRING, compact
  }
  n = note.to_s.strip
  input[:note] = n[0, 2000] unless n.empty?                         # optional; max 2000 chars
  input[:audit_handoff] = check["audit_handoff"] if task == "fix" && !check["audit_handoff"].to_s.empty?
  input
end

input = make_input("audit", "player-check.json",
                   "Porting the player from our Godot 3 prototype. It will not even open in 4.3 - what do we fix first?")

est = api("POST", "/estimate", input)
puts "hold #{est["hold_credits"]} min #{est["min_credits"]} " \
     "sponsored #{est["sponsor_enabled"]} warnings #{(est["warnings"] || []).inspect}"

// The body the page sends: task, code, facts as a JSON STRING, an optional note,
// and (fix lane only) the audit_handoff string -- every value a string.
function make_input(string $task, string $checkPath, string $note = ""): array {
    // decode to objects (not arrays) so an empty {} stays {} when re-encoded
    $check = json_decode(file_get_contents($checkPath));          // build-check.js (or handoff.js) output
    $input = [
        "task" => $task,
        "code" => $check->code,                                    // the paste as the page sends it
        "facts" => json_encode($check->facts, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE),  // a STRING
    ];
    $n = trim($note);
    if ($n !== "") $input["note"] = mb_substr($n, 0, 2000);        // optional; max 2000 chars
    if ($task === "fix" && !empty($check->audit_handoff)) $input["audit_handoff"] = $check->audit_handoff;
    return $input;
}

$input = make_input("audit", "player-check.json",
    "Porting the player from our Godot 3 prototype. It will not even open in 4.3 - what do we fix first?");

$est = api("POST", "/estimate", $input);
echo "hold ", $est->hold_credits ?? "-", " min ", $est->min_credits ?? "-",
     " sponsored ", json_encode($est->sponsor_enabled ?? false),
     " warnings ", json_encode($est->warnings ?? []), "\n";

// The body the page sends: task, code, facts as a JSON STRING, an optional note,
// and (fix lane only) the audit_handoff string -- every value a string.
static Dictionary<string, string> MakeInput(string task, string checkPath, string? note = null)
{
    var compact = new JsonSerializerOptions { Encoder = System.Text.Encodings.Web.JavaScriptEncoder.UnsafeRelaxedJsonEscaping };
    var check = JsonNode.Parse(File.ReadAllText(checkPath))!;               // build-check.js (or handoff.js) output
    var input = new Dictionary<string, string>
    {
        ["task"] = task,
        ["code"] = check["code"]!.GetValue<string>(),                         // the paste as the page sends it
        ["facts"] = check["facts"]!.ToJsonString(compact),                    // a STRING, compact
    };
    var n = (note ?? "").Trim();
    if (n.Length > 0) input["note"] = n.Length > 2000 ? n[..2000] : n;       // optional; max 2000 chars
    var handoff = check["audit_handoff"]?.GetValue<string>();
    if (task == "fix" && !string.IsNullOrEmpty(handoff)) input["audit_handoff"] = handoff;
    return input;
}

var input = MakeInput("audit", "player-check.json",
    "Porting the player from our Godot 3 prototype. It will not even open in 4.3 - what do we fix first?");

var est = await Api.Call("POST", "/estimate", input);
Console.WriteLine($"hold {est?["hold_credits"]} min {est?["min_credits"]} " +
    $"sponsored {est?["sponsor_enabled"]} warnings {est?["warnings"]?.ToJsonString() ?? "[]"}");

Step 5 — POST /run, then poll the job (audit)

Send the same input to /run with an Idempotency-Key header, using a personal token. Its data carries a job_id. Poll GET /jobs/{job_id} the way sdk.js waitForJob does: every second until status is succeeded or failed, giving up on the client side after 180 seconds. On the finished job, read:

• output.output — the model’s reply as a string: the JSON object from the output contract of the lane you asked for. Parse it yourself (from the first { to the last }). The samples print the verdict and headline, each area’s status, each finding’s id, file, line, severity and number of edits, then each flag answer. Keep the text: recheck.js reads it.
• truncated — true when the reply was cut short because the balance ran out. The page then closes the cut-off JSON, shows what arrived as a partial result (“N of 9 sections recovered” for an audit, of 8 for a fix run), and says it was cut short by the available balance.
• charged_credits — the real cost of the run, as opposed to the estimate’s hold_credits reservation. The page re-reads /me afterwards for the new balance.
• error — on a failed job.

Idempotency key. Resending a request with the same key must not start a second paid run, so derive the key from the input, not from the clock — and include the lane, so an audit and a fix run of the same paste never share a key. The page uses scriptward:<lane>:<inputHash>:a<attempt> (app.js run), where <lane> is audit or fix, <inputHash> is a 32-bit djb2 hash of JSON.stringify(input) in hex, a dash, and the string’s length in hex (app.js inputHash, over the input without retry_note), and <attempt> is 1 for a normal run and 2 for the automatic reformat retry (which also adds retry_note). For the two worked examples that is scriptward:audit:a1de78f0-27ad:a1 (player audit) and scriptward:fix:b0fdeb55-18f5:a1 (turret fix); the fix run of the player audit handed on (above) is scriptward:fix:12f96ec6-25d8:a1. The format is the page’s convention, not a requirement: any stable, unique string does. The samples below use the lane and a SHA-256 prefix.

The page itself uses /run-stream (step 6), not /run; both take the same body and header.

KEY="scriptward:audit:$(printf '%s' "$BODY" | shasum -a 256 | cut -c1-16):a1"

JOB=$(api POST /run -H "Idempotency-Key: $KEY" -d "$BODY" | jq -r '.data.job_id')

for i in $(seq 180); do                       # 1 s interval, 180 s client-side limit
  J=$(api GET "/jobs/$JOB")
  S=$(printf '%s' "$J" | jq -r '.data.status')
  if [ "$S" = "succeeded" ] || [ "$S" = "failed" ]; then break; fi
  sleep 1
done

printf '%s' "$J" | jq '.data | {status, truncated, charged_credits, error}'
printf '%s' "$J" | jq -r '.data.output.output' \
  | jq '{verdict, headline, areas: [(.areas // [])[] | {area, status}],
         findings: [(.findings // [])[] | {id, file, line, severity, edits: ((.edits // []) | length)}],
         flag_answers: [(.flag_answers // [])[] | {flag, status}]}'

body = json.dumps(inp)
key = "scriptward:audit:" + hashlib.sha256(body.encode()).hexdigest()[:16] + ":a1"

job_id = api("POST", "/run", inp, {"Idempotency-Key": key})["job_id"]

deadline = time.time() + 180                    # 1 s interval, 180 s client-side limit
while True:
    job = api("GET", "/jobs/" + urllib.parse.quote(job_id, safe=""))
    if job["status"] in ("succeeded", "failed"):
        break
    if time.time() > deadline:
        raise TimeoutError("job timed out")
    time.sleep(1)

if job["status"] == "failed":
    raise SystemExit(f"run failed: {job.get('error')}")

print("truncated:", job.get("truncated") is True, "charged:", job.get("charged_credits"))
text = (job.get("output") or {}).get("output") or ""
reply = json.loads(text[text.index("{"): text.rindex("}") + 1])
print(reply["verdict"], "-", reply["headline"])
for s in reply.get("areas", []):
    print("area", s["area"], s["status"])
for f in reply.get("findings", []):
    print(f["id"], f["file"], f.get("line"), f["severity"], len(f.get("edits") or []), "edit(s)")
for a in reply.get("flag_answers", []):
    print("answer", a["flag"], a["status"])

const key = "scriptward:audit:" +
  createHash("sha256").update(JSON.stringify(input)).digest("hex").slice(0, 16) + ":a1";

const { job_id } = await api("POST", "/run", input, { "Idempotency-Key": key });

let job;
const deadline = Date.now() + 180000;           // 1 s interval, 180 s client-side limit
for (;;) {
  job = await api("GET", "/jobs/" + encodeURIComponent(job_id));
  if (job.status === "succeeded" || job.status === "failed") break;
  if (Date.now() > deadline) throw new Error("job timed out");
  await new Promise((r) => setTimeout(r, 1000));
}
if (job.status === "failed") throw new Error("run failed: " + JSON.stringify(job.error));

console.log("truncated:", job.truncated === true, "charged:", job.charged_credits);
const text = (job.output && job.output.output) || "";
const reply = JSON.parse(text.slice(text.indexOf("{"), text.lastIndexOf("}") + 1));
console.log(reply.verdict, "-", reply.headline);
for (const s of reply.areas || []) console.log("area", s.area, s.status);
for (const f of reply.findings || []) console.log(f.id, f.file, f.line, f.severity, (f.edits || []).length, "edit(s)");
for (const a of reply.flag_answers || []) console.log("answer", a.flag, a.status);

inputJSON, _ := json.Marshal(input)
sum := sha256.Sum256(inputJSON)
key := "scriptward:audit:" + hex.EncodeToString(sum[:8]) + ":a1"

var started struct {
	JobID string `json:"job_id"`
}
if err := api("POST", "/run", input, map[string]string{"Idempotency-Key": key}, &started); err != nil {
	panic(err)
}

type jobT struct {
	Status string `json:"status"`
	Output *struct {
		Output string `json:"output"`
	} `json:"output"`
	Truncated      bool `json:"truncated"`
	ChargedCredits any  `json:"charged_credits"`
	Error          any  `json:"error"`
}
var job jobT
deadline := time.Now().Add(180 * time.Second) // 1 s interval, 180 s client-side limit
for {
	job = jobT{}
	if err := api("GET", "/jobs/"+url.PathEscape(started.JobID), nil, nil, &job); err != nil {
		panic(err)
	}
	if job.Status == "succeeded" || job.Status == "failed" {
		break
	}
	if time.Now().After(deadline) {
		panic("job timed out")
	}
	time.Sleep(time.Second)
}
if job.Status == "failed" {
	panic(fmt.Sprintf("run failed: %v", job.Error))
}

fmt.Println("truncated:", job.Truncated, "charged:", job.ChargedCredits)
text := ""
if job.Output != nil {
	text = job.Output.Output
}
var reply map[string]any
if a, b := strings.Index(text, "{"), strings.LastIndex(text, "}"); a >= 0 && b > a {
	if err := json.Unmarshal([]byte(text[a:b+1]), &reply); err != nil {
		panic(err)
	}
}
fmt.Println(reply["verdict"], "-", reply["headline"])
areas, _ := reply["areas"].([]any)
for _, e := range areas {
	s, _ := e.(map[string]any)
	fmt.Println("area", s["area"], s["status"])
}
findings, _ := reply["findings"].([]any)
for _, e := range findings {
	f, _ := e.(map[string]any)
	edits, _ := f["edits"].([]any)
	fmt.Println(f["id"], f["file"], f["line"], f["severity"], len(edits), "edit(s)")
}
answers, _ := reply["flag_answers"].([]any)
for _, e := range answers {
	a, _ := e.(map[string]any)
	fmt.Println("answer", a["flag"], a["status"])
}

byte[] digest = MessageDigest.getInstance("SHA-256").digest(JSON.writeValueAsBytes(input));
String key = "scriptward:audit:" + HexFormat.of().formatHex(digest, 0, 8) + ":a1";

String jobId = api("POST", "/run", input, Map.of("Idempotency-Key", key)).path("job_id").asText();

JsonNode job;
long deadline = System.currentTimeMillis() + 180_000;   // 1 s interval, 180 s client-side limit
while (true) {
  job = api("GET", "/jobs/" + URLEncoder.encode(jobId, StandardCharsets.UTF_8), null, null);
  String s = job.path("status").asText();
  if (s.equals("succeeded") || s.equals("failed")) break;
  if (System.currentTimeMillis() > deadline) throw new RuntimeException("job timed out");
  Thread.sleep(1000);
}
if (job.path("status").asText().equals("failed")) throw new RuntimeException("run failed: " + job.path("error"));

System.out.println("truncated: " + job.path("truncated").asBoolean(false) + ", charged: " + job.path("charged_credits"));
String text = job.path("output").path("output").asText("");
JsonNode reply = JSON.readTree(text.substring(text.indexOf('{'), text.lastIndexOf('}') + 1));
System.out.println(reply.path("verdict").asText() + " - " + reply.path("headline").asText());
for (JsonNode s : reply.path("areas")) {
  System.out.println("area " + s.path("area").asText() + " " + s.path("status").asText());
}
for (JsonNode f : reply.path("findings")) {
  System.out.println(f.path("id").asText() + " " + f.path("file").asText() + " " + f.path("line") + " "
      + f.path("severity").asText() + " " + f.path("edits").size() + " edit(s)");
}
for (JsonNode a : reply.path("flag_answers")) {
  System.out.println("answer " + a.path("flag").asText() + " " + a.path("status").asText());
}

key = "scriptward:audit:#{Digest::SHA256.hexdigest(JSON.generate(input))[0, 16]}:a1"

job_id = api("POST", "/run", input, { "Idempotency-Key" => key })["job_id"]

deadline = Time.now + 180                       # 1 s interval, 180 s client-side limit
job = nil
loop do
  job = api("GET", "/jobs/#{URI.encode_www_form_component(job_id)}")
  break if %w[succeeded failed].include?(job["status"])
  raise "job timed out" if Time.now > deadline
  sleep 1
end
raise "run failed: #{job["error"].inspect}" if job["status"] == "failed"

puts "truncated: #{job["truncated"] == true}, charged: #{job["charged_credits"]}"
text = (job["output"] || {})["output"].to_s
reply = JSON.parse(text[text.index("{")..text.rindex("}")])
puts "#{reply["verdict"]} - #{reply["headline"]}"
(reply["areas"] || []).each { |s| puts "area #{s["area"]} #{s["status"]}" }
(reply["findings"] || []).each { |f| puts "#{f["id"]} #{f["file"]} #{f["line"].inspect} #{f["severity"]} #{(f["edits"] || []).size} edit(s)" }
(reply["flag_answers"] || []).each { |a| puts "answer #{a["flag"]} #{a["status"]}" }

$key = "scriptward:audit:" . substr(hash("sha256", json_encode($input)), 0, 16) . ":a1";

$jobId = api("POST", "/run", $input, ["Idempotency-Key" => $key])->job_id;

$deadline = time() + 180;                       // 1 s interval, 180 s client-side limit
while (true) {
    $job = api("GET", "/jobs/" . rawurlencode($jobId));
    if (in_array($job->status, ["succeeded", "failed"], true)) break;
    if (time() > $deadline) throw new RuntimeException("job timed out");
    sleep(1);
}
if ($job->status === "failed") throw new RuntimeException("run failed: " . json_encode($job->error ?? null));

echo "truncated: ", json_encode(($job->truncated ?? false) === true), ", charged: ", $job->charged_credits ?? "-", "\n";
$text = $job->output->output ?? "";
$reply = json_decode(substr($text, strpos($text, "{"), strrpos($text, "}") - strpos($text, "{") + 1));
echo $reply->verdict, " - ", $reply->headline, "\n";
foreach ($reply->areas ?? [] as $s) echo "area ", $s->area, " ", $s->status, "\n";
foreach ($reply->findings ?? [] as $f) echo $f->id, " ", $f->file, " ", json_encode($f->line ?? null), " ", $f->severity, " ", count($f->edits ?? []), " edit(s)\n";
foreach ($reply->flag_answers ?? [] as $a) echo "answer ", $a->flag, " ", $a->status, "\n";

var digest = System.Security.Cryptography.SHA256.HashData(Encoding.UTF8.GetBytes(JsonSerializer.Serialize(input)));
var key = "scriptward:audit:" + Convert.ToHexString(digest, 0, 8).ToLowerInvariant() + ":a1";

var started = await Api.Call("POST", "/run", input, new Dictionary<string, string> { ["Idempotency-Key"] = key });
var jobId = started!["job_id"]!.GetValue<string>();

JsonNode job;
var deadline = DateTime.UtcNow.AddSeconds(180);   // 1 s interval, 180 s client-side limit
while (true)
{
    job = (await Api.Call("GET", "/jobs/" + Uri.EscapeDataString(jobId)))!;
    var s = job["status"]?.GetValue<string>();
    if (s == "succeeded" || s == "failed") break;
    if (DateTime.UtcNow > deadline) throw new TimeoutException("job timed out");
    await Task.Delay(1000);
}
if (job["status"]?.GetValue<string>() == "failed") throw new Exception($"run failed: {job["error"]?.ToJsonString()}");

var truncated = job["truncated"] is JsonValue t && t.TryGetValue(out bool tb) && tb;
Console.WriteLine($"truncated: {truncated}, charged: {job["charged_credits"]}");
var text = job["output"]?["output"]?.GetValue<string>() ?? "";
var reply = JsonNode.Parse(text[text.IndexOf('{')..(text.LastIndexOf('}') + 1)])!;
Console.WriteLine($"{reply["verdict"]} - {reply["headline"]}");
foreach (var s in reply["areas"]?.AsArray() ?? new JsonArray())
    Console.WriteLine($"area {s?["area"]} {s?["status"]}");
foreach (var f in reply["findings"]?.AsArray() ?? new JsonArray())
    Console.WriteLine($"{f?["id"]} {f?["file"]} {f?["line"]?.ToJsonString() ?? "null"} {f?["severity"]} {f?["edits"]?.AsArray().Count ?? 0} edit(s)");
foreach (var a in reply["flag_answers"]?.AsArray() ?? new JsonArray())
    Console.WriteLine($"answer {a?["flag"]} {a?["status"]}");

Step 6 — POST /run-stream (Server-Sent Events, fix)

The alternative to step 5, and what the page uses: same kind of body, same Idempotency-Key header, one request. Run one or the other for a given input, not both. To show the second lane, the samples build the fix input of the turret example (with its own key) and stream it; to stream the audit input instead, pass the step 4 input and key. The response is text/event-stream. sdk.js splits it into frames on a blank line, takes the event name from an event: line (default message) and concatenates the data: lines, skips frames with no data or with data that is not JSON, and handles these events:

If the response is not text/event-stream, it is an ordinary JSON envelope: the SDK returns its data (an idempotent replay returns this way) or raises the error on a non-2xx status. Handle both shapes.

From the final payload the page reads output.output (falling back to the concatenated delta text), truncated and charged_credits. Browsers receive progress ticks rather than deltas from this endpoint, so the page relies on the final payload; if the stream fails part-way, it tries to recover a partial reply from whatever delta text arrived. The samples print the verdict and headline, each returned file’s path and size, each change (function, flags and change), each verification step, each open item and each question. To put the files into the paste and re-check them the way the page’s “Put every file into the paste” does, keep the reply text and run recheck.js with the lane fix. To fix code you audited, read handoff.js’s output instead of turret-check.json: makeInput then carries its audit_handoff.

# the fix worked example: turret-check.json from build-check.js
# (for audited code, read handoff.js's output instead; the + (...) adds its audit_handoff)
FBODY=$(jq -c --arg note "The turret spins faster on my 144 Hz monitor and the game hitches every time it fires. Fix those. Leave the free() in take_hit exactly as it is for now - the level script checks for the turret on the same frame, and we will change both together." \
  '{task: "fix", code, facts: (.facts | tojson), note: $note} + (if .audit_handoff then {audit_handoff} else {} end)' \
  turret-check.json)
FKEY="scriptward:fix:$(printf '%s' "$FBODY" | shasum -a 256 | cut -c1-16):a1"

# -N turns off buffering; the whole stream lands in $STREAM
STREAM=$(api POST /run-stream -N -H "Idempotency-Key: $FKEY" -d "$FBODY")

# frames look like:
#   event: job
#   data: {...}
#
#   event: done
#   data: {"job_id":"...","status":"...","charged_credits":...,"output":{"output":"{\"task\":\"fix\",...}"}}

# the final reply text, from the done (or pending) frame:
REPLY=$(printf '%s\n' "$STREAM" \
  | awk '/^event:/{ev=$2} /^data:/ && (ev=="done" || ev=="pending"){sub(/^data: */,""); print}' \
  | jq -r '.output.output')
# an idempotent replay answers with a plain JSON envelope instead: REPLY=$(printf '%s' "$STREAM" | jq -r '.data.output.output')
printf '%s' "$REPLY" | jq '{verdict, headline,
  files: [(.files // [])[] | {path, characters: (.content | length)}],
  changes: [(.changes // [])[] | {function, flags, change}], verify, open, questions}'

# the fix worked example: turret-check.json from build-check.js
# (for audited code, pass handoff.js's output instead: make_input adds its audit_handoff)
fix_inp = make_input("fix", "turret-check.json",
                     "The turret spins faster on my 144 Hz monitor and the game hitches every time it fires. Fix those. Leave the free() in take_hit exactly as it is for now - the level script checks for the turret on the same frame, and we will change both together.")
fix_key = "scriptward:fix:" + hashlib.sha256(json.dumps(fix_inp).encode()).hexdigest()[:16] + ":a1"

h = {"Content-Type": "application/json", "Authorization": "Bearer " + TOKEN, "Idempotency-Key": fix_key}
done, failure, streamed = None, None, ""
with requests.post(BASE + "/run-stream", headers=h, data=json.dumps(fix_inp), stream=True) as r:
    if "text/event-stream" not in r.headers.get("content-type", ""):
        try:
            env = r.json()
        except ValueError:
            env = {}
        if not r.ok:
            err = env.get("error") or {}
            raise ApiError(r.status_code, err.get("code"), err.get("message") or r.reason)
        done = env.get("data")
    else:
        event, data = "message", ""
        for line in r.iter_lines(decode_unicode=True):
            if line == "":                          # a blank line ends a frame
                if data:
                    try:
                        payload = json.loads(data)
                    except ValueError:
                        payload = None
                    if event == "delta" and payload is not None:
                        streamed += payload.get("text") or ""
                    elif event == "job":
                        print("job", payload)
                    elif event in ("done", "pending"):
                        done = payload
                    elif event == "error":
                        failure = payload
                event, data = "message", ""
            elif line.startswith("event:"):
                event = line[6:].strip()
            elif line.startswith("data:"):
                data += line[5:].strip()

if failure:
    raise SystemExit(f"{failure.get('code')}: {failure.get('message')} (job {failure.get('job_id')})")
done = done or {}
full = (done.get("output") or {}).get("output") or streamed
print("truncated:", done.get("truncated") is True, "charged:", done.get("charged_credits"))
result = json.loads(full[full.index("{"): full.rindex("}") + 1])
print(result["verdict"], "-", result["headline"])
for f in result.get("files", []):
    print("file", f["path"], len(f.get("content") or ""), "characters")
for c in result.get("changes", []):
    print("change", c.get("function"), ",".join(c.get("flags") or []) or "-", "-", c.get("change"))
for step in result.get("verify", []):
    print("verify", step)
for o in result.get("open", []):
    print("open", o["item"], "-", o.get("reason"))
for q in result.get("questions", []):
    print("question", q)

// the fix worked example: turret-check.json from build-check.js
// (for audited code, pass handoff.js's output instead: makeInput adds its audit_handoff)
const fixInput = makeInput("fix", "turret-check.json",
  "The turret spins faster on my 144 Hz monitor and the game hitches every time it fires. Fix those. Leave the free() in take_hit exactly as it is for now - the level script checks for the turret on the same frame, and we will change both together.");
const fixKey = "scriptward:fix:" +
  createHash("sha256").update(JSON.stringify(fixInput)).digest("hex").slice(0, 16) + ":a1";

const res = await fetch(BASE + "/run-stream", {
  method: "POST",
  headers: { "Content-Type": "application/json", Authorization: "Bearer " + TOKEN, "Idempotency-Key": fixKey },
  body: JSON.stringify(fixInput),
});

let done = null, failure = null, streamed = "";
if (!(res.headers.get("content-type") || "").includes("text/event-stream")) {
  const json = await res.json().catch(() => ({}));
  if (!res.ok) throw new Error((json.error && json.error.message) || res.statusText);
  done = json.data;
} else {
  const reader = res.body.getReader();
  const decoder = new TextDecoder();
  let buffer = "";
  for (;;) {
    const chunk = await reader.read();
    if (chunk.done) break;
    buffer += decoder.decode(chunk.value, { stream: true });
    let idx;
    while ((idx = buffer.indexOf("\n\n")) >= 0) {
      const frame = buffer.slice(0, idx);
      buffer = buffer.slice(idx + 2);
      let event = "message", dataStr = "";
      for (const line of frame.split("\n")) {
        if (line.startsWith("event:")) event = line.slice(6).trim();
        else if (line.startsWith("data:")) dataStr += line.slice(5).trim();
      }
      if (!dataStr) continue;
      let data;
      try { data = JSON.parse(dataStr); } catch { continue; }
      if (event === "delta") streamed += data.text || "";
      else if (event === "job") console.log("job", data);
      else if (event === "done" || event === "pending") done = data;
      else if (event === "error") failure = data;
    }
  }
}
if (failure) throw new Error(`${failure.code}: ${failure.message} (job ${failure.job_id})`);

const full = (done && done.output && done.output.output) || streamed;
console.log("truncated:", !!(done && done.truncated), "charged:", done && done.charged_credits);
const result = JSON.parse(full.slice(full.indexOf("{"), full.lastIndexOf("}") + 1));
console.log(result.verdict, "-", result.headline);
for (const f of result.files || []) console.log("file", f.path, (f.content || "").length, "characters");
for (const c of result.changes || []) console.log("change", c.function, (c.flags || []).join(",") || "-", "-", c.change);
for (const step of result.verify || []) console.log("verify", step);
for (const o of result.open || []) console.log("open", o.item, "-", o.reason);
for (const q of result.questions || []) console.log("question", q);

// the fix worked example: turret-check.json from build-check.js
// (for audited code, pass handoff.js's output instead: makeInput adds its audit_handoff)
fixInput := makeInput("fix", "turret-check.json",
	"The turret spins faster on my 144 Hz monitor and the game hitches every time it fires. Fix those. Leave the free() in take_hit exactly as it is for now - the level script checks for the turret on the same frame, and we will change both together.")
fixJSON, _ := json.Marshal(fixInput)
fixSum := sha256.Sum256(fixJSON)
fixKey := "scriptward:fix:" + hex.EncodeToString(fixSum[:8]) + ":a1"

sreq, err := newRequest("POST", "/run-stream", fixInput, map[string]string{"Idempotency-Key": fixKey})
if err != nil {
	panic(err)
}
sres, err := http.DefaultClient.Do(sreq)
if err != nil {
	panic(err)
}
defer sres.Body.Close()

var done, failure map[string]any
var streamed strings.Builder
if !strings.Contains(sres.Header.Get("Content-Type"), "text/event-stream") {
	var env envelope
	_ = json.NewDecoder(sres.Body).Decode(&env)
	if sres.StatusCode < 200 || sres.StatusCode > 299 {
		panic(errorFrom(sres, env))
	}
	_ = json.Unmarshal(env.Data, &done)
} else {
	sc := bufio.NewScanner(sres.Body)
	sc.Buffer(make([]byte, 64*1024), 16*1024*1024) // the done frame can be long
	event, data := "message", ""
	for sc.Scan() {
		line := sc.Text()
		switch {
		case line == "": // a blank line ends a frame
			if data != "" {
				var p map[string]any
				if json.Unmarshal([]byte(data), &p) == nil {
					switch event {
					case "delta":
						if t, ok := p["text"].(string); ok {
							streamed.WriteString(t)
						}
					case "job":
						fmt.Println("job", p)
					case "done", "pending":
						done = p
					case "error":
						failure = p
					}
				}
			}
			event, data = "message", ""
		case strings.HasPrefix(line, "event:"):
			event = strings.TrimSpace(line[6:])
		case strings.HasPrefix(line, "data:"):
			data += strings.TrimSpace(line[5:])
		}
	}
}
if failure != nil {
	panic(fmt.Sprintf("%v: %v (job %v)", failure["code"], failure["message"], failure["job_id"]))
}

full := streamed.String()
if out, ok := done["output"].(map[string]any); ok {
	if s, ok := out["output"].(string); ok && s != "" {
		full = s
	}
}
fmt.Println("truncated:", done["truncated"] == true, "charged:", done["charged_credits"])
var result map[string]any
if a, b := strings.Index(full, "{"), strings.LastIndex(full, "}"); a >= 0 && b > a {
	if err := json.Unmarshal([]byte(full[a:b+1]), &result); err != nil {
		panic(err)
	}
}
fmt.Println(result["verdict"], "-", result["headline"])
files, _ := result["files"].([]any)
for _, e := range files {
	f, _ := e.(map[string]any)
	c, _ := f["content"].(string)
	fmt.Println("file", f["path"], len([]rune(c)), "characters")
}
changes, _ := result["changes"].([]any)
for _, e := range changes {
	c, _ := e.(map[string]any)
	var flags []string
	if fs, ok := c["flags"].([]any); ok {
		for _, fl := range fs {
			flags = append(flags, fmt.Sprint(fl))
		}
	}
	fl := strings.Join(flags, ",")
	if fl == "" {
		fl = "-"
	}
	fmt.Println("change", c["function"], fl, "-", c["change"])
}
verify, _ := result["verify"].([]any)
for _, st := range verify {
	fmt.Println("verify", st)
}
open, _ := result["open"].([]any)
for _, e := range open {
	o, _ := e.(map[string]any)
	fmt.Println("open", o["item"], "-", o["reason"])
}
questions, _ := result["questions"].([]any)
for _, q := range questions {
	fmt.Println("question", q)
}

// the fix worked example: turret-check.json from build-check.js
// (for audited code, pass handoff.js's output instead: makeInput adds its audit_handoff)
Map<String, Object> fixInput = makeInput("fix", "turret-check.json",
    "The turret spins faster on my 144 Hz monitor and the game hitches every time it fires. Fix those. Leave the free() in take_hit exactly as it is for now - the level script checks for the turret on the same frame, and we will change both together.");
byte[] fixDigest = MessageDigest.getInstance("SHA-256").digest(JSON.writeValueAsBytes(fixInput));
String fixKey = "scriptward:fix:" + HexFormat.of().formatHex(fixDigest, 0, 8) + ":a1";

HttpRequest sreq = request("POST", "/run-stream", fixInput, Map.of("Idempotency-Key", fixKey)).build();
HttpResponse<Stream<String>> sres = HTTP.send(sreq, HttpResponse.BodyHandlers.ofLines());

JsonNode done = null, failure = null;
StringBuilder streamed = new StringBuilder();
if (!sres.headers().firstValue("content-type").orElse("").contains("text/event-stream")) {
  JsonNode env = JSON.readTree(sres.body().collect(Collectors.joining("\n")));
  if (env == null) env = JSON.createObjectNode();
  if (sres.statusCode() / 100 != 2) throw errorFrom(sres.statusCode(), env);
  done = env.path("data");
} else {
  String event = "message";
  StringBuilder data = new StringBuilder();
  Iterator<String> it = sres.body().iterator();
  while (it.hasNext()) {
    String line = it.next();
    if (line.isEmpty()) {                        // a blank line ends a frame
      if (data.length() > 0) {
        JsonNode p = null;
        try { p = JSON.readTree(data.toString()); } catch (Exception ignored) { }
        if (p != null) {
          switch (event) {
            case "delta": streamed.append(p.path("text").asText("")); break;
            case "job": System.out.println("job " + p); break;
            case "done": case "pending": done = p; break;
            case "error": failure = p; break;
            default: break;
          }
        }
      }
      event = "message";
      data.setLength(0);
    } else if (line.startsWith("event:")) event = line.substring(6).trim();
    else if (line.startsWith("data:")) data.append(line.substring(5).trim());
  }
}
if (failure != null) {
  throw new RuntimeException(failure.path("code").asText() + ": " + failure.path("message").asText()
      + " (job " + failure.path("job_id").asText() + ")");
}

String full = done == null ? "" : done.path("output").path("output").asText("");
if (full.isEmpty()) full = streamed.toString();
System.out.println("truncated: " + (done != null && done.path("truncated").asBoolean(false))
    + ", charged: " + (done == null ? "-" : done.path("charged_credits").toString()));
JsonNode result = JSON.readTree(full.substring(full.indexOf('{'), full.lastIndexOf('}') + 1));
System.out.println(result.path("verdict").asText() + " - " + result.path("headline").asText());
for (JsonNode f : result.path("files")) {
  System.out.println("file " + f.path("path").asText() + " " + f.path("content").asText("").codePointCount(0, f.path("content").asText("").length()) + " characters");
}
for (JsonNode c : result.path("changes")) {
  List<String> flags = new ArrayList<>();
  c.path("flags").forEach(fl -> flags.add(fl.asText()));
  System.out.println("change " + c.path("function").asText() + " " + (flags.isEmpty() ? "-" : String.join(",", flags))
      + " - " + c.path("change").asText());
}
for (JsonNode step : result.path("verify")) System.out.println("verify " + step.asText());
for (JsonNode o : result.path("open")) System.out.println("open " + o.path("item").asText() + " - " + o.path("reason").asText());
for (JsonNode q : result.path("questions")) System.out.println("question " + q.asText());

# the fix worked example: turret-check.json from build-check.js
# (for audited code, pass handoff.js's output instead: make_input adds its audit_handoff)
fix_input = make_input("fix", "turret-check.json",
                       "The turret spins faster on my 144 Hz monitor and the game hitches every time it fires. Fix those. Leave the free() in take_hit exactly as it is for now - the level script checks for the turret on the same frame, and we will change both together.")
fix_key = "scriptward:fix:#{Digest::SHA256.hexdigest(JSON.generate(fix_input))[0, 16]}:a1"

uri, req = build_request("POST", "/run-stream", fix_input, { "Idempotency-Key" => fix_key })
done = failure = nil
streamed = +""

Net::HTTP.start(uri.host, uri.port, use_ssl: true, read_timeout: 300) do |http|
  http.request(req) do |res|
    unless res["content-type"].to_s.include?("text/event-stream")
      env = (JSON.parse(res.body) rescue {})
      unless res.is_a?(Net::HTTPSuccess)
        raise ApiError.new(res.code.to_i, env.dig("error", "code"), env.dig("error", "message") || res.message)
      end
      done = env["data"]
      next
    end
    buf = +""
    res.read_body do |chunk|
      buf << chunk
      while (i = buf.index("\n\n"))
        frame = buf.slice!(0, i + 2)
        event = "message"
        data = +""
        frame.split("\n").each do |line|
          if line.start_with?("event:") then event = line[6..].strip
          elsif line.start_with?("data:") then data << line[5..].strip
          end
        end
        next if data.empty?
        payload = (JSON.parse(data) rescue nil)
        next if payload.nil?
        case event
        when "delta" then streamed << payload["text"].to_s
        when "job" then puts "job #{payload.inspect}"
        when "done", "pending" then done = payload
        when "error" then failure = payload
        end
      end
    end
  end
end

raise "#{failure["code"]}: #{failure["message"]} (job #{failure["job_id"]})" if failure
done ||= {}
full = (done["output"] || {})["output"].to_s
full = streamed if full.empty?
puts "truncated: #{done["truncated"] == true}, charged: #{done["charged_credits"]}"
result = JSON.parse(full[full.index("{")..full.rindex("}")])
puts "#{result["verdict"]} - #{result["headline"]}"
(result["files"] || []).each { |f| puts "file #{f["path"]} #{f["content"].to_s.length} characters" }
(result["changes"] || []).each do |c|
  flags = (c["flags"] || []).join(",")
  puts "change #{c["function"]} #{flags.empty? ? "-" : flags} - #{c["change"]}"
end
(result["verify"] || []).each { |step| puts "verify #{step}" }
(result["open"] || []).each { |o| puts "open #{o["item"]} - #{o["reason"]}" }
(result["questions"] || []).each { |q| puts "question #{q}" }

// the fix worked example: turret-check.json from build-check.js
// (for audited code, pass handoff.js's output instead: make_input adds its audit_handoff)
$fixInput = make_input("fix", "turret-check.json",
    "The turret spins faster on my 144 Hz monitor and the game hitches every time it fires. Fix those. Leave the free() in take_hit exactly as it is for now - the level script checks for the turret on the same frame, and we will change both together.");
$fixKey = "scriptward:fix:" . substr(hash("sha256", json_encode($fixInput)), 0, 16) . ":a1";

$done = null; $failure = null; $streamed = ""; $buf = ""; $ctype = "";

$handle = function (string $event, string $data) use (&$done, &$failure, &$streamed) {
    $p = json_decode($data);
    if ($p === null) return;                    // not JSON: skipped, as sdk.js does
    switch ($event) {
        case "delta": $streamed .= $p->text ?? ""; break;
        case "job": echo "job ", json_encode($p), "\n"; break;
        case "done": case "pending": $done = $p; break;
        case "error": $failure = $p; break;
    }
};

$ch = curl_init(BASE . "/run-stream");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => headers_for(["Idempotency-Key" => $fixKey]),
    CURLOPT_POSTFIELDS => json_encode($fixInput, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE),
    CURLOPT_HEADERFUNCTION => function ($ch, $line) use (&$ctype) {
        if (stripos($line, "content-type:") === 0) $ctype = strtolower(trim(substr($line, 13)));
        return strlen($line);
    },
    CURLOPT_WRITEFUNCTION => function ($ch, $chunk) use (&$buf, &$ctype, $handle) {
        $buf .= $chunk;                         // collects the response in memory
        if (strpos($ctype, "text/event-stream") === false) return strlen($chunk); // plain JSON: parse at the end
        while (($i = strpos($buf, "\n\n")) !== false) {
            $frame = substr($buf, 0, $i);
            $buf = substr($buf, $i + 2);
            $event = "message"; $data = "";
            foreach (explode("\n", $frame) as $line) {
                if (strpos($line, "event:") === 0) $event = trim(substr($line, 6));
                elseif (strpos($line, "data:") === 0) $data .= trim(substr($line, 5));
            }
            if ($data !== "") $handle($event, $data);
        }
        return strlen($chunk);
    },
]);
if (curl_exec($ch) === false) throw new RuntimeException(curl_error($ch));
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if (strpos($ctype, "text/event-stream") === false) {
    $env = json_decode($buf) ?? new stdClass();
    if ($status < 200 || $status > 299) {
        throw new ApiError($status, $env->error->code ?? null, $env->error->message ?? "HTTP $status");
    }
    $done = $env->data ?? null;
}
if ($failure) throw new RuntimeException(($failure->code ?? "") . ": " . ($failure->message ?? "") . " (job " . ($failure->job_id ?? "") . ")");

$full = $done->output->output ?? "";
if ($full === "") $full = $streamed;
echo "truncated: ", json_encode(($done->truncated ?? false) === true), ", charged: ", $done->charged_credits ?? "-", "\n";
$result = json_decode(substr($full, strpos($full, "{"), strrpos($full, "}") - strpos($full, "{") + 1));
echo $result->verdict, " - ", $result->headline, "\n";
foreach ($result->files ?? [] as $f) echo "file ", $f->path, " ", mb_strlen($f->content ?? ""), " characters\n";
foreach ($result->changes ?? [] as $c) {
    $flags = implode(",", $c->flags ?? []);
    echo "change ", $c->function ?? "", " ", $flags === "" ? "-" : $flags, " - ", $c->change ?? "", "\n";
}
foreach ($result->verify ?? [] as $step) echo "verify ", $step, "\n";
foreach ($result->open ?? [] as $o) echo "open ", $o->item, " - ", $o->reason ?? "", "\n";
foreach ($result->questions ?? [] as $q) echo "question ", $q, "\n";

// the fix worked example: turret-check.json from build-check.js
// (for audited code, pass handoff.js's output instead: MakeInput adds its audit_handoff)
var fixInput = MakeInput("fix", "turret-check.json",
    "The turret spins faster on my 144 Hz monitor and the game hitches every time it fires. Fix those. Leave the free() in take_hit exactly as it is for now - the level script checks for the turret on the same frame, and we will change both together.");
var fixDigest = System.Security.Cryptography.SHA256.HashData(Encoding.UTF8.GetBytes(JsonSerializer.Serialize(fixInput)));
var fixKey = "scriptward:fix:" + Convert.ToHexString(fixDigest, 0, 8).ToLowerInvariant() + ":a1";

using var sreq = Api.Request("POST", "/run-stream", fixInput, new Dictionary<string, string> { ["Idempotency-Key"] = fixKey });
using var sres = await Api.Http.SendAsync(sreq, HttpCompletionOption.ResponseHeadersRead);

JsonNode? done = null, failure = null;
var streamed = new StringBuilder();
if (sres.Content.Headers.ContentType?.MediaType != "text/event-stream")
{
    JsonNode? env = null;
    try { env = JsonNode.Parse(await sres.Content.ReadAsStringAsync()); } catch (JsonException) { }
    if (!sres.IsSuccessStatusCode) throw Api.ErrorFrom(sres, env);
    done = env?["data"];
}
else
{
    using var reader = new StreamReader(await sres.Content.ReadAsStreamAsync());
    var ev = "message";
    var data = new StringBuilder();
    string? line;
    while ((line = await reader.ReadLineAsync()) != null)
    {
        if (line.Length == 0)                    // a blank line ends a frame
        {
            if (data.Length > 0)
            {
                JsonNode? p = null;
                try { p = JsonNode.Parse(data.ToString()); } catch (JsonException) { }
                if (p != null)
                {
                    switch (ev)
                    {
                        case "delta": streamed.Append(p["text"]?.GetValue<string>() ?? ""); break;
                        case "job": Console.WriteLine($"job {p.ToJsonString()}"); break;
                        case "done": case "pending": done = p; break;
                        case "error": failure = p; break;
                    }
                }
            }
            ev = "message";
            data.Clear();
        }
        else if (line.StartsWith("event:")) ev = line[6..].Trim();
        else if (line.StartsWith("data:")) data.Append(line[5..].Trim());
    }
}
if (failure != null) throw new Exception($"{failure["code"]}: {failure["message"]} (job {failure["job_id"]})");

var full = done?["output"]?["output"]?.GetValue<string>();
if (string.IsNullOrEmpty(full)) full = streamed.ToString();
var cut = done?["truncated"] is JsonValue tv && tv.TryGetValue(out bool cutShort) && cutShort;
Console.WriteLine($"truncated: {cut}, charged: {done?["charged_credits"]}");
var result = JsonNode.Parse(full[full.IndexOf('{')..(full.LastIndexOf('}') + 1)])!;
Console.WriteLine($"{result["verdict"]} - {result["headline"]}");
foreach (var f in result["files"]?.AsArray() ?? new JsonArray())
    Console.WriteLine($"file {f?["path"]} {(f?["content"]?.GetValue<string>() ?? "").Length} characters");
foreach (var c in result["changes"]?.AsArray() ?? new JsonArray())
{
    var flags = string.Join(",", (c?["flags"]?.AsArray() ?? new JsonArray()).Select(fl => fl?.GetValue<string>()));
    Console.WriteLine($"change {c?["function"]} {(flags == "" ? "-" : flags)} - {c?["change"]}");
}
foreach (var step in result["verify"]?.AsArray() ?? new JsonArray()) Console.WriteLine($"verify {step}");
foreach (var o in result["open"]?.AsArray() ?? new JsonArray()) Console.WriteLine($"open {o?["item"]} - {o?["reason"]}");
foreach (var q in result["questions"]?.AsArray() ?? new JsonArray()) Console.WriteLine($"question {q}");

What the page does that you now do

• Reads the paste in the browser and builds code and facts from it (gdkit.js), joining dropped files under # file: lines and cutting a large paste on whole files with a # [scriptward: not sent: ...] line; you send the same two strings.
• Prices every input with /estimate and refuses to run below min_credits, or on a paste with no GDScript it can read.
• Sends each attempt with an input- and lane-derived Idempotency-Key, and retries once with retry_note when a reply does not parse.
• Closes a cut-off JSON reply and shows what arrived when truncated is true or the stream ends early.
• Hands an audit to the fix lane as audit_handoff, with every edit applied to the paste first, and only while that edited paste is unchanged.
• Checks the reply against the code (recon.js), in the browser: files, lines, evidence, every edit applied in order (re-indented to the file’s tabs or spaces when that is the only match) and the free check re-run after each finding, flag answers and verdict; the fixed scripts put back, re-checked for mixed indentation, surviving funcs, parameters and signals, and matched against the changes list and the open items; and repeated credentials. recheck.js above runs the same checks for you.

Or skip all of this and use Scriptward in the browser: the check, the flags, the node-lookup, connection, signal and script inventories, putting an edit or the fixed scripts back into the paste, and the Markdown and CSV exports are free.